July 2007 - Test - lists.nanog.org

Mail Delivery (failure nanog@merit.edu)
by chip＠unicom.com 17 Jul '07

17 Jul '07

Dangerous Attachment has been Removed. The file "" has been removed because of a virus. It was infected with the "HTML/Iframe_CID!exploit" virus. File quarantined as: "". http://www.fortinet.com/VirusEncyclopedia/search/encyclopediaSearch.do?meth… Dangerous Attachment has been Removed. The file "message.scr" has been removed because of a virus. It was infected with the "W32/Netsky.P@mm" virus. File quarantined as: "". http://www.fortinet.com/VirusEncyclopedia/search/encyclopediaSearch.do?meth…

1 0

Current routing issues?
by Marcus H. Sachs 17 Jul '07

17 Jul '07

The Internet Storm Center just received a couple of notes from readers wondering if there are known routing problems happening right now. See http://www.internetpulse.net/. Any ideas? Marc -- Marc Sachs SANS ISC

2 2

Carrier Recommendations
by Daniel 17 Jul '07

17 Jul '07

All, I am currently in the process of evaluating carriers for future expansion into international regions, primarily Asia, Europe and South America. I am comfortable with AT&T and Verizon however I would like to make sure I include all the major players and would like your direct feedback and commentary in regards to any of them. These are the key areas I am concerned with. Support Reliability Flexibility Complexity Coverage I am looking at two deployment options as well if anyone would like to comment. 1) A single carrier for global connectivity to all sites (mpls etc) 2) A single carrier for global regional connectivity, and in country/regional carriers for all local offices that funnel back to regional aggregation points. Any insight would be greatly appreciated. Thanks, Daniel

3 2

Announcing new KYE paper: Fast-Flux Service Networks
by Lance Spitzner 17 Jul '07

17 Jul '07

The Honeynet Project & Research Alliance are excited to announce the release of a new paper, "KYE: Fast-Flux Service Networks". This whitepaper details a growing technique within the criminal community called fast-flux networks. Fast-flux is an architecture that builds more robust networks for malicious activity while making them more difficult to track and shutdown. In addition to the architecture, the paper covers how service provider networks can detect and mitigate these threats. You can learn more at KYE: Fast-Flux Service Networks http://www.honeynet.org/papers/ff/index.html This is the first KYE paper we are releasing in both .pdf and .html format. Thanks! lance

1 0

verizon
by bmanning＠vacation.karoshi.com 16 Jul '07

16 Jul '07

Industry consolidation denied. http://www.bloomberg.com/apps/news?pid=20601103&sid=aeIORwl_Y1WA&refer=us&s… --bill

1 0

Cisco 7200 series and G2 NPEs
by Steven Haigh 16 Jul '07

16 Jul '07

Hi all, I'm wondering if there is anyone willing to share any experiences they have had with Cisco 7200 series equipment (specifically relating to the G2 NPE) and any 12.4 based IOS. We were initially advised by Cisco to run 12.4(4)-XD7, however upon introducing our first G2 into the network, the vpdn target routers had a ~20% CPU usage increase, while the G2 itself showed signs of incorrectly establishing tunnels. Changing back to a G1 NPE (same config) and everything works as expected. Cisco has recommended that we move to a 12.2 SB IOS for the G2, however I'm wondering what other people are doing. On another note, it seems as though it is not possible to recover a G2 from a rommon state with invalid bootloader images or corrupt bootflash:. There are no commands in the rommon to allow Xmodem uploads via the console, nor any networking functions. I also noticed that it seems to be impossible to load the bootloader from a CF card - even though you can list the contents of the CF card. Does anyone have any recovery techniques that I'm not aware about in a real world failure scenario? -- Steven Haigh Email: netwiz(a)crc.id.au Web: http://www.crc.id.au Phone: (03) 9017 0597 - 0404 087 474

2 1

None
by None 13 Jul '07

13 Jul '07

0 (EDT) X-Virus-Scanned: amavisd-new at merit.edu Received: from trapdoor.merit.edu ([127.0.0.1]) by localhost (trapdoor.merit.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0vh7x9PbbZ55 for <nanog-outgoing(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:49:04 -0400 (EDT) Received: by trapdoor.merit.edu (Postfix, from userid 56) id 23CB44DF32; Fri, 13 Jul 2007 14:48:28 -0400 (EDT) Delivered-To: nanog(a)trapdoor.merit.edu X-Virus-Scanned: amavisd-new at merit.edu Received: from trapdoor.merit.edu ([127.0.0.1]) by localhost (trapdoor.merit.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sb6A9WOEOCBS for <nanog(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:47:43 -0400 (EDT) Received: from mozart.merit.edu (mozart.merit.edu [198.108.95.9]) by trapdoor.merit.edu (Postfix) with ESMTP id 823E74DFAB for <nanog(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:47:04 -0400 (EDT) Received: from bach.merit.edu (razorgate.merit.edu [198.108.95.7]) by mozart.merit.edu (MOS 3.8.2-GA) with ESMTP id AJY28182; Fri, 13 Jul 2007 14:48:46 -0400 (EDT) Received: from jem01.its.hawaii.edu (jem01.its.hawaii.edu [128.171.224.23]) by bach.merit.edu (MOS 3.8.2-GA) with ESMTP id ADW06257; Fri, 13 Jul 2007 14:48:45 -0400 (EDT) Received: from pmxchannel-daemon.jem01.its.hawaii.edu by jem01.its.hawaii.edu (Sun Java System Messaging Server 6.2-5.04 (built Jan 24 2006)) id <0JL400A12S98RE00(a)jem01.its.hawaii.edu>; Fri, 13 Jul 2007 08:48:44 -1000 (HST) Received: from [0.0.0.0] (vs162071.vserver.de [62.75.162.71]) by jem01.its.hawaii.edu (Sun Java System Messaging Server 6.2-5.04 (built Jan 24 2006)) with ESMTPSA id <0JL4003G8S8JEXE1(a)jem01.its.hawaii.edu>; Fri, 13 Jul 2007 08:48:27 -1000 (HST) Date: Fri, 13 Jul 2007 14:48:28 -0400 From: "Prof. Robert Mathews (OSIA)" <mathews(a)hawaii.edu> Subject: Breaking News: All Online Data Lost After Internet Crash To: NANOG <nanog(a)merit.edu> Message-id: <4697C8FC.4080705(a)hawaii.edu> Organization: University of Hawai'i - CSATI MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_nKYpYK3YwfDOdB0VFZXUVg)" X-PMX-Version: 5.3.2.304607, Antispam-Engine: 2.5.1.298604, Antispam-Data: 2007.7.13.112733 User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) Sender: owner-nanog(a)merit.edu Precedence: bulk Errors-To: owner-nanog(a)merit.edu X-Loop: nanog X-Junkmail-Status: score=10/50, host=mozart.merit.edu X-Junkmail-SD-Raw: score=unknown, refid=str=0001.0A090209.4697CA4B.0086:SCGAP167720,ss=1,fgs=0, ip=198.108.1.26, so=2006-09-22 03:48:54, dmn=5.3.14/2007-05-31 Status: RO X-Status: X-Keywords: NonJunk X-UID: 65 This is a multi-part message in MIME format. --Boundary_(ID_nKYpYK3YwfDOdB0VFZXUVg) Content-type: multipart/alternative; boundary="Boundary_(ID_a0J3qZ3rP5A/ibNQB3X8xA)" --Boundary_(ID_a0J3qZ3rP5A/ibNQB3X8xA) Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT Nanogers: I would like to introduce a motion to place the 'Slashdotting of Peter's mother' - discussion on hold, and IMMEDIATELY move to debate the ways in which we can avoid the type of *'data fatalities' *as outlined in the story below. Regards, Robert. -- -------- Original Message -------- Robert you are going to love this one. Regards. *Sent:* Friday, July 13, 2007 12:18 PM The recommended page is: Breaking News: All Online Data Lost After Internet Crash <http://www.theonion.com/content/video/breaking_news_all_online_data?utm_sou… =EMTF_Onion> http://www.theonion.com/content/video/breaking_news_all_online_data?utm_sou… EMTF_Onion --Boundary_(ID_a0J3qZ3rP5A/ibNQB3X8xA) Content-type: text/html; charset=ISO-8859-1 Content-transfer-encoding: 7BIT <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>A Friend Recommends A Page From The Onion</title> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta content="MSHTML 6.00.2900.3132" name="GENERATOR"> </head> <body bgcolor="#ffffff" text="#000000"> Nanogers: I would like to introduce a motion to place the 'Slashdotting of Peter's  mother' - discussion on hold, and IMMEDIATELY move to debate the ways in which we can avoid the type of 'data fatalities' as outlined in the story below. Regards, Robert. -- -------- Original Message -------- <title>A Friend Recommends A Page From The Onion</title> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta content="MSHTML 6.00.2900.3132" name="GENERATOR"> <div dir="ltr" align="left">Robert you are going to love this one.  Regards. </div>  Sent: Friday, July 13, 2007 12:18 PM The recommended page is: <a moz-do-not-send="true" href="http://www.theonion.com/content/video/breaking_news_all_online_data?utm_ source=EMTF_Onion">Breaking News: All Online Data Lost After Internet Crash</a> <a class="moz-txt-link-freetext" href="h ttp://www.theonion.com/content/video/breaking_news_all_online_data?utm_sour… MTF_Onion">http://www.theonion.com/content/video/breaking_news_all_online_data? utm_source=EMTF_Onion</a> </body> </html> --Boundary_(ID_a0J3qZ3rP5A/ibNQB3X8xA)-- --Boundary_(ID_nKYpYK3YwfDOdB0VFZXUVg) Content-type: text/x-vcard; charset=utf-8; name=mathews.vcf Content-transfer-encoding: 7BIT Content-disposition: attachment; filename=mathews.vcf begin:vcard fn:Prof. Robert Mathews n:Mathews;Robert org:University of Hawai'i adr:Wentworth Hall, Room# 2, 200 W. Kawili St. (ITO);;415 Nahua St., Ste 814 & 815 (HNL) / ;Honolulu & Hilo;HI;96815/96720;U.S.A email;internet:mathews@Hawaii.Edu title:Distinguished Senior Research Scholar on National Security Affairs & U.S. Industrial Preparedness tel;work:+ 315.853.7853 (NY) / + 703.655.7124 (VA/WDC) tel;fax:+ 315.859.1998 note;quoted-printable:This visiting card contains two distinct addresses, = =0D=0A= one for Honolulu Hi., and the other for Hilo, Hi. = =0D=0A= =0D=0A= If writing to Prof. Mathews is your preference,=0D=0A= then it must be noted that he can presently = =0D=0A= be reached through the following address, = =0D=0A= and it is:=0D=0A= =0D=0A= 119 St. Mary's Avenue,=0D=0A= Clinton, NY 13323.=0D=0A= U.S.A x-mozilla-html:FALSE url:http://www2.hawaii.edu/~mathews version:2.1 end:vcard --Boundary_(ID_nKYpYK3YwfDOdB0VFZXUVg)--

1 0

None
by None 13 Jul '07

13 Jul '07

0 (EDT) X-Virus-Scanned: amavisd-new at merit.edu Received: from trapdoor.merit.edu ([127.0.0.1]) by localhost (trapdoor.merit.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3JIGC9VZ3GxV for <nanog-outgoing(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:28:33 -0400 (EDT) Received: by trapdoor.merit.edu (Postfix, from userid 56) id 0ADB34DFC2; Fri, 13 Jul 2007 14:27:06 -0400 (EDT) Delivered-To: nanog(a)trapdoor.merit.edu X-Virus-Scanned: amavisd-new at merit.edu Received: from trapdoor.merit.edu ([127.0.0.1]) by localhost (trapdoor.merit.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0QmPLIZDrCye for <nanog(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:26:57 -0400 (EDT) Received: from mozart.merit.edu (mozart.merit.edu [198.108.95.9]) by trapdoor.merit.edu (Postfix) with ESMTP id EE43E4DFC5 for <nanog(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:22:38 -0400 (EDT) Received: from bach.merit.edu (razorgate.merit.edu [198.108.95.7]) by mozart.merit.edu (MOS 3.8.2-GA) with ESMTP id AJY25472; Fri, 13 Jul 2007 14:24:17 -0400 (EDT) Received: from chopin.merit.edu (razorgate.merit.edu [198.108.95.8]) by bach.merit.edu (MOS 3.8.2-GA) with ESMTP id ADW05340; Fri, 13 Jul 2007 14:24:16 -0400 (EDT) Received: from smtp-out.google.com (smtp-out.google.com [216.239.45.13]) by chopin.merit.edu (MOS 3.8.2-GA) with ESMTP id AFK49711; Fri, 13 Jul 2007 14:24:16 -0400 (EDT) Received: from zps77.corp.google.com (zps77.corp.google.com [172.25.146.77]) by smtp-out.google.com with ESMTP id l6DIOBLm020621; Fri, 13 Jul 2007 11:24:11 -0700 Received: from [172.29.23.83] (dot.corp.google.com [172.29.23.83]) (authenticated bits=0) by zps77.corp.google.com with ESMTP id l6DINxtd031838 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Fri, 13 Jul 2007 11:24:01 -0700 In-Reply-To: <4696E69E.20104(a)west.net> References: <30366.27320.qm(a)web30805.mail.mud.yahoo.com> <4696E69E.20104(a)west.n et> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <CDC42C7A-A318-48B6-BA55-B73D4675161A(a)kumari.net> Cc: nanog <nanog(a)merit.edu> Content-Transfer-Encoding: 7bit From: Warren Kumari <warren(a)kumari.net> Subject: Re: TCP congestion Date: Fri, 13 Jul 2007 14:23:45 -0400 To: Jay Hennigan <jay(a)west.net> X-Mailer: Apple Mail (2.752.3) Sender: owner-nanog(a)merit.edu Precedence: bulk Errors-To: owner-nanog(a)merit.edu X-Loop: nanog X-Junkmail-Status: score=10/50, host=mozart.merit.edu X-Junkmail-SD-Raw: score=unknown, refid=str=0001.0A090202.4697C591.0134:SCGAP167720,ss=1,fgs=0, ip=198.108.1.26, so=2006-09-22 03:48:54, dmn=5.3.14/2007-05-31 Status: RO So, when you say "pickup again after 15-20 seconds" do you mean that it takes 15-20 seconds to ramp back up to the original speed or that the line is basically idle for 15-20 seconds before any packets start flowing again? If the latter, I'd suggest that you take a look at the apps some more.. Actually, you might want to try and duplicate the issue with identical machines sitting next to each other and a piece of cable between them... On Jul 12, 2007, at 10:42 PM, Jay Hennigan wrote: > > Philip Lavine wrote: >> Can someone explain how a TCP conversation could degenerate into >> congestion avoidance on a long fat pipe if there is no packet/ >> segment loss or out of order segments? Here is the situation: >> WAN = 9 Mbps ATM connection between NY and LA (70 ms delay) >> LAN = Gig Ethernet >> Receiver: LA server = Win2k3 >> Sender: NY server = Linux 2.4 >> Data transmission typical = bursty but never more that 50% of CIR >> Segment sizes = 64k to 1460k but mostly less than 100k >> Typical Problem Scenario: Data transmission is humming along >> consistently at 2 Mbps, all of a sudden transmission rates drop to >> nothing then pickup again after 15-20 seconds. Prior to the drop >> off (based on packet capture) there is usually a DUP ACK/SACK >> coming from the receiver followed by the Retransmits and >> congestion avoidence. What is strange is there is nothing prior to >> the drop off that would be an impetus for congestion (no high BW >> utilization or packet loss). >> Also is there any known TCP issues between linux 2.4 kernel and >> windows 2003 SP1? Mainly are there issues regarding the handling >> of SACK, DUP ACK's and Fast Retransmits. Of course we all know >> that this is not a application issue since developers make >> flawless socket code, but if it is network issue how is caused? > > Duplex mismatch on an intermediate ethernet segment? Oooh, I like that one.... > > -- > Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net > Impulse Internet Service - http://www.impulse.net/ > Your local telephone and internet company - 805 884-6323 - WB6RDV > -- She'd even given herself a middle initial - X - which stood for "someone who has a cool and exciting middle name". -- (Terry Pratchett, Maskerade)

1 0

None
by None 13 Jul '07

13 Jul '07

0 (EDT) X-Virus-Scanned: amavisd-new at merit.edu Received: from trapdoor.merit.edu ([127.0.0.1]) by localhost (trapdoor.merit.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7i37TYHIwMFD for <nanog-outgoing(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:18:11 -0400 (EDT) Received: by trapdoor.merit.edu (Postfix, from userid 56) id C65F84DF98; Fri, 13 Jul 2007 14:18:10 -0400 (EDT) Delivered-To: nanog(a)trapdoor.merit.edu X-Virus-Scanned: amavisd-new at merit.edu Received: from trapdoor.merit.edu ([127.0.0.1]) by localhost (trapdoor.merit.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pdCbut3lHMb4 for <nanog(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:18:00 -0400 (EDT) Received: from mozart.merit.edu (mozart.merit.edu [198.108.95.9]) by trapdoor.merit.edu (Postfix) with ESMTP id CCBC44DFC0 for <nanog(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:17:01 -0400 (EDT) Received: from chopin.merit.edu (razorgate.merit.edu [198.108.95.8]) by mozart.merit.edu (MOS 3.8.2-GA) with ESMTP id AJY24839; Fri, 13 Jul 2007 14:18:43 -0400 (EDT) Received: from turing-police.cc.vt.edu (turing-police.cc.vt.edu [128.173.14.107 ]) by chopin.merit.edu (MOS 3.8.2-GA) with ESMTP id AFK49304; Fri, 13 Jul 2007 14:18:43 -0400 (EDT) Received: from turing-police.cc.vt.edu (turing-police.cc.vt.edu [127.0.0.1]) by turing-police.cc.vt.edu (8.14.1/8.14.1) with ESMTP id l6DIIgYu032640 ; Fri, 13 Jul 2007 14:18:42 -0400 X-Mailer: exmh version 2.7.2 01/07/2005 with nmh-1.2 To: Keegan.Holley(a)sungard.com Cc: nanog(a)nanog.org Subject: Re: peter lothberg's mother slashdotted In-Reply-To: Your message of "Fri, 13 Jul 2007 13:57:01 EDT." <OF45E950D8.4930B35D-ON85257317.006053EE-85257317.00629AA1@sungard .com> From: Valdis.Kletnieks(a)vt.edu References: <OF45E950D8.4930B35D-ON85257317.006053EE-85257317.00629AA1@sungard. com> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="==_Exmh_1184350722_3376P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit Date: Fri, 13 Jul 2007 14:18:42 -0400 Message-ID: <32638.1184350722(a)turing-police.cc.vt.edu> Sender: owner-nanog(a)merit.edu Precedence: bulk Errors-To: owner-nanog(a)merit.edu X-Loop: nanog X-Junkmail-Status: score=10/50, host=mozart.merit.edu X-Junkmail-SD-Raw: score=unknown, refid=str=0001.0A090202.4697C2E7.008B:SCGAP167720,ss=1,fgs=0, ip=198.108.1.26, so=2006-09-22 03:48:54, dmn=5.3.14/2007-05-31 Status: RO X-Status: X-Keywords: NonJunk X-UID: 63 --==_Exmh_1184350722_3376P Content-Type: text/plain; charset=us-ascii On Fri, 13 Jul 2007 13:57:01 EDT, Keegan.Holley(a)sungard.com said: > Maybe I'm missing something as I'm not the smartest guy on this list, but > what exactly did this prove? Always an important question to ask... > Although, a picture of Peter Lothberg in his mothers basement standing > next to a CRS-1 and maybe 8am Margera would make a better commercial than > the one with the kids. Hey Peter - they're onto you. :) --==_Exmh_1184350722_3376P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Exmh version 2.5 07/13/2001 iD8DBQFGl8ICcC3lWbTT17ARAiVRAKCYRUowXk6sv0qqiEslrqwxfpWDOgCg+GJc vQ7qn737CbMIh2I6APZ6TyQ= =BiQG -----END PGP SIGNATURE----- --==_Exmh_1184350722_3376P--

1 0

None
by None 13 Jul '07

13 Jul '07

0 (EDT) X-Virus-Scanned: amavisd-new at merit.edu Received: from trapdoor.merit.edu ([127.0.0.1]) by localhost (trapdoor.merit.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nrXmMFh-mj-o for <nanog-outgoing(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:04:40 -0400 (EDT) Received: by trapdoor.merit.edu (Postfix, from userid 56) id 7F5814DFB4; Fri, 13 Jul 2007 14:04:38 -0400 (EDT) Delivered-To: nanog(a)trapdoor.merit.edu X-Virus-Scanned: amavisd-new at merit.edu Received: from trapdoor.merit.edu ([127.0.0.1]) by localhost (trapdoor.merit.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t57bYksKJ+h8 for <nanog(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:04:25 -0400 (EDT) Received: from mozart.merit.edu (mozart.merit.edu [198.108.95.9]) by trapdoor.merit.edu (Postfix) with ESMTP id 0D5864DFD4 for <nanog(a)trapdoor.merit.edu>; Fri, 13 Jul 2007 14:02:46 -0400 (EDT) Received: from bach.merit.edu (razorgate.merit.edu [198.108.95.7]) by mozart.merit.edu (MOS 3.8.2-GA) with ESMTP id AJY23254; Fri, 13 Jul 2007 14:04:24 -0400 (EDT) Received: from thyme.apnic.net (thyme.apnic.net [203.119.0.114]) by bach.merit.edu (MOS 3.8.2-GA) with ESMTP id ADW04511; Fri, 13 Jul 2007 14:04:19 -0400 (EDT) Received: from thyme.apnic.net (localhost.localdomain [127.0.0.1]) by thyme.apnic.net (8.13.1/8.13.1) with ESMTP id l6DI3xpF009401; Sat, 14 Jul 2007 04:03:59 +1000 Received: (from cscora@localhost) by thyme.apnic.net (8.13.1/8.13.1/Submit) id l6DI3uZV009399; Sat, 14 Jul 2007 04:03:56 +1000 From: Routing Analysis Role Account <cscora(a)apnic.net> Message-Id: <200707131803.l6DI3uZV009399(a)thyme.apnic.net> Subject: Weekly Routing Table Report Date: Sat, 14 Jul 2007 04:03:56 +1000 (EST) Reply-To: pfs(a)cisco.com To: apops(a)apops.net, nanog(a)nanog.org, routing-wg(a)ripe.net, afnog(a)afnog.org, ausnog(a)ausnog.net, sanog(a)sanog.org X-Mailer: fastmail [version 2.5 PL6] Sender: owner-nanog(a)merit.edu Precedence: bulk Errors-To: owner-nanog(a)merit.edu This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 14 Jul, 2007 Report Website: http://thyme.apnic.net This report: http://thyme.apnic.net/ap-data/2007/07/14/0400 Analysis Summary ---------------- BGP routing table entries examined: 225547 Prefixes after maximum aggregation: 118636 Deaggregation factor: 1.90 Unique aggregates announced to Internet: 109493 Total ASes present in the Internet Routing Table: 25683 Prefixes per ASN: 8.78 Origin-only ASes present in the Internet Routing Table: 22406 Origin ASes announcing only one prefix: 10886 Transit ASes present in the Internet Routing Table: 3277 Transit-only ASes present in the Internet Routing Table: 73 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 25 Max AS path prepend of ASN (16327) 21 Prefixes from unregistered ASNs in the Routing Table: 7 Unregistered ASNs in the Routing Table: 10 Prefixes from 32-bit ASNs in the Routing Table: 5 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 11 Number of addresses announced to Internet: 1737103968 Equivalent to 103 /8s, 138 /16s and 26 /24s Percentage of available address space announced: 46.9 Percentage of allocated address space announced: 62.1 Percentage of available address space allocated: 75.5 Total number of prefixes smaller than registry allocations: 118597 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 52824 Total APNIC prefixes after maximum aggregation: 20564 APNIC Deaggregation factor: 2.57 Prefixes being announced from the APNIC address blocks: 49705 Unique aggregates announced from the APNIC address blocks: 21795 APNIC Region origin ASes present in the Internet Routing Table: 3009 APNIC Prefixes per ASN: 16.52 APNIC Region origin ASes announcing only one prefix: 803 APNIC Region transit ASes present in the Internet Routing Table: 452 Average APNIC Region AS path length visible: 3.7 Max APNIC Region AS path length visible: 25 Number of APNIC addresses announced to Internet: 304296352 Equivalent to 18 /8s, 35 /16s and 49 /24s Percentage of available APNIC address space announced: 75.4 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 116/6, 120/6, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 107255 Total ARIN prefixes after maximum aggregation: 62281 ARIN Deaggregation factor: 1.72 Prefixes being announced from the ARIN address blocks: 78905 Unique aggregates announced from the ARIN address blocks: 31219 ARIN Region origin ASes present in the Internet Routing Table: 11677 ARIN Prefixes per ASN: 6.76 ARIN Region origin ASes announcing only one prefix: 4502 ARIN Region transit ASes present in the Internet Routing Table: 1060 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 339063104 Equivalent to 20 /8s, 53 /16s and 177 /24s Percentage of available ARIN address space announced: 74.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 96/6, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 47361 Total RIPE prefixes after maximum aggregation: 30469 RIPE Deaggregation factor: 1.55 Prefixes being announced from the RIPE address blocks: 43732 Unique aggregates announced from the RIPE address blocks: 28884 RIPE Region origin ASes present in the Internet Routing Table: 9902 RIPE Prefixes per ASN: 4.42 RIPE Region origin ASes announcing only one prefix: 5255 RIPE Region transit ASes present in the Internet Routing Table: 1557 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 24 Number of RIPE addresses announced to Internet: 322506048 Equivalent to 19 /8s, 57 /16s and 13 /24s Percentage of available RIPE address space announced: 80.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-44031 RIPE Address Blocks 62/8, 77/8, 78/7, 80/5, 88/6, 92/7, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 15508 Total LACNIC prefixes after maximum aggregation: 4289 LACNIC Deaggregation factor: 3.62 Prefixes being announced from the LACNIC address blocks: 13549 Unique aggregates announced from the LACNIC address blocks: 7650 LACNIC Region origin ASes present in the Internet Routing Table: 824 LACNIC Prefixes per ASN: 16.44 LACNIC Region origin ASes announcing only one prefix: 266 LACNIC Region transit ASes present in the Internet Routing Table: 140 Average LACNIC Region AS path length visible: 4.0 Max LACNIC Region AS path length visible: 19 Number of LACNIC addresses announced to Internet: 40528384 Equivalent to 2 /8s, 106 /16s and 106 /24s Percentage of available LACNIC address space announced: 60.4 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2591 Total AfriNIC prefixes after maximum aggregation: 1023 AfriNIC Deaggregation factor: 2.53 Prefixes being announced from the AfriNIC address blocks: 2102 Unique aggregates announced from the AfriNIC address blocks: 1281 AfriNIC Region origin ASes present in the Internet Routing Table: 197 AfriNIC Prefixes per ASN: 10.67 AfriNIC Region origin ASes announcing only one prefix: 60 AfriNIC Region transit ASes present in the Internet Routing Table: 35 Average AfriNIC Region AS path length visible: 3.7 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 6299392 Equivalent to 0 /8s, 96 /16s and 31 /24s Percentage of available AfriNIC address space announced: 18.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1355 10715 285 CHINANET-BACKBONE 4755 1277 382 71 Videsh Sanchar Nigam Ltd. Aut 9583 1115 80 375 Sify Limited 9498 965 533 68 BHARTI BT INTERNET LTD. 23577 793 34 687 Korea Telecom (ATM-MPLS) 4766 784 4929 314 Korea Telecom (KIX) 17488 721 63 54 Hathway IP Over Cable Interne 7545 689 149 111 TPG Internet Pty Ltd 18101 565 117 39 Reliance Infocom Ltd Internet 1221 544 1951 423 Telstra Pty Ltd 4812 521 903 92 China Telecom (Shanghai) 4668 512 68 10 LG-EDS Systems Inc. 17676 504 10935 65 Softbank BB Corp. 9443 472 122 77 Primus Telecommunications 7474 411 218 270 SingTel Optus Pty Ltd 4802 410 105 150 Wantree Development 17974 371 130 13 PT TELEKOMUNIKASI INDONESIA 2907 362 1701 302 SINET Japan 4808 355 666 118 CNCGROUP IP network: China169 17557 352 45 173 Pakistan Telecom ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1464 6058 989 AT&T WorldNet Services 4323 1321 1021 375 Time Warner Telecom 2386 1209 616 751 AT&T Data Communications Serv 6478 1129 371 173 AT&T Worldnet Services 11492 1099 107 27 Cable One 6197 1028 717 509 BellSouth Network Solutions, 18566 1014 288 9 Covad Communications 174 965 6776 855 Cogent Communications 701 944 6565 721 UUNET Technologies, Inc. 7011 857 252 537 Citizens Utilities 1239 815 2741 581 Sprint 20115 800 734 428 Charter Communications 19262 759 2755 185 Verizon Global Networks 209 742 3859 577 Qwest 22773 738 1892 49 Cox Communications, Inc. 5668 616 169 21 CenturyTel Internet Holdings, 7029 612 488 79 Alltel Information Services, 855 575 254 73 Canadian Research Network 852 572 1093 363 Telus Advanced Communications 19916 568 49 51 OLM LLC RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 2119 513 1075 136 Telenor Internet Access 702 500 1921 401 UUNET - Commercial IP service 24863 358 56 37 LINKdotNET AS number 9116 316 168 25 Goldenlines main autonomous s 3301 311 1456 291 TeliaNet Sweden 3320 309 6034 256 Deutsche Telekom AG 6746 280 129 256 Dynamic Network Technologies, 5089 268 1658 53 NTL Group Limited 680 265 2045 256 DFN-IP service G-WiN 3215 255 2376 96 France Telecom Transpac 8220 251 444 243 COLT Telecommunications 8708 250 420 239 Romania Data Systems S.A. 8551 223 213 28 Bezeq International 3269 222 2775 74 TELECOM ITALIA 3352 218 1864 41 Ibernet, Internet Access Netw 9121 210 1441 24 TTnet Autonomous System 1257 194 1195 172 SWIPnet Swedish IP Network 3292 194 1379 174 TDC Tele Danmark 12479 190 578 6 Uni2 Autonomous System 3246 185 253 176 Song Networks LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 855 1910 211 UniNet S.A. de C.V. 11830 483 299 9 Instituto Costarricense de El 11172 373 116 63 Servicios Alestra S.A de C.V 16814 361 22 8 NSS, S.A. 22047 318 246 13 VTR PUNTO NET S.A. 7303 305 148 35 Telecom Argentina Stet-France 6471 299 74 33 ENTEL CHILE S.A. 14117 279 19 15 Telefonica del Sur S.A. 11556 231 128 4 Cable-Wireless Panama 6147 226 174 26 Telefonica Del Peru 6503 208 172 85 AVANTEL, S.A. 10620 208 59 14 TVCABLE BOGOTA 23216 196 16 43 RAMtelecom Telecomunicaciones 10481 181 72 8 Prima S.A. 14522 177 28 7 SatNet S.A. 8163 176 11 9 METROTEL REDES S.A. 7738 156 506 23 Telecomunicacoes da Bahia S.A 20299 156 23 12 NEWCOM AMERICAS 21826 156 27 59 INTERCABLE 7910 155 11 30 ANDINET ON LINE AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 277 867 221 The Internet Solution 8452 231 188 7 TEDATA 6713 142 135 11 Itissalat Al-MAGHRIB 2018 136 301 111 Tertiary Education Network 5536 124 8 10 Internet Egypt Network 33783 122 8 12 EEPAD TISP TELECOM & INTERNET 24835 86 48 6 RAYA Telecom - Egypt 2905 76 174 73 The Internetworking Company o 15475 76 84 4 Nile Online 2561 62 6 2 Egyptian Universities Network 15706 56 12 4 Sudatel Internet Exchange Aut 23889 51 16 15 MAURITIUS TELECOM 5713 46 294 36 Telkom SA Ltd 33774 44 29 24 AS Number for Telecom Algeria 16637 37 21 29 Johnnic e-Ventures 33776 35 2 6 Starcomms Nigeria Limited 8524 32 2 8 AUCEGYPT Autonomous System 12455 31 6 3 Jambonet Autonomous system 21280 29 4 4 Swift Global Kenya Ltd.Is an 10798 24 2 15 Standard Bank of South Africa Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4755 1277 1206 Videsh Sanchar Nigam Ltd. Aut 11492 1099 1072 Cable One 4134 1355 1070 CHINANET-BACKBONE 18566 1014 1005 Covad Communications 6478 1129 956 AT&T Worldnet Services 4323 1321 946 Time Warner Telecom 9498 965 897 BHARTI BT INTERNET LTD. 9583 1115 740 Sify Limited 22773 738 689 Cox Communications, Inc. 17488 721 667 Hathway IP Over Cable Interne 8151 855 644 UniNet S.A. de C.V. 5668 616 595 CenturyTel Internet Holdings, 7545 689 578 TPG Internet Pty Ltd 19262 759 574 Verizon Global Networks 7029 612 533 Alltel Information Services, 18101 565 526 Reliance Infocom Ltd Internet 6517 563 526 Yipes Communications, Inc. 6197 1028 519 BellSouth Network Solutions, 19916 568 517 OLM LLC 15270 555 517 PaeTec.net -a division of Pae List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65332 PRIVATE 63.166.106.192/27 1803 SPRINT 43185 UNALLOCATED 77.95.208.0/21 12779 ITGATE.Net 38347 UNALLOCATED 116.212.160.0/21 9389 BEIJING SHENZHOU GRE 38347 UNALLOCATED 116.212.168.0/21 9389 BEIJING SHENZHOU GRE 24410 UNALLOCATED 203.119.28.0/24 4134 CHINANET-BACKBONE 65101 PRIVATE 203.127.145.0/24 9255 Singapore Telecom 22895 UNALLOCATED 216.174.38.0/24 19094 Adelphia Business So Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 7.1.1.0/24 1239 Sprint 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.33.1.0/24 7018 AT&T WorldNet Services 192.0.10.0/24 9498 BHARTI BT INTERNET LTD. 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.153.136.0/21 721 DLA Systems Automation Center 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:9 /10:15 /11:36 /12:129 /13:254 /14:468 /15:901 /16:9546 /17:4012 /18:6483 /19:13733 /20:15992 /21:14447 /22:18801 /23:19740 /24:118614 /25:771 /26:987 /27:479 /28:77 /29:8 /30:14 /31:0 /32:13 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6478 1119 1129 AT&T Worldnet Services 11492 1090 1099 Cable One 18566 996 1014 Covad Communications 9583 956 1115 Sify Limited 2386 902 1209 AT&T Data Communications Serv 7018 796 1464 AT&T WorldNet Services 23577 784 793 Korea Telecom (ATM-MPLS) 6197 781 1028 BellSouth Network Solutions, 7011 756 857 Citizens Utilities 4755 673 1277 Videsh Sanchar Nigam Ltd. Aut 9498 639 965 BHARTI BT INTERNET LTD. 4766 588 784 Korea Telecom (KIX) 19916 563 568 OLM LLC 4323 553 1321 Time Warner Telecom 17488 543 721 Hathway IP Over Cable Interne 6517 528 563 Yipes Communications, Inc. 15270 519 555 PaeTec.net -a division of Pae 4668 502 512 LG-EDS Systems Inc. 5668 482 616 CenturyTel Internet Holdings, 18101 479 565 Reliance Infocom Ltd Internet Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:8 7:1 8:83 9:1 12:1803 15:19 16:3 17:3 18:11 20:37 24:938 25:1 32:50 33:3 38:334 40:60 41:208 44:2 47:3 52:4 55:3 56:3 57:25 58:430 59:378 60:333 61:986 62:872 63:1983 64:3120 65:2357 66:3301 67:742 68:625 69:1890 70:433 71:106 72:1345 73:2 74:572 75:269 76:72 77:280 78:19 80:827 81:817 82:668 83:383 84:487 85:869 86:341 87:455 88:287 89:906 90:7 91:413 97:6 98:4 116:239 117:49 121:230 122:576 123:128 124:846 125:942 128:288 129:222 130:140 131:360 132:54 133:9 134:195 135:38 136:186 137:80 138:149 139:72 140:495 141:173 142:373 143:233 144:297 145:45 146:324 147:120 148:401 149:144 150:113 151:160 152:90 153:127 154:2 155:254 156:153 157:213 158:159 159:162 160:105 161:93 162:219 163:179 164:461 165:408 166:294 167:292 168:506 169:120 170:409 171:20 172:1 189:61 190:741 192:5738 193:3916 194:3161 195:2240 196:964 198:3812 199:3272 200:4924 201:1097 202:7382 203:7579 204:3965 205:2007 206:2408 207:2834 208:2712 209:3504 210:2439 211:933 212:1302 213:1482 214:408 215:41 216:3988 217:1152 218:362 219:387 220:992 221:409 222:266 End of report

1 0