January 2007 - Test - lists.nanog.org

New GRH feature: Missing IPv6 prefixes => Many ISP's need IPv6 filter updates!
by Jeroen Massar 21 Jan '07

21 Jan '07

Hi, It seems that there are quite a few ISP's with IPv6 capabilities that are nicely filtering. Of course they also forget to actually update those filters. Blocks that are filtered by quite a number of ISP's that should not be filtered are: 2001:500::/30, 2001:678::/29, 2400::/16, 2600::/12, 2620::/23, 2a00::/16, and 2a01::/16 Note that some of these also have blocks upto /48's because of IPv6 PI space and micro allocations. Pay also special attention to 2001:678::/29 as that contains RIPE's Anycast TLD prefixes sized /48. It seems that these are nicely filtered out (then again RIPE stuck it in the middle of a block where only /32's come from normally) The recommended filters can be found here: http://www.space.net/~gert/RIPE/ipv6-filters.html Please check your filters, to be able to easily able to do what you are missing, you can use the following new GRH features: Want to know what ISP's are missing your prefix? See: http://www.sixxs.net/tools/grh/lg/ enter your prefix and look at the bottom. Want to know which ISP's filter what exactly? For ASN's peering with GRH, those can be looked up at: http://www.sixxs.net/tools/grh/dfp/ see under the heading for Missing prefixes, select and go. There are cross references between the tools so that you can look it easily from both references. Not peering with GRH yet? Check http://www.sixxs.net/tools/grh/peering/ and show the world that your IPv6 routing tables are okay. Which benefits you, but also other folks as they can check without having to find where to debug it ;) Of course, for comments, questions, suggestions, bug reports, don't hesitate to yell to info(a)sixxs.net! Enjoy the week ;) Greets, Jeroen

1 0

ISIS SNMP monitoring help
by Robert Boyle 20 Jan '07

20 Jan '07

Hello, I am posting here because I haven't been able to find what I need despite much searching and a previous unanswered post to cisco-nsp and I'm hoping someone here will have the answer. I need to find the SNMP OID for monitoring ISIS / CLNS neighbors: I tried walking: 1.3.6.1.3.37. and 1.3.6.1.3.37.1.5. and 1.3.6.1.3.37.1.5.1.1.2. and 1.3.6.1.3.37 which is the only OID I have found for ISIS seem to be invalid. I tried on a 7206 running 12.3(19) and a 6506 Sup720-3BXL running 12.2(18)SXF7 both of which are running ISIS and have many neighbors. I am looking for the ISIS roughly equivalent command to the BGP OID which we use to monitor BGP peers, but instead to monitor ISIS neighbor adjacencies: For BGP: 1.3.6.1.2.1.15.3.1.2.a.b.c.d For ISIS: ???? Thanks, Robert btw- For those who helped with my Foundry questions and those who wanted a summary, I am working on the summary now and we are also wrapping up our testing of the MLX/XMR boxes. Tellurian Networks - Global Hosting Solutions Since 1995 http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin

1 0

what happens when you put a typo in a DNSBL server?
by Wes Hardaker 19 Jan '07

19 Jan '07

A number of ISPs use njabl.org as a DNS BL server. However, starting jan 2 a new domain exists "njalb.org" which is serving A records for anything queried against it's DNS server. (note the difference: njaBL vs njaLB). Previous to this date a misconfigured ISP was just not being protected by the BL. Now, it's potentially dropping all mail from anyone because of the typo. # dig +short mail.merit.edu a 198.108.1.11 # dig +short 11.1.108.198.combined.njabl.org # dig +short 11.1.108.198.combined.njalb.org 64.20.43.107 66.45.232.66 66.45.232.75 66.45.237.187 I know of at least one ISP that is likely dropping mail from everyone... -- "In the bathtub of history the truth is harder to hold than the soap, and much more difficult to find." -- Terry Pratchett

8 8

Meeting Reminders
by Betty Burke 19 Jan '07

19 Jan '07

All: We are counting down the days to Toronto! I hope you have taken the time to register for NANOG-39. However, if you have forgotten to do so, a few reminders follow. 1. The hotel room rate increases on Saturday, the 20th. <http://www.nanog.org/mtg-0702/hotel.html> 2. The full agenda will be posted on Monday the 22nd. The PC has been working hard to bring a strong program to Toronto. <http://www.nanog.org/mtg-0702/topics.html> 3. Confirm passport issues have been resolved. <http://www.nanog.org/mtg-0702/passport.html> 4. REGISTER!!! <https://www.nanog.org/registration/> As always, send any all suggestions, questions or concerns to us, nanog-support(a)nanog.org. We look forward to a great meeting and in visiting with all soon. All best. Betty NANOG Project Manager

1 0

Meeting Reminders
by Betty Burke 19 Jan '07

19 Jan '07

All: We are counting down the days to Toronto! I hope you have taken the time to register for NANOG-39. However, if you have forgotten to do so, a few reminders follow. 1. The hotel room rate increases on Saturday, the 20th. <http://www.nanog.org/mtg-0702/hotel.html> 2. The full agenda will be posted on Monday the 22nd. The PC has been working hard to bring a strong program to Toronto. <http://www.nanog.org/mtg-0702/topics.html> 3. Confirm passport issues have been resolved. <http://www.nanog.org/mtg-0702/passport.html> 4. REGISTER!!! <https://www.nanog.org/registration/> As always, send any all suggestions, questions or concerns to us, nanog-support(a)nanog.org. We look forward to a great meeting and in visiting with all soon. All best. Betty NANOG Project Manager

1 0

For anyone who hasn't yet asked Ren for an explanation...
by Bill Woodcock 19 Jan '07

19 Jan '07

...of how this whole AT&T rebranding thing works, Stephen Colbert summs it up: http://www.youtube.com/watch?v=Bj1Mtv9cD0I&eurl= -Bill

3 2

Drone Armies C&C Report - 19 Jan 2007
by randy_vaughn＠Baylor.edu 19 Jan '07

19 Jan '07

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 5187 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 14723 reported C&Cs. Of the suspect C&Cs surveyed, 678 reported as Open, 1769 reported as closed, and 812 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 5845 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 19318 NJIIX-AS-1 - NEW JERSEY INTERN 124 24 81 13301 UNITEDCOLO-AS Autonomous System of 99 29 71 4766 KIXS-AS-KR 61 21 66 14779 INKT Inktomi Corporation 58 0 100 30058 FDCSE FDCservers.net LLC 58 14 76 16265 LEASEWEB AS 43 26 40 23522 CIT-FOONET 42 24 43 9318 HANARO-AS 38 10 74 7132 SBC Internet Services 36 5 86 25761 STAMIN-2 Staminus Communications 35 20 43 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 33 6 82 174 Cogent Communications 31 27 13 33597 InfoRelay Online Systems, Inc. 31 0 100 4837 CHINA169-Backbone 31 7 77 8560 SCHLUND-AS 29 14 52 15083 IIS-129 Infolink Information Servic 28 1 96 3786 ERX-DACOMNET 26 12 54 12832 Lycos Europe 24 0 100 28753 NETDIRECT AS NETDIRECT Frankfurt 23 8 65 4134 CHINANET-BACKBONE 22 7 68 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 99 29 71 174 Cogent Communications 31 27 13 16265 LEASEWEB AS 43 26 40 23522 CIT-FOONET 42 24 43 19318 NJIIX-AS-1 - NEW JERSEY INTERN 124 24 81 4766 KIXS-AS-KR 61 21 66 25761 STAMIN-2 Staminus Communications 35 20 43 8560 SCHLUND-AS 29 14 52 30058 FDCSE FDCservers.net LLC 58 14 76 3786 ERX-DACOMNET 26 12 54 9318 HANARO-AS 38 10 74 31103 KEYWEB-AS Keyweb AG 10 8 20 28753 NETDIRECT AS NETDIRECT Frankfurt 23 8 65 4837 CHINA169-Backbone 31 7 77 9930 TTNET-MY 8 7 13 4134 CHINANET-BACKBONE 22 7 68 18942 WEBHO-3 WebHostPlus Inc 11 7 36 6140 ImpSat 8 7 13 1781 KAIST-DAEJEON-AS-KR Korea Advanced 8 7 13 12322 PROXAD AS for Proxad ISP 8 7 13 A version of this report with addition rankings can be found via the isotf.org home page. Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 19 Jan '07

19 Jan '07

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 20 Jan, 2007 Analysis Summary ---------------- BGP routing table entries examined: 208300 Prefixes after maximum aggregation: 112624 Deaggregation factor: 1.85 Unique aggregates announced to Internet: 101475 Total ASes present in the Internet Routing Table: 24172 Origin-only ASes present in the Internet Routing Table: 21051 Origin ASes announcing only one prefix: 10192 Transit ASes present in the Internet Routing Table: 3121 Transit-only ASes present in the Internet Routing Table: 78 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 32 Max AS path prepend of ASN (20858) 18 Prefixes from unregistered ASNs in the Routing Table: 4 Unregistered ASNs in the Routing Table: 7 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 27 Number of addresses announced to Internet: 1660997452 Equivalent to 99 /8s, 0 /16s and 207 /24s Percentage of available address space announced: 44.8 Percentage of allocated address space announced: 63.6 Percentage of available address space allocated: 70.5 Total number of prefixes smaller than registry allocations: 106510 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 46255 Total APNIC prefixes after maximum aggregation: 18724 APNIC Deaggregation factor: 2.47 Prefixes being announced from the APNIC address blocks: 43822 Unique aggregates announced from the APNIC address blocks: 19170 APNIC Region origin ASes present in the Internet Routing Table: 2827 APNIC Region origin ASes announcing only one prefix: 793 APNIC Region transit ASes present in the Internet Routing Table: 422 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 276302048 Equivalent to 16 /8s, 120 /16s and 8 /24s Percentage of available APNIC address space announced: 86.4 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 102695 Total ARIN prefixes after maximum aggregation: 60728 ARIN Deaggregation factor: 1.69 Prefixes being announced from the ARIN address blocks: 75619 Unique aggregates announced from the ARIN address blocks: 28899 ARIN Region origin ASes present in the Internet Routing Table: 11274 ARIN Region origin ASes announcing only one prefix: 4311 ARIN Region transit ASes present in the Internet Routing Table: 1039 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 21 Number of ARIN addresses announced to Internet: 313853056 Equivalent to 18 /8s, 181 /16s and 4 /24s Percentage of available ARIN address space announced: 69.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 96/6, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 43136 Total RIPE prefixes after maximum aggregation: 28202 RIPE Deaggregation factor: 1.53 Prefixes being announced from the RIPE address blocks: 39854 Unique aggregates announced from the RIPE address blocks: 26576 RIPE Region origin ASes present in the Internet Routing Table: 9058 RIPE Region origin ASes announcing only one prefix: 4785 RIPE Region transit ASes present in the Internet Routing Table: 1465 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 32 Number of RIPE addresses announced to Internet: 286553764 Equivalent to 17 /8s, 20 /16s and 118 /24s Percentage of available RIPE address space announced: 77.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-43007 RIPE Address Blocks 62/8, 77/8, 78/7, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 13696 Total LACNIC prefixes after maximum aggregation: 4015 LACNIC Deaggregation factor: 3.41 Prefixes being announced from the LACNIC address blocks: 11682 Unique aggregates announced from the LACNIC address blocks: 7207 LACNIC Region origin ASes present in the Internet Routing Table: 759 LACNIC Region origin ASes announcing only one prefix: 248 LACNIC Region transit ASes present in the Internet Routing Table: 135 Average LACNIC Region AS path length visible: 4.2 Max LACNIC Region AS path length visible: 20 Number of LACNIC addresses announced to Internet: 36298752 Equivalent to 2 /8s, 41 /16s and 224 /24s Percentage of available LACNIC address space announced: 54.1 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2515 Total AfriNIC prefixes after maximum aggregation: 954 AfriNIC Deaggregation factor: 2.64 Prefixes being announced from the AfriNIC address blocks: 1788 Unique aggregates announced from the AfriNIC address blocks: 1150 AfriNIC Region origin ASes present in the Internet Routing Table: 175 AfriNIC Region origin ASes announcing only one prefix: 55 AfriNIC Region transit ASes present in the Internet Routing Table: 33 Average AfriNIC Region AS path length visible: 3.6 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 5369600 Equivalent to 0 /8s, 81 /16s and 239 /24s Percentage of available AfriNIC address space announced: 16.0 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1269 8655 268 CHINANET-BACKBONE 4755 1091 383 75 Videsh Sanchar Nigam Ltd. Aut 9583 1023 99 66 Sify Limited 9498 929 467 64 BHARTI BT INTERNET LTD. 23577 774 34 702 KRNIC 4766 760 4944 312 Korea Telecom (KIX) 17488 584 36 20 Hathway IP Over Cable Interne 1221 570 1697 441 Telstra Pty Ltd 7545 564 126 74 TPG Internet Pty Ltd 18101 511 103 27 Reliance Infocom Ltd Internet 17676 503 10935 66 Softbank BB Corp. 9443 442 111 74 Primus Telecommunications 4812 434 759 68 China Telecom (Shanghai) 4802 361 86 150 Wantree Development 17974 357 129 14 PT TELEKOMUNIKASI INDONESIA 17557 353 35 171 Pakistan Telecom 17849 353 33 93 Telecommunications Technology 4837 333 4071 146 chinanet IDC center beijing n 2907 332 1749 309 SINET Japan 7474 312 212 239 SingTel Optus Pty Ltd ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1548 6145 994 AT&T WorldNet Services 2386 1109 586 735 AT&T Data Communications Serv 4323 1066 820 299 Time Warner Telecom 6197 1022 645 500 BellSouth Network Solutions, 18566 986 272 8 Covad Communications 701 938 6692 751 UUNET Technologies, Inc. 174 934 6789 865 Cogent Communications 11492 910 99 14 Cable One 1239 827 2730 577 Sprint 19262 792 2570 184 Verizon Global Networks 20115 787 686 412 Charter Communications 7011 722 214 448 Citizens Utilities 209 717 3750 566 Qwest 22773 716 1744 42 Cox Communications, Inc. 721 708 21837 285 DLA Systems Automation Center 852 609 1093 394 Telus Advanced Communications 5668 568 161 19 CenturyTel Internet Holdings, 19916 568 49 54 OLM LLC 855 558 250 73 Canadian Research Network 6198 548 519 256 BellSouth Network Solutions, RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 547 1912 426 UUNET - Commercial IP service 3301 305 1199 287 TeliaNet Sweden 3320 298 4993 249 Deutsche Telekom AG 24863 298 45 25 LINKdotNET AS number 8220 271 474 262 COLT Telecommunications 6746 269 95 246 Dynamic Network Technologies, 680 257 2044 251 DFN-IP service G-WiN 3215 233 2136 96 France Telecom Transpac 8708 233 283 220 Romania Data Systems S.A. 1257 216 1069 172 SWIPnet Swedish IP Network 3269 211 2375 74 TELECOM ITALIA 30890 211 18 91 SC Kappa Invexim SRL 3246 207 354 197 Song Networks 5416 205 13 13 BATELCO-BH 8551 192 193 28 Bezeq International 20858 189 34 3 This AS will be used to conne 3300 177 171 89 AUCS Communications Services 3352 177 1767 31 Ibernet, Internet Access Netw 12479 176 578 6 Uni2 Autonomous System 786 171 1779 171 The JANET IP Service LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 849 2015 203 UniNet S.A. de C.V. 11830 482 299 19 Instituto Costarricense de El 11172 391 107 81 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 22047 307 206 11 VTR PUNTO NET S.A. 14117 259 16 13 Telefonica del Sur S.A. 6471 256 74 31 ENTEL CHILE S.A. 7303 231 103 33 Telecom Argentina Stet-France 6147 224 182 20 Telefonica Del Peru 6503 217 170 92 AVANTEL, S.A. 11556 212 105 7 Cable-Wireless Panama 10481 181 72 8 Prima S.A. 21826 157 21 36 INTERCABLE 7910 149 10 33 ANDINET ON LINE 23216 147 19 43 RAMtelecom Telecomunicaciones 18822 145 9 10 TELEFONICA MANQUEHUE 19169 141 9 24 Telconet 19429 140 84 35 E.T.B. 14522 135 21 8 SatNet S.A. 7738 116 442 21 Telecomunicacoes da Bahia S.A AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 290 868 232 The Internet Solution 8452 222 60 6 TEDATA 15475 154 84 4 Nile Online 6713 144 135 11 Itissalat Al-MAGHRIB 2018 138 309 113 Tertiary Education Network 5536 123 8 15 Internet Egypt Network 33783 106 6 4 EEPAD TISP TELECOM & INTERNET 2905 85 176 74 The Internetworking Company o 24835 85 48 6 RAYA Telecom - Egypt 2561 60 6 2 Egyptian Universities Network 15706 55 12 4 Sudatel Internet Exchange Aut 23889 50 13 15 MAURITIUS TELECOM 5713 41 294 34 Telkom SA Ltd 12455 39 6 3 Jambonet Autonomous system 33774 38 12 22 AS Number for Telecom Algeria 16637 33 21 25 Johnnic e-Ventures 33766 33 2 1 Nyala Communications Pty Ltd 8524 30 2 6 AUCEGYPT Autonomous System 33776 27 2 5 Starcomms Nigeria Limited 10798 23 1 14 Standard Bank of South Africa Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4755 1091 1016 Videsh Sanchar Nigam Ltd. Aut 4134 1269 1001 CHINANET-BACKBONE 18566 986 978 Covad Communications 9583 1023 957 Sify Limited 11492 910 896 Cable One 9498 929 865 BHARTI BT INTERNET LTD. 4323 1066 767 Time Warner Telecom 22773 716 674 Cox Communications, Inc. 8151 849 646 UniNet S.A. de C.V. 19262 792 608 Verizon Global Networks 17488 584 564 Hathway IP Over Cable Interne 5668 568 549 CenturyTel Internet Holdings, 6197 1022 522 BellSouth Network Solutions, 19916 568 514 OLM LLC 7545 564 490 TPG Internet Pty Ltd 855 558 485 Canadian Research Network 18101 511 484 Reliance Infocom Ltd Internet 15270 498 464 PaeTec.net -a division of Pae 11830 482 463 Instituto Costarricense de El 4766 760 448 Korea Telecom (KIX) List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 23456 UNALLOCATED 203.10.62.0/24 1221 Telstra Pty Ltd 24410 UNALLOCATED 203.119.28.0/24 4134 CHINANET-BACKBONE 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com 65313 PRIVATE 203.184.140.0/24 9304 Hutchison Telecom (H Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 7.1.1.0/24 1239 Sprint 116.0.0.0/24 12654 RIPE NCC RIS Project 116.50.0.0/21 12654 RIPE NCC RIS Project 116.255.0.0/16 12654 RIPE NCC RIS Project 117.0.0.0/24 12654 RIPE NCC RIS Project 117.50.0.0/21 12654 RIPE NCC RIS Project 117.255.0.0/16 12654 RIPE NCC RIS Project 118.0.0.0/24 12654 RIPE NCC RIS Project 118.50.0.0/21 12654 RIPE NCC RIS Project 118.255.0.0/16 12654 RIPE NCC RIS Project 119.0.0.0/24 12654 RIPE NCC RIS Project 119.50.0.0/21 12654 RIPE NCC RIS Project 119.255.0.0/16 12654 RIPE NCC RIS Project 120.0.0.0/24 12654 RIPE NCC RIS Project 120.50.0.0/21 12654 RIPE NCC RIS Project 120.255.0.0/16 12654 RIPE NCC RIS Project 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.33.1.0/24 7018 AT&T WorldNet Services 180.190.0.0/16 24003 JUBILANT ORGANOSYS LTD., INDI 192.0.10.0/24 9498 BHARTI BT INTERNET LTD. 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.153.136.0/21 721 DLA Systems Automation Center 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:10 /10:13 /11:32 /12:117 /13:230 /14:412 /15:811 /16:9126 /17:3652 /18:5948 /19:12921 /20:14539 /21:12987 /22:16561 /23:17804 /24:111456 /25:626 /26:448 /27:360 /28:66 /29:39 /30:90 /31:0 /32:33 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 969 986 Covad Communications 11492 896 910 Cable One 9583 852 1023 Sify Limited 7018 848 1548 AT&T WorldNet Services 2386 831 1109 AT&T Data Communications Serv 6197 795 1022 BellSouth Network Solutions, 23577 760 774 KRNIC 7011 626 722 Citizens Utilities 9498 587 929 BHARTI BT INTERNET LTD. 4766 569 760 Korea Telecom (KIX) 19916 563 568 OLM LLC 4755 500 1091 Videsh Sanchar Nigam Ltd. Aut 15270 466 498 PaeTec.net -a division of Pae 855 456 558 Canadian Research Network 18101 444 511 Reliance Infocom Ltd Internet 5668 437 568 CenturyTel Internet Holdings, 1239 412 827 Sprint 17488 407 584 Hathway IP Over Cable Interne 33588 400 422 Bresnan Communications, LLC. 6517 388 414 Yipes Communications, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 7:1 8:62 9:1 12:1661 13:1 15:15 16:3 17:3 18:5 20:36 24:871 25:1 32:55 38:276 40:56 41:61 44:2 47:10 52:4 55:1 56:3 57:24 58:295 59:376 60:199 61:953 62:1037 63:1901 64:3183 65:2312 66:3130 67:708 68:640 69:1722 70:416 71:133 72:1137 73:1 74:138 75:61 76:20 80:819 81:778 82:641 83:346 84:494 85:799 86:435 87:460 88:268 89:754 90:2 91:139 97:1 116:1 117:1 118:1 119:1 120:1 121:129 122:66 123:25 124:551 125:753 128:311 129:219 130:112 131:315 132:49 133:9 134:183 135:44 136:180 137:113 138:190 139:54 140:522 141:135 142:365 143:211 144:266 145:67 146:321 147:138 148:365 149:189 150:114 151:118 152:90 153:119 154:5 155:245 156:166 157:168 158:167 159:147 160:99 161:101 162:227 163:162 164:451 165:239 166:244 167:281 168:493 169:121 170:378 171:15 172:1 189:73 190:351 192:5737 193:3638 194:2913 195:2206 196:920 198:3784 199:3283 200:4610 201:959 202:7129 203:7261 204:3958 205:2095 206:2407 207:2895 208:2405 209:3563 210:2317 211:880 212:1306 213:1422 214:391 215:39 216:4103 217:1180 218:356 219:267 220:854 221:368 222:289 End of report Report Website: http://thyme.apnic.net

1 0

Re: HTML email, was Re: Phishing and BGP Blackholing
by Fergie 19 Jan '07

19 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Stephane Bortzmeyer <bortzmeyer(a)nic.fr> wrote: >> a combination of retarded registry policies (pitting business >> interests against common technical sense) > >In a capitalist country, I do not see how you could do otherwise. In a >non-capitalist country, there is still hope, I'll talk to Fidel about >that, next time we meet. > Whatever. :-) I'm sure that all 30,090 results of a search for "ebay" are legit: http://domain-search.domaintools.com/?q=ebay Cheers, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFsP8Aq1pz9mNUZTMRAvxTAJ0dDPpqcUhEDirzpEQNrdBf9jWdlACg7GmU 3EeA9OZ5veYUQfooHsUFh58= =Waoa -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Phishing and BGP Blackholing
by Joy, Dylan 19 Jan '07

19 Jan '07

Happy New Year all, I'm curious if anyone can answer whether there has been any traction made relative to blocking egress traffic (via BGP) on US backbones which is destined to IP addresses used for fraudulent purposes, such as phishing sites. I'm sure there are several challenges to implementing this... Regards, Dylan Joy Network Security Analyst, BECU NOTICE: This communication and any attachments may contain privileged or otherwise confidential information. If you are not the intended recipient or believe that you may have received this communication in error, please reply to the sender indicating that fact and delete the copy you received without printing, copying, retransmitting, disseminating, or otherwise using the information. Thank you.

24 40