February 2007 - Test - lists.nanog.org

Web Server Botnets and Server Farms as Attack Platforms
by Gadi Evron 12 Feb '07

12 Feb '07

Are file inclusion vulnerabilitiess equivalent to remote code execution? Are servers (both Linux and Windows) now the lower hanging fruit rather than desktop systems? In the February edition of the Virus Bulletin magazine, we (Kfir Damari, Noam Rathaus and Gadi Evron (me) of Beyond Security) wrote an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms. Web security papers deal mostly with secure coding and application security. In this paper we describe how these are taken to the next level with live attacks and operational problems service providers deal with daily. We discuss how these attacks work using (mainly) file inclusion vulnerabilities (RFI) and (mainly) PHP shells. Further, we discuss how ISPs and hosting farms suffer tremendously from this, and what can be done to combat the threat. I'd like to write more on this here, and ask for the community's feedback on what others see in this field and how you deal with similar issues. Malware is often built to operate within a certain OS environment. Web server malware is completely cross-platform (as long as a web daemon which supports scripting can be found such as IIS, Apache, etc.). These malware attack the web application first, and only then further compromise takes place platform by platform, using the web server's privileges. Most web servers are being compromised by these attacks as a result of an insecure web application written in PHP, although attacks for other scripting languages such as Perl and ASP are also in-the-wild. The main reason for this is that many different PHP applications are available online, and often freely as open source, which makes them a popular selection for use on many web sites. Another reason for the popularity of attacks against PHP applications is that writing securely in PHP is very difficult, which makes most of these PHP applications vulnerable to multiple attacks, with hundreds of new vulnerabilities released publicly every month. While in the past botnets used to be composed of mainly broadband end users running Windows, today we can see more and more server botnets we can refer to as "IIS botnets" or "Linux botnets" as a direct result of these attacks. One of the conclusions we reached was that although the technologies used are not new (RFI, PHP shells, etc.) the sheer scale of the problem is what's interesting. In our research as detailed in the Virus Bulletin article we recognize that vulnerabilities such as file inclusion, as simple as they may be, are equivalent to remote code execution in effect. Although escalation wars, which are reactive in nature, are a solution we hate and are stuck with on botnets, spam, fraud and many other fronts, this front of web server attacks stands completely unopposed and controlled by the bad guys. In our research we detail how over-time, when aggregated, most attacks come from the same IP addresses without these ever getting blocked. ISPs and hosting farms selling low-cost hosting services can not cope with this threat, especially where an attack against one user running such an application can compromise a server running 3000 other sites. Another issue discussed was the formation of the Web Honeynet Task Force ( http://www.webhoneynet.net/ renamed from the Web Honeynet Project to avoid confusion with the honeynet project). I write more about this and host the paper on my blog at SecuriTeam ( http://blogs.securiteam.com/index.php/archives/815 ). All rights for the article itself belong to the Virus Bulletin magazine. Gadi Evron.

1 0

Re: death of the net predicted by deloitte -- film at 11
by Brandon Butterworth 12 Feb '07

12 Feb '07

> Multicast isn't going to help the phoneco atm network. Indeed, people keep quoting that but it's a bogus argument as nothing will help the phoneco atm network running out of bandwidth other than upgrading it That is happening, unicast/p2p/multicast/whatever, as all this content is raising average user bandwidth > But if you accept that the average user only watches 3-6 hours of HDTV per > day, you can spread the load out over 24 hours, the effects on available > bandwidth can be reduced. The TIVO model appears to have an advantage for > the viewer (a large archive to select from) and for the phoneco's and ISP's > at the customer end. When people have their akamai@home box that'll help for some cases. To say it's a universal fix is a bogus as saying multicast will fix all problems. brandon

1 0

Re: death of the net predicted by deloitte -- film at 11
by Frank Coluccio 11 Feb '07

11 Feb '07

I believe that the element that has been missing in this discussion thus far has been the source (content) players, and where they are hiding. CDNs, a la Akamai, Limelight, etc., will take up some of the slack and mitigate much of the backbone burden where legitimate ISPs are concerned, as will hierarchical caching for the newbie carriers-that-came-to-be-called "ISPs" -i.e., the MSOs and Telcos. Playing the Pareto, the higher the demand (95/5) for a title, the closer it will be stored to the user community, and the longer the tail (5/95) of a title, the farther its storage from the user community. My point is, CDNs and hierarchical cache must be inserted into the calculus, because one, they are already being used, and two, their use will only increase with time, fwiw. Frank ps - I've had some issues with my email editor of late. If anyone notices any artifacts or extraneous characters in the delivery of this message, kindly email me off list and I shall be indebted to you, tia. On Sun Feb 11 19:22 , "Geo." sent: > > >> do what google is presumably doing (lots of fiber), or would they put >> some capital and preorder into IDMR? > >IDMR is great if you're a broadcaster or a backbone, but how does it help >the last 2 miles, the phoneco ATM network or the ISP network where you have >10k different users watching 10k different channels? I'm not sure if it >would help with a multinode replication network like what google is probably >up to either (which explains why they want dedicated bandwidth, internode >replication solves the backup problems as well). > >Also forgetting that bandwidth issue for a moment, where is the draw that >makes IPTV better than cable or satellite? I mean come on guys, if the >world had started out with IPTV live broadcasts over the internet and then >someone developed cable, satellite, or over the air broadcasting, any of >those would have been considered an improvement. IPTV needs something the >others don't have and a simple advantage is that of an archive instead of >broadcast medium. The model has to be different from the broadcast model or >it's never going to fly. > >TIVO type setup with a massive archive of every show so you can not only >watch this weeks episode but you can tivo download any show from the last 6 >years worth of your favorite series is one heck of a draw over cable or >satellite and might be enough to motivate the public to move to a different >service. A better tivo than tivo. As for making money, just stick a >commercial on the front of every download. How many movies are claimed >downloaded on the fileshare networks every week? > >Geo. >

2 1

RE: Question about SLAs
by michael.dillon＠bt.com 11 Feb '07

11 Feb '07

> An SLA is a contract. > > A contract is... a contract. Does that mean you can take them to small claims court if they don't pay you the agreed SLA credits? --Michael Dillon

6 5

Any NANOGers going to 3GSM World Congress?
by Alexander Harrowell 11 Feb '07

11 Feb '07

For the mobile maniacs among us..if you're coming to Barcelona, and flying Iberia, BA or Lufthansa via Heathrow, beware that your aircraft will come in at Terminal A but your checked baggage will be sent to Terminal B. Do NOT pass through the doors to the baggage reclaim in Terminal A because you won't be able to get back through, and will have to pass through the security checkpoint in Terminal B Departures to recover your bags. This will be problematic for non-Spanish speakers and impossible for anyone who has thrown away their ticket stub. That is, of course, if any NANOG users actually *have* checked baggage.

1 0

an RBL for virus alert senders?
by Mark Jeftovic 10 Feb '07

10 Feb '07

Is there an RBL for mail servers run by brain dead "postmasters" that insist on running anti-viral software that sends out less-than-useless "virus alerts", "virus in your email", "banned attachment" spewage to the guaranteed-to-be-forged "From" address in the message headers? I wouldn't mind never receiving another piece of email from servers like that again. Ever. Bueller? Bueller? -mark -- Mark Jeftovic <markjr(a)easydns.com> Founder & President, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(866) 273-2892

2 1

Question about SLAs
by Barry Shein 09 Feb '07

09 Feb '07

Other than "give them the bum's rush!" what do you do when a vendor is a PITA about SLAs for outages? Obviously there's not enough on the table to get lawyers involved, but it's aggravating when first they act like they lost your SLA request, then claim their logs don't match your logs in some significant way, then try to avoid returning calls to find out what got decided about disputes I guess hoping you'll give up, etc. It's lousy "game theory" if the vendor just wants to insist their logs are very different than the customer's (highly detailed logs), for example, short of bolting, which there might be other reasons to not want to do except as a last resort, like the cost would be a lot more than the SLAs in question. But where's the leverage? I hope this is operational enough for this list, if not feel free point me somewhere else. -- -Barry Shein The World | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

5 6

Weekly Routing Table Report
by Routing Analysis Role Account 09 Feb '07

09 Feb '07

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 10 Feb, 2007 Analysis Summary ---------------- BGP routing table entries examined: 210553 Prefixes after maximum aggregation: 113369 Deaggregation factor: 1.86 Unique aggregates announced to Internet: 102510 Total ASes present in the Internet Routing Table: 24297 Origin-only ASes present in the Internet Routing Table: 21155 Origin ASes announcing only one prefix: 10225 Transit ASes present in the Internet Routing Table: 3142 Transit-only ASes present in the Internet Routing Table: 78 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 32 Max AS path prepend of ASN (20858) 18 Prefixes from unregistered ASNs in the Routing Table: 4 Unregistered ASNs in the Routing Table: 5 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 13 Number of addresses announced to Internet: 1674787756 Equivalent to 99 /8s, 211 /16s and 59 /24s Percentage of available address space announced: 45.2 Percentage of allocated address space announced: 62.1 Percentage of available address space allocated: 72.8 Total number of prefixes smaller than registry allocations: 108001 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 47410 Total APNIC prefixes after maximum aggregation: 18871 APNIC Deaggregation factor: 2.51 Prefixes being announced from the APNIC address blocks: 44702 Unique aggregates announced from the APNIC address blocks: 19589 APNIC Region origin ASes present in the Internet Routing Table: 2845 APNIC Region origin ASes announcing only one prefix: 788 APNIC Region transit ASes present in the Internet Routing Table: 425 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 283353088 Equivalent to 16 /8s, 227 /16s and 160 /24s Percentage of available APNIC address space announced: 70.2 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 116/6, 120/6, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 103086 Total ARIN prefixes after maximum aggregation: 61000 ARIN Deaggregation factor: 1.69 Prefixes being announced from the ARIN address blocks: 75941 Unique aggregates announced from the ARIN address blocks: 29279 ARIN Region origin ASes present in the Internet Routing Table: 11320 ARIN Region origin ASes announcing only one prefix: 4334 ARIN Region transit ASes present in the Internet Routing Table: 1049 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 21 Number of ARIN addresses announced to Internet: 317024640 Equivalent to 18 /8s, 229 /16s and 105 /24s Percentage of available ARIN address space announced: 70.0 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 96/6, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 43629 Total RIPE prefixes after maximum aggregation: 28493 RIPE Deaggregation factor: 1.53 Prefixes being announced from the RIPE address blocks: 40331 Unique aggregates announced from the RIPE address blocks: 26830 RIPE Region origin ASes present in the Internet Routing Table: 9115 RIPE Region origin ASes announcing only one prefix: 4798 RIPE Region transit ASes present in the Internet Routing Table: 1464 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 32 Number of RIPE addresses announced to Internet: 289124388 Equivalent to 17 /8s, 59 /16s and 176 /24s Percentage of available RIPE address space announced: 78.3 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-43007 RIPE Address Blocks 62/8, 77/8, 78/7, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 13875 Total LACNIC prefixes after maximum aggregation: 4042 LACNIC Deaggregation factor: 3.43 Prefixes being announced from the LACNIC address blocks: 11946 Unique aggregates announced from the LACNIC address blocks: 7157 LACNIC Region origin ASes present in the Internet Routing Table: 760 LACNIC Region origin ASes announcing only one prefix: 249 LACNIC Region transit ASes present in the Internet Routing Table: 135 Average LACNIC Region AS path length visible: 4.2 Max LACNIC Region AS path length visible: 20 Number of LACNIC addresses announced to Internet: 37378560 Equivalent to 2 /8s, 58 /16s and 90 /24s Percentage of available LACNIC address space announced: 55.7 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2550 Total AfriNIC prefixes after maximum aggregation: 961 AfriNIC Deaggregation factor: 2.65 Prefixes being announced from the AfriNIC address blocks: 1837 Unique aggregates announced from the AfriNIC address blocks: 1164 AfriNIC Region origin ASes present in the Internet Routing Table: 178 AfriNIC Region origin ASes announcing only one prefix: 55 AfriNIC Region transit ASes present in the Internet Routing Table: 36 Average AfriNIC Region AS path length visible: 3.6 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 5387776 Equivalent to 0 /8s, 82 /16s and 54 /24s Percentage of available AfriNIC address space announced: 16.1 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1283 8678 277 CHINANET-BACKBONE 4755 1098 383 75 Videsh Sanchar Nigam Ltd. Aut 9583 1038 109 16 Sify Limited 9498 943 467 64 BHARTI BT INTERNET LTD. 23577 776 35 703 Korea Telecom (ATM-MPLS) 4766 765 4944 313 Korea Telecom (KIX) 17488 594 39 23 Hathway IP Over Cable Interne 7545 575 126 73 TPG Internet Pty Ltd 1221 572 1682 441 Telstra Pty Ltd 18101 520 103 23 Reliance Infocom Ltd Internet 17676 503 10935 65 Softbank BB Corp. 4812 441 771 72 China Telecom (Shanghai) 9443 441 111 73 Primus Telecommunications 7474 378 215 255 SingTel Optus Pty Ltd 17849 370 35 94 Telecommunications Technology 4802 359 86 149 Wantree Development 17557 359 34 170 Pakistan Telecom 17974 346 129 14 PT TELEKOMUNIKASI INDONESIA 2907 336 1749 309 SINET Japan 4837 336 4151 148 chinanet IDC center beijing n ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1502 6125 984 AT&T WorldNet Services 4323 1118 827 357 Time Warner Telecom 2386 1110 570 733 AT&T Data Communications Serv 6197 1027 652 504 BellSouth Network Solutions, 18566 988 288 9 Covad Communications 701 941 6696 747 UUNET Technologies, Inc. 174 938 6792 866 Cogent Communications 11492 938 100 16 Cable One 1239 824 2730 576 Sprint 20115 799 698 413 Charter Communications 7011 785 227 474 Citizens Utilities 19262 757 2591 178 Verizon Global Networks 22773 725 1872 41 Cox Communications, Inc. 209 718 3742 564 Qwest 721 682 21836 279 DLA Systems Automation Center 852 603 1090 391 Telus Advanced Communications 5668 575 144 16 CenturyTel Internet Holdings, 19916 568 49 54 OLM LLC 855 563 250 73 Canadian Research Network 6198 554 526 259 BellSouth Network Solutions, RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 546 1897 424 UUNET - Commercial IP service 3301 315 1199 290 TeliaNet Sweden 24863 307 45 25 LINKdotNET AS number 3320 297 4993 248 Deutsche Telekom AG 8220 270 472 262 COLT Telecommunications 6746 267 95 246 Dynamic Network Technologies, 680 257 2044 251 DFN-IP service G-WiN 8708 240 284 226 Romania Data Systems S.A. 3215 238 2224 92 France Telecom Transpac 1257 222 1100 171 SWIPnet Swedish IP Network 5416 215 14 15 BATELCO-BH 3269 212 2391 71 TELECOM ITALIA 3246 208 355 198 Song Networks 8551 201 194 29 Bezeq International 20858 197 34 3 EgyNet 3352 194 1767 31 Ibernet, Internet Access Netw 30890 187 15 91 SC Kappa Invexim SRL 3300 182 171 91 AUCS Communications Services 12479 177 578 6 Uni2 Autonomous System 786 172 1779 172 The JANET IP Service LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 990 2111 204 UniNet S.A. de C.V. 11830 482 299 19 Instituto Costarricense de El 11172 343 107 82 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 22047 307 206 11 VTR PUNTO NET S.A. 6471 253 74 30 ENTEL CHILE S.A. 7303 247 142 29 Telecom Argentina Stet-France 14117 239 16 13 Telefonica del Sur S.A. 11556 235 116 6 Cable-Wireless Panama 6147 226 182 20 Telefonica Del Peru 6503 219 175 90 AVANTEL, S.A. 10481 181 72 8 Prima S.A. 21826 153 27 56 INTERCABLE 7910 152 11 32 ANDINET ON LINE 23216 148 19 42 RAMtelecom Telecomunicaciones 18822 145 9 10 TELEFONICA MANQUEHUE 20299 145 22 17 NEWCOM AMERICAS 19169 142 9 24 Telconet 14522 140 22 9 SatNet S.A. 19429 139 84 34 E.T.B. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 290 868 232 The Internet Solution 8452 237 60 6 TEDATA 15475 155 84 4 Nile Online 6713 144 135 11 Itissalat Al-MAGHRIB 2018 138 309 113 Tertiary Education Network 5536 123 8 15 Internet Egypt Network 33783 114 6 5 EEPAD TISP TELECOM & INTERNET 24835 86 48 6 RAYA Telecom - Egypt 2905 79 173 72 The Internetworking Company o 2561 63 6 2 Egyptian Universities Network 15706 55 12 4 Sudatel Internet Exchange Aut 23889 52 16 13 MAURITIUS TELECOM 5713 44 294 34 Telkom SA Ltd 33774 40 11 24 AS Number for Telecom Algeria 16637 33 21 25 Johnnic e-Ventures 33766 33 2 1 Nyala Communications Pty Ltd 8524 30 2 6 AUCEGYPT Autonomous System 21280 27 4 4 Swift Global Kenya Ltd.Is an 33776 27 2 5 Starcomms Nigeria Limited 10798 23 1 14 Standard Bank of South Africa Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4755 1098 1023 Videsh Sanchar Nigam Ltd. Aut 9583 1038 1022 Sify Limited 4134 1283 1006 CHINANET-BACKBONE 18566 988 979 Covad Communications 11492 938 922 Cable One 9498 943 879 BHARTI BT INTERNET LTD. 8151 990 786 UniNet S.A. de C.V. 4323 1118 761 Time Warner Telecom 22773 725 684 Cox Communications, Inc. 19262 757 579 Verizon Global Networks 17488 594 571 Hathway IP Over Cable Interne 5668 575 559 CenturyTel Internet Holdings, 6197 1027 523 BellSouth Network Solutions, 19916 568 514 OLM LLC 7545 575 502 TPG Internet Pty Ltd 18101 520 497 Reliance Infocom Ltd Internet 855 563 490 Canadian Research Network 15270 505 471 PaeTec.net -a division of Pae 11830 482 463 Instituto Costarricense de El 4766 765 452 Korea Telecom (KIX) List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65332 PRIVATE 63.166.106.192/27 1803 SPRINT 24410 UNALLOCATED 203.119.28.0/24 4134 CHINANET-BACKBONE 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com 22895 UNALLOCATED 216.174.38.0/24 19094 Adelphia Business So Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 7.1.1.0/24 1239 Sprint 42.205.192.0/20 36925 Meditelecom 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.33.1.0/24 7018 AT&T WorldNet Services 180.190.0.0/16 24003 JUBILANT ORGANOSYS LTD., INDI 192.0.10.0/24 9498 BHARTI BT INTERNET LTD. 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.153.136.0/21 721 DLA Systems Automation Center 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:9 /10:13 /11:33 /12:116 /13:226 /14:422 /15:818 /16:9214 /17:3713 /18:6052 /19:13061 /20:14678 /21:13137 /22:16959 /23:17964 /24:112306 /25:689 /26:481 /27:407 /28:68 /29:43 /30:92 /31:0 /32:33 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 970 988 Covad Communications 11492 924 938 Cable One 9583 866 1038 Sify Limited 2386 831 1110 AT&T Data Communications Serv 7018 810 1502 AT&T WorldNet Services 6197 795 1027 BellSouth Network Solutions, 23577 762 776 Korea Telecom (ATM-MPLS) 7011 684 785 Citizens Utilities 9498 601 943 BHARTI BT INTERNET LTD. 4766 573 765 Korea Telecom (KIX) 19916 563 568 OLM LLC 4755 508 1098 Videsh Sanchar Nigam Ltd. Aut 15270 473 505 PaeTec.net -a division of Pae 855 462 563 Canadian Research Network 18101 451 520 Reliance Infocom Ltd Internet 5668 447 575 CenturyTel Internet Holdings, 17488 416 594 Hathway IP Over Cable Interne 33588 410 432 Bresnan Communications, LLC. 4323 404 1118 Time Warner Telecom 1239 403 824 Sprint Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 6:1 7:1 8:64 9:1 12:1656 13:1 15:16 16:3 17:3 18:5 20:36 24:881 25:1 32:53 38:277 40:57 41:69 44:2 47:7 52:4 55:1 56:3 57:25 58:302 59:377 60:203 61:918 62:1020 63:1906 64:3250 65:2312 66:3111 67:720 68:652 69:1719 70:448 71:95 72:1184 73:2 74:160 75:77 77:16 80:838 81:777 82:662 83:354 84:516 85:733 86:456 87:481 88:226 89:776 90:1 91:197 97:1 116:1 117:1 118:1 119:1 120:1 121:131 122:77 123:37 124:577 125:797 128:313 129:219 130:129 131:342 132:49 133:9 134:185 135:45 136:181 137:113 138:196 139:54 140:516 141:141 142:372 143:215 144:270 145:43 146:313 147:144 148:368 149:190 150:115 151:116 152:92 153:119 154:5 155:250 156:128 157:174 158:168 159:149 160:98 161:87 162:229 163:162 164:450 165:328 166:247 167:280 168:496 169:120 170:383 171:15 172:1 189:156 190:389 192:5750 193:3695 194:2951 195:2196 196:940 198:3752 199:3280 200:4608 201:968 202:7212 203:7368 204:3954 205:2098 206:2408 207:2865 208:2456 209:3591 210:2369 211:921 212:1296 213:1406 214:399 215:39 216:4064 217:1155 218:353 219:266 220:856 221:371 222:265 End of report Report Website: http://thyme.apnic.net

1 0

RE: Question about SLAs
by michael.dillon＠bt.com 09 Feb '07

09 Feb '07

> Absolutely, so long as the amount in controversy > doesn't exceed the small claims limit in your jurisdiction. > If it does, off to regular court. And the nice thing about small claims court, if you meet the maximum limit of course, is that large companies often are lazy about dealing with the claims. If you are smaller than them, judges will often grant you a judgement when the big company doesn't show. At that point, with a court judgement in hand, it is easier to get the carrier's attention. SLA disputes are usually handled in the sales department by people whose paycheck is at least partly determined by sales quotas. Paying you the SLA hurts their paycheck. But a court judgement is usually handled by the legal department whose paycheck is 100% salary plus bonus for performance, which in the case of a lawyer would have to do with settling cases so that they do minimum damage to the company. In the case of a small claims court judgement, it is cheaper for them to pay you than to dispute the judgement. Of course, if you understand the supplier's internal issues from the beginning, then you can usually escalate it to the right people to resolve the problem before it gets to court. For instance, sales management usually have the bonus/quota system rigged so that they can pay you your SLA but not get hurt in the paycheck. Don't bang your head against the wall. If the supplier doesn't deal with issues promptly, work your way through different people in the organization until you find someone who can act to fix the problem. --Michael Dillon

2 1

BGP Update Report
by cidr-report＠potaroo.net 09 Feb '07

09 Feb '07

BGP Update Report Interval: 26-Jan-07 -to- 08-Feb-07 (14 days) Observation Point: BGP Peering with AS4637 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS701 35249 1.4% 36.3 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 2 - AS28751 28943 1.1% 120.1 -- CAUCASUS-NET-AS Caucasus Network Tbilisi, Georgia 3 - AS702 27116 1.1% 37.8 -- AS702 MCI EMEA - Commercial IP service provider in Europe 4 - AS8151 24366 0.9% 24.1 -- Uninet S.A. de C.V. 5 - AS17974 17707 0.7% 33.7 -- TELKOMNET-AS2-AP PT TELEKOMUNIKASI INDONESIA 6 - AS3561 16509 0.6% 33.8 -- SAVVIS - Savvis 7 - AS4788 15563 0.6% 8.4 -- TMNET-AS-AP TM Net, Internet Service Provider 8 - AS705 14460 0.6% 29.3 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 9 - AS11830 13316 0.5% 27.6 -- Instituto Costarricense de Electricidad y Telecom. 10 - AS9583 12377 0.5% 11.7 -- SIFY-AS-IN Sify Limited 11 - AS17488 12262 0.5% 20.4 -- HATHWAY-NET-AP Hathway IP Over Cable Internet 12 - AS6197 12009 0.5% 11.7 -- BATI-ATL - BellSouth Network Solutions, Inc 13 - AS4323 11878 0.5% 11.0 -- TWTC - Time Warner Telecom, Inc. 14 - AS30890 11812 0.5% 54.4 -- EVOLVA Evolva Telecom 15 - AS9498 11676 0.5% 12.3 -- BBIL-AP BHARTI BT INTERNET LTD. 16 - AS7545 11558 0.5% 20.9 -- TPG-INTERNET-AP TPG Internet Pty Ltd 17 - AS3301 11416 0.4% 37.1 -- TELIANET-SWEDEN TeliaNet Sweden 18 - AS11486 10609 0.4% 37.8 -- WAN - Worldcom Advance Networks 19 - AS4621 10476 0.4% 77.6 -- UNSPECIFIED UNINET-TH 20 - AS2914 10444 0.4% 45.8 -- NTT-COMMUNICATIONS-2914 - NTT America, Inc. TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS31594 4356 0.2% 4356.0 -- FORTESS-AS Fortess LLC Network 2 - AS15774 2837 0.1% 2837.0 -- MEDIANAT LLC "MEDIANAT", ISP primarily for educational institution 3 - AS35489 2692 0.1% 2692.0 -- TOTO-TECH-AS Toto Ltd. 4 - AS31624 8287 0.3% 1657.4 -- VFMNL-AS Verza Facility Management BV 5 - AS38151 1605 0.1% 1605.0 -- ENUM-AS-ID APJII-RD 6 - AS33447 1243 0.1% 1243.0 -- RPTCO-ASN-1 - RPT Consulting, Inc. 7 - AS32131 1203 0.1% 1203.0 -- AS-PCML - Penso Capital Markets, LLC 8 - AS27407 1024 0.0% 1024.0 -- FRISCHS-INC - Frisch's Restaurants, Inc. 9 - AS27814 995 0.0% 995.0 -- Aeprovi 10 - AS34378 969 0.0% 969.0 -- RUG-AS Razguliay-UKRROS Group 11 - AS3727 944 0.0% 944.0 -- SHRUBB - Shrubbery Networks 12 - AS31307 908 0.0% 908.0 -- YKYATIRIM YAPI KREDI YATIRIM 13 - AS4587 2395 0.1% 798.3 -- ONEWORLD2 - One World Internetworking, Inc 14 - AS17645 7759 0.3% 775.9 -- NTT-SG-AP ASN - NTT SINGAPORE PTE LTD 15 - AS20426 3025 0.1% 756.2 -- PWC-AS - PriceWaterhouseCoopers, LLP 16 - AS29630 640 0.0% 640.0 -- AZRENA-AS Azerbaijan Research and Educational Networking 17 - AS20050 1223 0.1% 611.5 -- SPPINTERNET01 - Southwest Power Pool 18 - AS3043 3013 0.1% 602.6 -- AMPHIB-AS - Amphibian Media Corporation 19 - AS30355 595 0.0% 595.0 -- PATRIOT-COMMUNICATIONS - PATRIOT COMMUNICATIONS 20 - AS30707 1615 0.1% 538.3 -- SICOR-US-CA-IRVINE - SICOR Pharmaceuticals, Inc. TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 194.242.124.0/22 4356 0.1% AS31594 -- FORTESS-AS Fortess LLC Network 2 - 89.4.128.0/24 3221 0.1% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 3 - 216.32.206.0/24 3169 0.1% AS20473 -- AS-CHOOPA - Choopa, LLC 4 - 89.4.129.0/24 3111 0.1% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 5 - 155.201.48.0/21 3010 0.1% AS20426 -- PWC-AS - PriceWaterhouseCoopers, LLP 6 - 209.140.24.0/24 2966 0.1% AS3043 -- AMPHIB-AS - Amphibian Media Corporation 7 - 62.68.143.0/24 2837 0.1% AS15774 -- MEDIANAT LLC "MEDIANAT", ISP primarily for educational institution 8 - 62.213.176.0/23 2692 0.1% AS35489 -- TOTO-TECH-AS Toto Ltd. 9 - 89.4.131.0/24 2685 0.1% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 10 - 61.0.0.0/8 2220 0.1% AS4678 -- FINE CANON NETWORK COMMUNICATIONS INC. 11 - 83.223.32.0/23 1993 0.1% AS31624 -- VFMNL-AS Verza Facility Management BV 12 - 83.223.38.0/23 1993 0.1% AS31624 -- VFMNL-AS Verza Facility Management BV 13 - 83.223.36.0/23 1993 0.1% AS31624 -- VFMNL-AS Verza Facility Management BV 14 - 83.223.40.0/23 1993 0.1% AS31624 -- VFMNL-AS Verza Facility Management BV 15 - 194.42.208.0/20 1891 0.1% AS705 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 16 - 203.177.144.0/23 1667 0.1% AS4775 -- GLOBE-TELECOM-AS Telecom Carrier / ISP Plus + 17 - 202.136.172.0/22 1605 0.1% AS17645 -- NTT-SG-AP ASN - NTT SINGAPORE PTE LTD 18 - 202.136.180.0/23 1605 0.1% AS17645 -- NTT-SG-AP ASN - NTT SINGAPORE PTE LTD 19 - 203.119.54.0/24 1605 0.1% AS38151 -- ENUM-AS-ID APJII-RD 20 - 58.65.2.0/23 1551 0.1% AS17645 -- NTT-SG-AP ASN - NTT SINGAPORE PTE LTD Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0