January 2007 - Test - lists.nanog.org

The Cidr Report
by cidr-report＠potaroo.net 12 Jan '07

12 Jan '07

This report has been generated at Fri Jan 12 21:45:54 2007 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 05-01-07 203862 133004 06-01-07 204012 133074 07-01-07 203992 133133 08-01-07 204055 133297 09-01-07 204137 133361 10-01-07 204234 133138 11-01-07 204266 133090 12-01-07 204271 133169 AS Summary 24021 Number of ASes in routing system 10158 Number of ASes announcing only one prefix 1522 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 90820096 Largest address span announced by an AS (/32s) AS721 : DISA-ASNBLK - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 12Jan07 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 204425 133198 71227 34.8% All ASes AS4134 1233 297 936 75.9% CHINANET-BACKBONE No.31,Jin-rong Street AS18566 984 106 878 89.2% COVAD - Covad Communications Co. AS4755 1044 172 872 83.5% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS9498 919 90 829 90.2% BBIL-AP BHARTI BT INTERNET LTD. AS4323 1060 304 756 71.3% TWTC - Time Warner Telecom, Inc. AS22773 712 47 665 93.4% CCINET-2 - Cox Communications Inc. AS11492 908 328 580 63.9% CABLEONE - CABLE ONE AS19262 757 183 574 75.8% VZGNI-TRANSIT - Verizon Internet Services Inc. AS7018 1522 990 532 35.0% ATT-INTERNET4 - AT&T WorldNet Services AS6197 1022 508 514 50.3% BATI-ATL - BellSouth Network Solutions, Inc AS17488 567 56 511 90.1% HATHWAY-NET-AP Hathway IP Over Cable Internet AS19916 567 70 497 87.7% ASTRUM-0001 - OLM LLC AS18101 499 32 467 93.6% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS721 747 295 452 60.5% DISA-ASNBLK - DoD Network Information Center AS17676 503 66 437 86.9% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS15270 494 80 414 83.8% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS4766 724 317 407 56.2% KIXS-AS-KR Korea Telecom AS9583 1023 618 405 39.6% SIFY-AS-IN Sify Limited AS8151 827 442 385 46.6% Uninet S.A. de C.V. AS2386 1104 735 369 33.4% INS-AS - AT&T Data Communications Services AS6467 415 51 364 87.7% ESPIRECOMM - Xspedius Communications Co. AS4812 429 69 360 83.9% CHINANET-SH-AP China Telecom (Group) AS3602 514 186 328 63.8% AS3602-RTI - Rogers Telecom Inc. AS16852 390 66 324 83.1% BROADWING-FOCAL - Broadwing Communications, Inc. AS33588 422 120 302 71.6% BRESNAN-AS - Bresnan Communications, LLC. AS6198 552 263 289 52.4% BATI-MIA - BellSouth Network Solutions, Inc AS6517 401 115 286 71.3% YIPESCOM - Yipes Communications, Inc. AS14654 304 32 272 89.5% WAYPORT - Wayport AS10139 303 33 270 89.1% SMARTBRO-PH-AP Smart Broadband, Inc. AS22047 307 38 269 87.6% VTR BANDA ANCHA S.A. Total 21253 6709 14544 68.4% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 64.7.112.0/21 AS13511 ITXC - ITXC 64.7.120.0/21 AS13537 ITXC-2 - ITXC 64.7.240.0/20 AS3602 AS3602-RTI - Rogers Telecom Inc. 64.13.192.0/18 AS31815 MEDIATEMPLE - Media Temple, Inc. 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.46.96.0/20 AS13680 AS13680 Hostway Corporation Tampa, FL 64.46.112.0/20 AS13680 AS13680 Hostway Corporation Tampa, FL 64.79.64.0/19 AS10789 BIGNET-AS - The Bignet 64.79.86.0/24 AS10789 BIGNET-AS - The Bignet 64.79.87.0/24 AS10789 BIGNET-AS - The Bignet 64.79.88.0/24 AS10789 BIGNET-AS - The Bignet 64.79.89.0/24 AS10789 BIGNET-AS - The Bignet 64.79.90.0/24 AS10789 BIGNET-AS - The Bignet 64.79.96.0/20 AS10789 BIGNET-AS - The Bignet 64.89.224.0/20 AS15276 MAX-LV - Intuitive Logic 64.89.224.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.225.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.226.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.232.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.239.0/24 AS15276 MAX-LV - Intuitive Logic 64.250.128.0/18 AS10789 BIGNET-AS - The Bignet 65.60.45.0/24 AS32311 JKS-ASN - JKS Media, LLC 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.163.96.0/20 AS25767 WAVEFORM - Waveform Technology, LLC 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.36.128.0/20 AS16527 GVTCINTERNET - Guadalupe Valley Telephone Co-op, Inc. 69.36.192.0/20 AS29804 INTEGRATIX - Integratix Inc. 69.55.108.0/24 AS4977 NET1 - Pecos Technologies 72.9.128.0/20 AS27572 THEBOE-27572 - The Boeing Company 72.9.130.0/24 AS29904 THEBOE-29904 - The Boeing Company 78.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 78.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 79.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 79.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 128.209.0.0/16 AS4017 BELLST - Bell Atlantic Science & Technology 131.64.0.0/12 AS721 DISA-ASNBLK - DoD Network Information Center 132.0.0.0/10 AS721 DISA-ASNBLK - DoD Network Information Center 137.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 138.136.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 139.56.0.0/19 AS14956 BROADVISION-ASN - Broadvision Inc. 139.56.72.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 159.3.211.0/24 AS2687 ATT-ASIAPACIFIC AT&T Global Network Services - EMEA 159.220.0.0/22 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.4.0/22 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.4.0/24 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.8.0/22 AS35528 REUTERS-UK2-AS Reuters-UK2 159.220.40.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.41.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.42.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.43.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.64.0/23 AS24977 MONEYLINE-UK Moneyline Telerate 162.54.122.0/24 AS5400 BT BT European Backbone 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 190.54.0.0/16 AS6429 Core Internet AT&T Chile 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS12582 TSF-DATANET-NGD-AS TSF MPLS VPN Services 192.69.107.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.108.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.177.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.81.160.0/24 AS719 ELISA-AS Elisa Oyj 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS29259 DE-IABG-TELEPORT IABG Teleport, DE 192.96.36.0/24 AS5713 SAIX-NET 192.96.37.0/24 AS10474 NETACTIVE 192.96.135.0/24 AS2018 TENET-1 192.96.136.0/23 AS2018 TENET-1 192.96.140.0/24 AS2018 TENET-1 192.96.143.0/24 AS2018 TENET-1 192.96.145.0/24 AS2018 TENET-1 192.96.177.0/24 AS6083 POSIX-AFRICA 192.96.250.0/24 AS2018 TENET-1 192.107.104.0/24 AS7137 TELEMATIX/ ENITEL 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.139.3.0/24 AS23184 PERSONA - PERSONA COMMUNICATIONS INC. 192.153.144.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 192.172.0.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 192.188.208.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 192.245.235.0/24 AS29748 CARPATHIA-HOSTING - Carpathia Hosting 193.43.228.0/22 AS8757 ACCESS11 Access 11 Ltd. (UK) 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.35.104.0/24 AS12445 SPIDERNET-AS Selene s.p.a. 196.6.108.0/24 AS5713 SAIX-NET 196.6.175.0/24 AS3741 IS 196.6.176.0/23 AS3741 IS 196.6.183.0/24 AS3741 IS 196.6.196.0/24 AS3741 IS 196.6.199.0/24 AS3741 IS 196.6.208.0/24 AS3741 IS 196.6.211.0/24 AS3741 IS 196.6.212.0/23 AS3741 IS 196.6.212.0/24 AS3741 IS 196.6.222.0/23 AS3741 IS 196.6.237.0/24 AS3741 IS 196.10.119.0/24 AS2018 TENET-1 196.10.122.0/23 AS2018 TENET-1 196.10.136.0/22 AS3741 IS 196.10.140.0/22 AS3741 IS 196.10.231.0/24 AS3741 IS 196.10.251.0/24 AS2018 TENET-1 196.10.252.0/23 AS2018 TENET-1 196.10.254.0/24 AS2018 TENET-1 196.11.0.0/20 AS3741 IS 196.11.40.0/21 AS3741 IS 196.11.135.0/24 AS3741 IS 196.11.188.0/23 AS3741 IS 196.11.190.0/24 AS3741 IS 196.11.251.0/24 AS3741 IS 196.13.101.0/24 AS2018 TENET-1 196.13.102.0/23 AS2018 TENET-1 196.13.104.0/24 AS2018 TENET-1 196.13.108.0/24 AS3741 IS 196.13.116.0/22 AS2018 TENET-1 196.13.121.0/24 AS2018 TENET-1 196.13.125.0/24 AS2018 TENET-1 196.13.126.0/24 AS2018 TENET-1 196.13.128.0/22 AS3741 IS 196.13.144.0/22 AS2905 TICSA-ASN 196.13.152.0/21 AS2905 TICSA-ASN 196.13.160.0/24 AS2905 TICSA-ASN 196.13.169.0/24 AS2018 TENET-1 196.13.174.0/23 AS2018 TENET-1 196.13.176.0/21 AS2018 TENET-1 196.13.188.0/22 AS2018 TENET-1 196.13.192.0/22 AS2018 TENET-1 196.13.196.0/24 AS2018 TENET-1 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET-1 198.54.92.0/24 AS2018 TENET-1 198.54.222.0/24 AS2018 TENET-1 198.54.249.0/24 AS2018 TENET-1 198.54.250.0/24 AS2018 TENET-1 198.54.251.0/24 AS2018 TENET-1 198.97.72.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.80.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.96.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.240.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 198.169.0.0/16 AS803 SASKTEL - SaskTel 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.128.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.130.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.132.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.150.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.0.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.16.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.80.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.175.64.0/19 AS6539 GT-BELL - Bell Canada 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 202.4.160.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.4.161.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.4.162.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.58.224.0/19 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.224.0/20 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.240.0/20 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.240.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.244.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.249.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.250.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.253.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.94.70.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.124.192.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.193.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.194.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.196.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.197.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.198.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.199.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.200.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.201.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.202.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.203.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.204.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.205.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.206.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.207.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.125.96.0/20 AS7693 COMNET-TH KSC Commercial Internet Co. Ltd. 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.100.0/24 AS18101 RIL-IDC Reliance Infocom Ltd Internet Data Centre, 202.182.32.0/22 AS10223 UECOMM-AU Uecomm Ltd 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.80.32.0/20 AS4817 DESTRA-AU-AP Destra Corporation 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.128.128.0/19 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 203.152.136.0/23 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.138.0/23 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.142.0/24 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.143.0/24 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.160.104.0/22 AS23914 OCI-AS-VN One-Connection Internet Company 203.160.110.0/23 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 204.29.196.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 204.29.197.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 204.48.58.0/24 AS4323 TWTC - Time Warner Telecom, Inc. 204.48.60.0/24 AS4323 TWTC - Time Warner Telecom, Inc. 204.153.68.0/24 AS4017 BELLST - Bell Atlantic Science & Technology 204.153.71.0/24 AS4017 BELLST - Bell Atlantic Science & Technology 204.153.104.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.143.144.0/21 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 207.7.64.0/19 AS14093 ITRIBE - iTRiBE, Inc. 207.189.62.0/23 AS7132 SBIS-AS - SBC Internet Services 207.191.224.0/23 AS2828 XO-AS15 - XO Communications 207.191.232.0/21 AS2828 XO-AS15 - XO Communications 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 207.246.192.0/20 AS5656 ACCESSUS-DOM - accessU.S./BASENet 209.105.224.0/19 AS20074 KNOWLEDGENET - KNOWLEDGENET 209.159.128.0/19 AS209 ASN-QWEST - Qwest 209.177.64.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 209.177.65.0/24 AS8088 SRTNET - SRT ENTERPRISES 209.177.66.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 209.177.68.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 209.177.70.0/24 AS19159 STING - Sting Communications 209.177.89.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 209.177.93.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 209.177.94.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 209.177.95.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.212.128.0/19 AS7453 GTINET - Gateway Telecommunications, Inc. 210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone 216.21.1.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.6.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.7.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.15.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.17.0/24 AS11652 DATATONE - Datatone Communications Inc 216.65.160.0/19 AS7770 TRITON - Triton Technologies, Inc. 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.230.224.0/20 AS15270 AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

Web Honeynet Project: announcement, exploit URLs this Wednesday
by Gadi Evron 11 Jan '07

11 Jan '07

[ Warning: this email message includes links to live web server malware propagated this Wednesday via file inclusions exploits. These links are not safe! ] Hello. The newly formed Web Honeynet Project from SecuriTeam and the ISOTF will in the next few months announce research on real-world web server attacks which infect web servers with: Tools, connect-back shells, bots, downloaders, malware, etc. which are all cross-platform (for web servers) and currently exploited in the wild. The Web Honeynet Project will, for now, not deal with the regular SQL injection and XSS attacks every web security expert loves so much, but just with malware and code execution attacks on web servers and hosting farms. These attacks form botnets constructed from web servers (mainly IIS and Apache on Linux and Windows servers) and transform hosting farms/colos to attack platforms. Most of these "tools" are being injected by (mainly) file inclusion attacks against (mainly) PHP web applications, as is well known and established. PHP (or scripting) shells, etc. have been known for a while, as well as file inclusion (or RFI) attacks, however, mostly as something secondary and not much (if any - save for some blogs and a few mailing list posts a year ago) attention was given to the subject other than to the vulnerabilities themselves. The bad guys currently exploit, create botnets and deface in a massive fashion and force ISPs and colos to combat an impossible situation where any (mainly) PHP application from any user can exploit entire server farms, and where the web vulnerability serves as a remote exploit to be followed by a local code execution one, or as a direct one. What is new here is the scale, and the fact we now start engaging the bad guys on this front (which so far, they have been unchallenged on) - meaning aside for research, the Web Honeynet Project will also release actionable data on offensive IP addresses, URLs and on the tools themselves to be made available to operational folks, so that they can mitigate the threat. It's long overdue that we start the escalation war with web server attackers, much like we did with spam and botnets, etc. years ago. Several folks (and quite loudly - me) have been warning about this for a while, not it's time to take action instead of talk. :) Note: Below you can find sample statistics on some of the Web Honeynet Project information for this last Wednesday, on file inclusion attacks seeding malware. You will likely notice most of these have been taken care of by now. The first research on the subject (after looking into several hundred such tools) will be made public in the February edition of the Virus Bulletin magazine, from: Kfir Damari, Noam Rathaus and Gadi Evron (yours truly). The SecuriTeam and ISOTF Web Honeynet Project would like to thank Beyond Security ( http://www.beyondsecurity.com ) for all the support. Special thanks (so far) to: Ryan Carter, Randy Vaughn and the rest of the new members of the project. For more information on the Web Honeynet Project feel free to contact me. Also, thanks for yet others who helped me form this research and operations hybrid project (you know who you are). Gadi. Sample report and statistics (for Wednesday the 10th of January, 2007): IP | Hit Count | Malware (Count), ... | 195.225.130.118 | 12 | http://m embers.lycos.co.uk/onuhack/cmd1.do? (4), http://m embers.lycos.co.uk/onuhack/injek.txt? (6), http://m embers.lycos.co.uk/onuhack/cmd.do? (2), 69.93.147.242 | 11 | http://w ww.clubmusic.caucasus.net/administrator/cmd.gif? (1), http://c lubmusic.caucasus.net/administrator/cmd.gif? (4), http://w ww.ucanartists.org/components/com_extcalendar/cmd.gif? (5), http://t bchat.caucasus.net/cmd.gif? (1), 216.22.3.11 | 8 | http://h eidi.by.ru/cmdi.txt? (7), http://h eidiz.by.ru/cmdi.txt? (1), 62.149.36.116 | 8 | http://w ww.fc-magdeburg.de/jscripts/tiny_mce/plugins/pic.gif?? (3), http://w ww.discoverchimpanzees.org/blog/sendit.jpg?? (2), http://u bk.no-ip.biz/shine.jpg?? (1), http://w ww.sle.br/polvo2/script/ftv3doc.gif?? (1), http://w ww.sle.br/polvo2/css/css.gif?? (1), 85.25.148.178 | 7 | h ttp://213.133.108.122/alex.gif? (1), http://c lubmusic.caucasus.net/Administrator/cmd.gif? (5), http://w ww.ucanartists.org/components/com_extcalendar/cmd.gif? (1), 69.13.6.170 | 7 | http://c ajem.by.ru/cmd.gif? (3), http://k ama.opensolarisproject.com/phpBB2/files/cmd.gif? (1), http://s upsup.by.ru/cmd.gif? (2), http://w ww.bhlynx.org/htdig/sad.gif? (1), 201.63.179.122 | 7 | http://d arkhand.netfast.org/list.txt??? (2), http://w ww.locman.net/Guide/vkod/list.txt?? (3), http://g odarmy.net/cmd.txt?? (1), http://c hapolin.by.ru/cmds/list.txt? (1), 219.67.171.131 | 7 | http://i ntra/ (7), 193.39.119.174 | 6 | http://w ww.sirmet.it/pronti/cmd.txt?? (1), http://w ww.overclockers.pl/images/r57.gif? (1), http://w ww.rldiseno.com/administrator/components/com_remository/morgancmd.gif? (1), http://v irtual.uarg.unpa.edu.ar/myftp/list.txt? (1), http://w ww.sirmet.it/pronti/cmd.txt? (1), http://v irtual.uarg.unpa.edu.ar/myftp/list.txt?? (1), 80.74.142.173 | 6 | http://7 2.232.231.10/~superbr/tk.txt?? (1), http://t hebesthack.altervista.org/soka.txt? (2), http://m rmorte.by.ru/r57.swf?&add=bot (1), http://w ww.bhlynx.org/htdig/UPLOADING/full.gif? (2), Statistics: IP Count (Unique): 11 Hit Count: 79 (from same IP: 86.08%) Malware | Hit Count | IPs (Count), ... | cmd.gif | 279 | 69.93.147.242 (11), 85.25.148.178 (6), 69.13.6.170 (6), 211.174.52.20 (4), 205.234.146.49 (4), 85.25.7.109 (3), 201.9.252.67 (3), 204.157.9.185 (3), 216.46.205.101 (3), 70.86.237.202 (3), 66.228.211.16 (3), 206.225.82.46 (3), 213.192.241.44 (3), 82.208.181.122 (2), 64.34.203.104 (2), 216.104.149.111 (2), 201.19.41.223 (2), 140.138.2.234 (2), 82.194.78.30 (2), 151.8.228.196 (2), 82.194.70.92 (2), 66.111.45.130 (2), 202.8.87.197 (2), 194.30.160.101 (2), 83.149.84.184 (2), 83.65.141.130 (2), 70.84.49.42 (2), 203.146.247.79 (2), 212.34.138.206 (2), 72.22.90.219 (2), 216.16.246.240 (2), 195.214.44.149 (2), 193.84.250.29 (2), 130.94.69.17 (2), 216.174.97.241 (2), 202.5.195.7 (2), 201.9.216.138 (2), 62.149.140.17 (2), 213.202.247.177 (2), 66.249.137.127 (2), 69.31.45.194 (2), 65.98.67.250 (2), 200.32.5.203 (2), 62.152.64.210 (2), 81.169.155.146 (2), 62.75.247.5 (2), 201.50.166.11 (2), 62.103.159.219 (1), 82.165.181.50 (1), 201.19.27.135 (1), 200.62.64.1 (1), 84.191.92.243 (1), 72.21.56.226 (1), 193.93.22.78 (1), 65.111.169.4 (1), 205.234.105.84 (1), 81.169.176.252 (1), 208.53.170.148 (1), 87.253.128.30 (1), 148.244.125.3 (1), 216.22.24.29 (1), 216.237.124.82 (1), 82.79.190.155 (1), 216.55.155.27 (1), 69.64.34.14 (1), 193.189.139.51 (1), 62.149.36.24 (1), 62.193.237.34 (1), 212.227.127.183 (1), 203.22.204.167 (1), 201.19.33.183 (1), 202.75.40.172 (1), 62.213.96.213 (1), 69.26.178.141 (1), 66.62.91.188 (1), 65.98.24.42 (1), 62.90.247.53 (1), 213.190.10.170 (1), 195.225.196.213 (1), 81.33.30.22 (1), 202.75.48.81 (1), 201.27.130.105 (1), 80.86.83.26 (1), 201.8.170.227 (1), 195.117.34.114 (1), 209.200.229.90 (1), 204.157.11.179 (1), 203.150.230.119 (1), 194.135.81.25 (1), 213.171.206.174 (1), 69.9.37.130 (1), 201.19.41.150 (1), 201.238.227.107 (1), 72.36.228.18 (1), 80.32.187.191 (1), 205.234.190.102 (1), 203.130.242.71 (1), 193.165.77.26 (1), 172.178.51.210 (1), 200.42.92.84 (1), 65.110.9.76 (1), 62.193.238.124 (1), 84.19.176.212 (1), 85.13.128.214 (1), 66.199.183.131 (1), 217.156.103.28 (1), 212.227.127.159 (1), 64.239.45.44 (1), 70.84.183.130 (1), 70.84.178.34 (1), 83.243.43.98 (1), 189.141.43.211 (1), 65.254.50.114 (1), 70.85.230.210 (1), 85.25.134.185 (1), 64.66.120.30 (1), 216.32.67.66 (1), 195.140.142.111 (1), 200.217.200.13 (1), 80.190.243.85 (1), 200.21.85.98 (1), 201.9.214.114 (1), 194.177.128.241 (1), 201.19.41.112 (1), 82.192.67.66 (1), 81.169.177.159 (1), 208.53.170.15 (1), 72.29.93.179 (1), 64.118.85.15 (1), 61.64.159.247 (1), 213.188.35.62 (1), 72.36.229.154 (1), 193.238.106.20 (1), 198.173.64.81 (1), 62.193.238.72 (1), 203.162.202.137 (1), 208.49.83.50 (1), 82.150.135.90 (1), 201.9.192.32 (1), 204.157.10.95 (1), 70.84.86.122 (1), 85.221.229.18 (1), 81.88.17.101 (1), 209.112.56.11 (1), 67.19.48.116 (1), 193.109.252.107 (1), 205.234.252.143 (1), 65.254.139.52 (1), 62.75.177.72 (1), 82.165.177.145 (1), 201.19.24.185 (1), 8.6.223.5 (1), 213.115.183.36 (1), 205.205.189.1 (1), 212.227.119.154 (1), 85.12.17.242 (1), 212.204.213.31 (1), 212.97.96.139 (1), 195.34.78.100 (1), 201.19.43.137 (1), 62.193.228.59 (1), 66.232.114.230 (1), 216.193.201.201 (1), 200.101.93.29 (1), 69.56.245.170 (1), 66.201.119.2 (1), 81.182.246.8 (1), 194.145.200.200 (1), 202.188.124.52 (1), 62.193.216.17 (1), 213.251.172.103 (1), 66.36.240.45 (1), 217.160.226.5 (1), 212.241.192.85 (1), 65.19.139.183 (1), 69.73.175.50 (1), 193.138.206.126 (1), 74.52.220.58 (1), 66.226.74.90 (1), 72.232.9.238 (1), 83.143.85.50 (1), 64.76.24.214 (1), 202.158.89.67 (1), 12.6.95.21 (1), 217.160.226.2 (1), 82.195.230.142 (1), 64.20.50.35 (1), 70.85.221.154 (1), 72.36.179.162 (1), 212.227.96.202 (1), 64.91.255.130 (1), 209.160.32.106 (1), 209.59.163.222 (1), 213.186.34.130 (1), 216.227.215.62 (1), 201.9.209.49 (1), 72.29.64.229 (1), 200.162.196.214 (1), 213.247.60.210 (1), 72.9.248.146 (1), 205.234.235.173 (1), 218.150.78.201 (1), 64.34.166.126 (1), cmd.txt | 123 | 87.238.209.101 (5), 212.110.122.165 (3), 62.193.237.22 (3), 64.3.156.59 (3), 81.29.75.112 (2), 217.160.252.4 (2), 85.119.219.36 (2), 204.157.15.189 (2), 212.241.192.113 (2), 193.6.6.101 (2), 81.57.112.15 (2), 207.58.177.50 (2), 200.255.50.131 (2), 202.5.195.7 (2), 213.240.243.15 (2), 193.39.119.174 (2), 64.34.203.104 (1), 203.36.0.15 (1), 82.192.87.144 (1), 201.75.27.149 (1), 85.98.229.152 (1), 88.232.110.242 (1), 201.63.179.122 (1), 213.189.27.96 (1), 87.238.208.100 (1), 201.19.16.223 (1), 204.2.106.3 (1), 62.75.251.113 (1), 66.111.45.130 (1), 201.58.41.9 (1), 72.232.53.210 (1), 82.165.183.17 (1), 88.226.0.154 (1), 208.234.20.125 (1), 66.18.160.59 (1), 85.12.147.20 (1), 195.39.35.115 (1), 85.107.94.14 (1), 81.215.251.88 (1), 62.166.203.203 (1), 200.168.144.40 (1), 62.193.226.73 (1), 88.226.0.79 (1), 72.36.190.242 (1), 82.98.74.4 (1), 194.44.38.218 (1), 64.8.114.14 (1), 70.84.205.34 (1), 220.134.22.185 (1), 84.244.146.209 (1), 82.160.16.3 (1), 85.101.26.131 (1), 86.127.26.72 (1), 85.106.226.172 (1), 85.101.195.146 (1), 69.61.12.2 (1), 65.254.36.146 (1), 64.34.168.95 (1), 213.188.35.62 (1), 85.97.85.192 (1), 213.251.168.77 (1), 201.92.114.224 (1), 208.49.83.50 (1), 85.103.172.119 (1), 66.228.211.16 (1), 86.109.192.86 (1), 80.118.168.219 (1), 201.75.60.132 (1), 81.169.175.152 (1), 200.168.144.175 (1), 85.214.42.118 (1), 213.161.194.235 (1), 205.205.189.1 (1), 85.108.187.234 (1), 85.99.187.79 (1), 87.118.98.140 (1), 195.34.78.100 (1), 85.107.93.3 (1), 64.0.197.99 (1), 207.58.138.211 (1), 204.15.121.100 (1), 195.46.154.122 (1), 210.196.116.84 (1), 201.29.65.167 (1), 203.63.5.173 (1), 200.29.2.93 (1), 85.97.126.185 (1), 86.127.29.111 (1), 85.98.5.167 (1), 70.85.23.132 (1), 200.89.73.35 (1), 81.214.168.249 (1), 86.127.26.31 (1), 193.202.89.13 (1), 200.243.56.196 (1), 85.99.224.67 (1), 207.58.129.57 (1), 84.191.212.176 (1), 64.118.84.10 (1), 82.98.225.171 (1), 85.99.141.199 (1), list.txt | 106 | 201.63.179.122 (6), 72.29.71.211 (3), 62.149.140.15 (3), 216.139.67.90 (2), 207.150.191.52 (2), 195.149.99.131 (2), 209.172.34.86 (2), 70.85.154.226 (2), 70.87.86.130 (2), 202.143.173.2 (2), 193.39.119.174 (2), 84.252.146.194 (2), 81.169.155.146 (2), 72.52.184.4 (1), 213.251.132.191 (1), 82.165.235.5 (1), 216.22.24.29 (1), 72.29.68.123 (1), 216.104.149.111 (1), 69.16.207.166 (1), 154.37.2.50 (1), 216.180.243.242 (1), 72.232.91.130 (1), 66.227.122.97 (1), 216.55.147.90 (1), 63.146.198.100 (1), 193.226.140.228 (1), 67.19.80.180 (1), 216.130.161.111 (1), 66.197.195.101 (1), 216.7.178.164 (1), 64.27.5.179 (1), 69.72.224.106 (1), 204.157.11.179 (1), 217.112.42.25 (1), 82.102.15.13 (1), 81.169.167.240 (1), 72.36.158.226 (1), 209.59.195.31 (1), 218.36.126.67 (1), 66.7.200.164 (1), 63.247.139.69 (1), 70.84.146.130 (1), 65.254.50.114 (1), 87.17.78.245 (1), 194.30.160.11 (1), 202.130.106.156 (1), 209.59.130.114 (1), 194.79.71.157 (1), 201.42.41.18 (1), 200.146.61.40 (1), 203.88.114.169 (1), 161.132.144.50 (1), 151.51.63.190 (1), 194.145.127.68 (1), 134.58.253.114 (1), 67.91.198.51 (1), 91.121.7.26 (1), 72.21.51.210 (1), 72.18.130.32 (1), 209.33.215.180 (1), 210.0.211.228 (1), 205.234.99.226 (1), 88.149.156.142 (1), 62.149.140.18 (1), 209.51.140.2 (1), 70.86.172.210 (1), 64.151.90.220 (1), 200.241.111.203 (1), 67.18.167.138 (1), 81.4.74.238 (1), 82.163.66.89 (1), 216.117.150.82 (1), 201.26.46.108 (1), 87.118.98.140 (1), 216.227.217.6 (1), 64.0.197.99 (1), 193.25.197.122 (1), 72.29.73.71 (1), 200.101.93.29 (1), 83.143.81.2 (1), 200.216.87.236 (1), 83.243.154.180 (1), 72.36.202.166 (1), 216.246.45.69 (1), 210.208.204.56 (1), 38.118.74.77 (1), c.txt | 60 | 213.193.229.39 (5), 86.54.102.2 (4), 195.10.193.5 (3), 62.231.119.106 (3), 193.25.197.127 (3), 202.64.87.188 (2), 207.58.142.226 (2), 65.75.190.245 (2), 158.66.1.12 (2), 209.47.167.151 (2), 193.198.217.3 (1), 67.15.42.38 (1), 85.158.249.30 (1), 70.86.48.66 (1), 82.80.253.45 (1), 69.90.141.2 (1), 201.34.32.66 (1), 216.17.101.249 (1), 202.83.173.216 (1), 196.203.35.2 (1), 195.189.226.241 (1), 194.67.32.44 (1), 58.71.41.3 (1), 213.193.229.20 (1), 72.232.69.250 (1), 195.206.96.40 (1), 61.246.2.74 (1), 195.46.71.19 (1), 193.43.88.3 (1), 87.238.162.143 (1), 83.228.34.135 (1), 193.25.197.122 (1), 87.238.162.16 (1), 72.29.82.174 (1), 192.71.85.140 (1), 65.77.42.233 (1), 87.106.33.210 (1), 213.193.246.81 (1), 212.75.96.165 (1), 213.193.246.25 (1), 85.214.75.173 (1), 69.60.109.202 (1), cmd.do | 53 | 200.24.106.14 (4), 141.44.47.74 (3), 200.188.219.122 (2), 87.242.72.37 (2), 217.112.36.52 (2), 195.225.130.118 (2), 62.103.159.219 (1), 85.17.3.141 (1), 205.214.64.176 (1), 66.227.122.97 (1), 84.244.8.53 (1), 69.155.36.50 (1), 81.21.79.93 (1), 209.8.117.170 (1), 70.86.234.234 (1), 69.64.50.67 (1), 64.191.33.200 (1), 204.9.174.110 (1), 72.232.62.98 (1), 67.159.21.37 (1), 64.92.171.58 (1), 64.38.19.238 (1), 62.193.248.88 (1), 209.126.142.253 (1), 206.51.236.115 (1), 216.227.218.113 (1), 85.25.59.184 (1), 213.83.63.53 (1), 208.49.83.50 (1), 208.101.43.190 (1), 62.116.130.180 (1), 67.18.229.90 (1), 147.94.192.41 (1), 66.225.239.199 (1), 91.143.130.1 (1), 81.57.112.15 (1), 70.86.207.162 (1), 216.194.64.235 (1), 69.56.243.130 (1), 222.237.78.168 (1), 163.29.233.6 (1), 209.123.92.40 (1), 198.77.13.98 (1), 62.4.84.36 (1), c.in | 51 | 212.12.121.43 (3), 66.103.152.111 (3), 202.123.79.16 (3), 193.138.230.200 (3), 62.221.213.68 (2), 64.8.118.5 (2), 66.230.196.135 (2), 64.199.142.69 (2), 209.47.167.151 (2), 66.246.134.221 (1), 67.19.143.130 (1), 89.207.232.18 (1), 204.11.234.28 (1), 64.38.11.6 (1), 64.15.138.182 (1), 63.245.201.68 (1), 62.4.70.180 (1), 62.193.229.152 (1), 87.233.12.130 (1), 70.86.36.194 (1), 209.47.139.138 (1), 67.19.224.66 (1), 81.183.219.157 (1), 213.193.230.201 (1), 70.86.151.130 (1), 66.7.193.220 (1), 218.38.14.205 (1), 72.22.69.224 (1), 189.146.75.42 (1), 75.126.58.208 (1), 72.36.155.170 (1), 70.84.122.194 (1), 66.235.206.151 (1), 72.51.35.25 (1), 204.16.246.8 (1), 67.18.252.98 (1), 202.139.20.8 (1), 85.92.70.238 (1), tk.txt | 48 | 83.137.17.37 (2), 202.181.206.50 (2), 61.194.40.108 (2), 72.5.54.40 (2), 203.146.140.221 (1), 205.234.190.84 (1), 216.61.218.2 (1), 66.226.64.33 (1), 198.64.149.204 (1), 64.202.123.184 (1), 82.217.225.104 (1), 87.233.14.82 (1), 205.234.190.102 (1), 62.193.234.11 (1), 212.80.70.2 (1), 87.117.224.250 (1), 72.36.190.242 (1), 69.0.231.197 (1), 62.111.211.194 (1), 64.8.114.14 (1), 81.29.195.54 (1), 213.192.241.47 (1), 209.59.137.106 (1), 69.64.33.9 (1), 212.34.138.238 (1), 209.172.34.86 (1), 80.74.142.173 (1), 194.109.148.172 (1), 216.120.228.160 (1), 62.193.228.59 (1), 217.71.214.135 (1), 67.159.26.207 (1), 212.241.248.177 (1), 211.115.217.151 (1), 150.140.140.91 (1), 209.126.254.191 (1), 213.240.243.15 (1), 201.32.170.233 (1), 64.76.24.214 (1), 62.193.226.57 (1), 200.161.198.118 (1), 213.184.216.134 (1), 206.251.247.140 (1), 204.14.110.100 (1), sad.gif | 40 | 212.110.122.165 (2), 81.169.175.152 (2), 82.208.181.122 (1), 193.93.22.78 (1), 216.246.60.183 (1), 216.70.72.167 (1), 205.234.223.151 (1), 62.75.161.45 (1), 85.17.53.242 (1), 216.7.178.164 (1), 219.95.3.182 (1), 128.121.21.33 (1), 218.111.135.154 (1), 194.204.11.67 (1), 200.162.196.187 (1), 69.13.6.170 (1), 220.134.22.185 (1), 67.19.25.34 (1), 200.234.201.118 (1), 67.19.71.228 (1), 210.245.226.52 (1), 83.143.81.22 (1), 64.20.33.154 (1), 81.0.254.66 (1), 72.232.25.58 (1), 64.34.169.139 (1), 68.23.46.65 (1), 204.157.11.61 (1), 212.3.242.140 (1), 81.222.134.125 (1), 222.122.46.217 (1), 202.5.195.7 (1), 198.173.81.121 (1), 222.122.31.173 (1), 72.36.155.138 (1), 64.106.143.220 (1), 83.14.225.50 (1), 213.239.175.53 (1), tool20.dat | 37 | 85.98.228.55 (3), 81.215.251.73 (2), 81.214.163.255 (2), 81.214.160.78 (1), 81.215.248.208 (1), 81.215.245.81 (1), 81.214.168.215 (1), 81.214.165.43 (1), 85.104.40.203 (1), 81.214.161.240 (1), 81.215.237.251 (1), 81.214.174.71 (1), 81.214.169.172 (1), 81.214.172.202 (1), 81.214.171.65 (1), 81.214.168.116 (1), 85.98.123.10 (1), 81.214.166.1 (1), 81.214.175.73 (1), 81.214.164.94 (1), 81.215.247.8 (1), 85.98.123.29 (1), 201.19.113.219 (1), 81.214.164.5 (1), 201.19.65.249 (1), 81.214.169.97 (1), 81.215.255.156 (1), 85.104.40.207 (1), 81.214.169.190 (1), 81.214.175.27 (1), 81.214.171.215 (1), 81.214.162.240 (1), 81.214.172.207 (1), c.php.txt | 32 | 81.183.219.157 (2), 64.199.142.69 (2), 202.60.74.106 (2), 84.19.182.32 (1), 72.36.192.42 (1), 193.164.131.35 (1), 85.43.93.220 (1), 65.42.183.2 (1), 81.92.6.204 (1), 70.84.178.34 (1), 195.2.72.34 (1), 72.232.214.242 (1), 66.165.236.122 (1), 72.29.75.151 (1), 195.138.198.28 (1), 208.101.29.107 (1), 67.19.37.228 (1), 66.103.130.131 (1), 70.86.36.194 (1), 195.238.74.73 (1), 219.93.90.33 (1), 66.235.209.82 (1), 85.25.11.42 (1), 66.45.242.178 (1), 66.235.206.151 (1), 195.2.72.35 (1), 69.93.128.17 (1), 212.24.224.18 (1), 72.232.6.132 (1), Statistics: Malware Count (Unique): 11 Malware Hit Count: 829 (from same IP: 98.67%)

1 0

RE: 4 Byte AS tested
by Geoff Huston 11 Jan '07

11 Jan '07

At 09:33 AM 12/01/2007, Anderson, Matthew R [NTK] wrote: >One test case I would like to see is alternating 2- and 4-byte ASNs >in the path. This may be harder. E.g., AS_PATH = 1239 23456 1221 >23456 23456 23456. Or how about an AS_PATH including the 4-byte ASN >placeholder (23456) whose origin is a 2-byte OLD speaker? E.g., >AS_PATH = 1239 23456 1221 23456 23456 23456 12234. I've done a number of small scale permutations with BGP configurations, but larger tests of the form you describe here will need some more willing participants, particularly if we are interested in doing this in the context of the Internet itself rather than in a collection of small scale ebgp peerings. Geoff

1 0

4 Byte AS tested
by Geoff Huston 11 Jan '07

11 Jan '07

# bgpctl show rib 203.10.62.0/24 flags: * = Valid, > = Selected, I = via IBGP, A = Announced origin: i = IGP, e = EGP, ? = Incomplete flags destination gateway lpref med aspath origin *> 203.10.62.0/24 147.28.0.1 100 0 0.3130 0.1239 0.4637 0.4637 0.4637 0.4637 0.4637 0.4637 0.1221 1.202 i George Michaelson, Randy Bush and myself have successfully tested the implementation of 4Byte AS BGP on a public Internet transit. The above BGP RIB snapshot was taken at a 4Byte BGP speaker in North America, showing a transit path across AS 1221, AS 4637, AS 1239 and AS 3130 , with correct reconstruction of the originating AS at the other (4Byte AS) end. The code base used was OpenBGPD, with 4 byte patches that I've added to the code in the past couple of weeks. (Patched versions of openbgpd to include 4-byte AS support can be found at http://www.potaroo.net/tools/bgpd/) cheers, Geoff

9 13

Re: 4 Byte AS tested
by Randy Bush 11 Jan '07

11 Jan '07

Anderson, Matthew R [NTK] wrote: > One test case I would like to see is alternating 2- and 4-byte ASNs in the path. This may be harder. E.g., AS_PATH = 1239 23456 1221 23456 23456 23456. Or how about an AS_PATH including the 4-byte ASN placeholder (23456) whose origin is a 2-byte OLD speaker? E.g., AS_PATH = 1239 23456 1221 23456 23456 23456 12234. line wrap! good idea. and you could do that in your lab using the openbgp and quagga kits posted to the net today! please tell us how it goes. randy

1 0

Anything going on in Atlanta, GA?
by Dean, Matt 11 Jan '07

11 Jan '07

Good evening, I'm currently seeing a routing loop in Atlanta, GA. I've contacted the ISP with no response yet. Just curious if anyone knows if there's something major going on there. My traceroute is below. Tracing route to shs01.mdeinc.ca [207.210.113.61] over a maximum of 30 hops: 1 1 ms 2 ms 2 ms corpnet-rtr01.ba01.mdeinc.ca [10.143.5.1] 2 5 ms 5 ms 5 ms mdei-rci-border-rtr01.ba01.mdeinc.ca [10.99.99.5] 3 17 ms 13 ms 15 ms 10.231.36.1 4 16 ms 13 ms 13 ms gw01.bawk.phub.net.cable.rogers.com [66.185.90.193] 5 13 ms 13 ms 16 ms gw01.bawk.phub.net.cable.rogers.com [66.185.83.253] 6 14 ms 13 ms 13 ms gw01.basp.phub.net.cable.rogers.com [66.185.82.6] 7 15 ms 15 ms 18 ms gw02.mtnk.phub.net.cable.rogers.com [66.185.81.209] 8 15 ms 15 ms 15 ms 66.185.80.41 9 32 ms 31 ms 32 ms igw01.vaash.phub.net.cable.rogers.com [66.185.80.190] 10 36 ms 37 ms 37 ms POS2-1.ar2.DCA3.gblx.net [208.51.239.201] 11 51 ms 54 ms 51 ms NLAYER-COMMUNICATIONS-INC.ge-4-1-0.410.ar4.ATL1.gblx.net [206.41.25.230] 12 267 ms 76 ms 122 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 13 * * * Request timed out. 14 54 ms 50 ms 56 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 15 * * * Request timed out. 16 52 ms 53 ms 53 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 17 * * * Request timed out. 18 54 ms 64 ms 51 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 19 * * * Request timed out. 20 52 ms 53 ms 52 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 21 * * * Request timed out. 22 53 ms 53 ms 54 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 23 * * * Request timed out. 24 53 ms 51 ms 54 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 25 * * * Request timed out. 26 54 ms 51 ms 56 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 27 * * * Request timed out. 28 53 ms 66 ms 56 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] 29 * * * Request timed out. 30 52 ms 52 ms 56 ms atl-core-a-tgi2-1.gnax.net [209.51.149.105] Trace complete. Thanks in advance. Matt Dean, MCP, MCDST, MCPS, MCNPS Cremto Inc. Integrated Technology Consulting 530 Adelaide St. West, Unit 6133 Toronto, Ontario M5V 2K7 Canada (416) 619-0472 mdean(a)cremto.com

4 4

4 Byte AS tested
by Geoff Huston 11 Jan '07

11 Jan '07

# bgpctl show rib 203.10.62.0/24 flags: * = Valid, > = Selected, I = via IBGP, A = Announced origin: i = IGP, e = EGP, ? = Incomplete flags destination gateway lpref med aspath origin *> 203.10.62.0/24 147.28.0.1 100 0 0.3130 0.1239 0.4637 0.4637 0.4637 0.4637 0.4637 0.4637 0.1221 1.202 i George Michaelson, Randy Bush and myself have successfully tested the implementation of 4Byte AS BGP on a public Internet transit. The above BGP RIB snapshot was taken at a 4Byte BGP speaker in North America, showing a transit path across AS 1221, AS 4637, AS 1239 and AS 3130 , with correct reconstruction of the originating AS at the other (4Byte AS) end. The code base used was OpenBGPD, with 4 byte patches that I've added to the code in the past couple of weeks. (Patched versions of openbgpd to include 4-byte AS support can be found at http://www.potaroo.net/tools/bgpd/) cheers, Geoff

1 0

Fwd: [routing-wg]New Document Available: RIPE-399
by Fergie 10 Jan '07

10 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I hadn't seen any mention of this on the list today, so I figured I would mention it. I finally got a few free minutes to review this document this evening and I think it is a really good community resource. FYI, - - ferg [forwarded message] To: routing-wg(a)ripe.net From: RIPE NCC Document Announcement Service <webmaster(a)ripe.net> Subject: [routing-wg]New Document Available: RIPE-399 Sender: routing-wg-admin(a)ripe.net Date: Wed, 10 Jan 2007 16:57:36 +0100 New RIPE Document Announcement - -------------------------------------- A new document is available from the RIPE Document store. Ref: ripe-399 Title: RIPE Routing Working Group Recommendations on Route Aggregation Author: Philip Smith, Rob Evans, Mike Hughes Format: PDF= 89, 997 Date: December 2006 Short content description - ------------------------- This document discusses the need for aggregation of prefixes on the Internet today, and recommends good working practices for Internet Service Providers and other Autonomous Networks connected to the Internet. Accessing the RIPE Document Store - --------------------------------- You can access this RIPE document at: http://www.ripe.net/docs/ripe-399.html [snip] -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFpbr7q1pz9mNUZTMRAoZ8AJ4gbdH1fo8OD/KaRToztqpcbp+E3QCdEeZn FtwMbt3qzzAs485WlPvJLwk= =jcbf -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Standalone DC power recommendations?
by Deepak Jain 10 Jan '07

10 Jan '07

We are going to need to deploy about 800A of -48VDC power equipment in a datacenter that doesn't supply DC power normally. They will give us an three phase AC-power feed that is generator backed. Can anyone point me in the direction of a decent vendor of DC-power plants that are suitable for this size need and/or a ballpark price one would expect to pay for the equipment? Thanks in advance, Deepak

2 1

Re: Network end users to pull down 2 gigabytes a day, continuously?
by Richard Naylor 10 Jan '07

10 Jan '07

At 08:40 p.m. 9/01/2007 -0500, Gian Constantine wrote: >It would not be any easier. The negotiations are very complex. The issue >is not one of infrastructure capex. It is one of jockeying between content >providers (big media conglomerates) and the video service providers (cable >companies). We're seeing a degree of co-operation in this area. Its being driven by the market. - see below. <snip> On Jan 9, 2007, at 7:57 PM, Bora Akyol wrote: An additional point to consider is that it takes a lot of effort and >>$$$$ to get a channel allocated to your content in a cable network. >> >>This is much easier when TV is being distributed over the Internet. The other bigger driver, is that for most broadcasters (both TV and Radio), advertising revenues are flat, *except* in the on-line area. So they are chasing on-line growth like crazy. Typically on-line revenues now make up around 25% of income. So broadcasters are reacting and developing quite large systems for delivering content both new and old. We're seeing these as a mixture of live streams, on-demand streams, on-demand downloads and torrents. Basically, anything that works and is reliable and can be scaled. (we already do geographic distribution and anycast routing). And the broadcasters won't pay flash transit charges. They are doing this stuff from within existing budgets. They will put servers in different countries if it makes financial sense. We have servers in the USA, and their biggest load is non-peering NZ based ISPs. And broadcasters aren't the only source of large content. My estimate is that they are only 25% of the source. Somewhere last year I heard John Chambers say that many corporates are seeing 500% growth in LAN traffic - fueled by video. We do outside webcasting - to give you an idea of traffic, when we get a fiber connex, we allow for 6GBytes per day between an encoder and the server network - per programme. We often produce several different programmes from a site in different languages etc. Each one is 6GB. If we don't have fiber, it scales down to about 2GB per programme. (on fiber we crank out a full 2Mbps Standard Def stream, on satellite we only get 2Mbps per link). I have a chart by my phone that gives the minute/hour/day/month traffic impact of a whole range of streams and refer to it every day. Oh - we can do 1080i on demand and can and do produce content in that format. They're 8Mbps streams. Not many viewers tho :-) We're close to being able to webcast it live. We currently handle 50+ radio stations and 12 TV stations, handling around 1.5 to 2million players a month, in a country with a population of 4million. But then my stats could be lying...... Rich (long time lurker)

2 2