November 2008 - Test - lists.nanog.org

The Cidr Report
by cidr-report＠potaroo.net 28 Nov '08

28 Nov '08

This report has been generated at Fri Nov 28 21:24:45 2008 AEST. The report analyses the BGP Routing Table of AS2.0 router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org for a current version of this report. Recent Table History Date Prefixes CIDR Agg 21-11-08 291693 179552 22-11-08 292056 179242 23-11-08 292318 178139 24-11-08 292375 179063 25-11-08 292506 179813 26-11-08 292651 178174 27-11-08 292308 176215 28-11-08 288778 176644 AS Summary 30082 Number of ASes in routing system 12755 Number of ASes announcing only one prefix 5069 Largest number of prefixes announced by an AS AS4538 : ERX-CERNET-BKB China Education and Research Network Center 89820928 Largest address span announced by an AS (/32s) AS27064: DDN-ASNBLK1 - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 28Nov08 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 289048 176623 112425 38.9% All ASes AS4538 5069 877 4192 82.7% ERX-CERNET-BKB China Education and Research Network Center AS6389 4379 356 4023 91.9% BELLSOUTH-NET-BLK - BellSouth.net Inc. AS209 2991 1319 1672 55.9% ASN-QWEST - Qwest Communications Corporation AS1785 1701 205 1496 87.9% AS-PAETEC-NET - PaeTec Communications, Inc. AS6298 2168 681 1487 68.6% ASN-CXA-PH-6298-CBS - Cox Communications Inc. AS17488 1442 293 1149 79.7% HATHWAY-NET-AP Hathway IP Over Cable Internet AS4323 1589 458 1131 71.2% TWTC - tw telecom holdings, inc. AS4755 1175 202 973 82.8% TATACOMM-AS TATA Communications formerly VSNL is Leading ISP AS6478 1608 760 848 52.7% ATT-INTERNET3 - AT&T WorldNet Services AS8151 1395 559 836 59.9% Uninet S.A. de C.V. AS18566 1059 242 817 77.1% COVAD - Covad Communications Co. AS11492 1219 451 768 63.0% CABLEONE - CABLE ONE, INC. AS2386 1597 917 680 42.6% INS-AS - AT&T Data Communications Services AS19262 932 255 677 72.6% VZGNI-TRANSIT - Verizon Internet Services Inc. AS18101 787 183 604 76.7% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS3356 1106 524 582 52.6% LEVEL3 Level 3 Communications AS9498 692 115 577 83.4% BBIL-AP BHARTI Airtel Ltd. AS7545 660 154 506 76.7% TPG-INTERNET-AP TPG Internet Pty Ltd AS4808 624 157 467 74.8% CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network AS22773 1003 545 458 45.7% ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. AS20115 1840 1386 454 24.7% CHARTER-NET-HKY-NC - Charter Communications AS24560 625 172 453 72.5% AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services AS7018 1442 999 443 30.7% ATT-INTERNET4 - AT&T WorldNet Services AS17676 522 79 443 84.9% GIGAINFRA BB TECHNOLOGY Corp. AS855 560 119 441 78.8% CANET-ASN-4 - Bell Aliant AS9443 523 84 439 83.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS4766 1331 896 435 32.7% KIXS-AS-KR Korea Telecom AS22047 552 121 431 78.1% VTR BANDA ANCHA S.A. AS4134 907 477 430 47.4% CHINANET-BACKBONE No.31,Jin-rong Street AS4668 691 276 415 60.1% LGNET-AS-KR LG CNS Total 42189 13862 28327 67.1% Top 30 total Possible Bogus Routes 24.75.116.0/22 AS10796 SCRR-10796 - Road Runner HoldCo LLC 24.75.160.0/19 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 24.142.40.0/21 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.142.160.0/19 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.245.128.0/17 AS11492 CABLEONE - CABLE ONE, INC. 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 62.61.220.0/23 AS24974 TACHYON-EU Tachyon Europe BV - Wireless Broadband via Satellite 62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV - Wireless Broadband via Satellite 62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV - Wireless Broadband via Satellite 63.140.213.0/24 AS22555 UTC - Universal Talkware Corporation 63.143.251.0/24 AS22555 UTC - Universal Talkware Corporation 63.248.0.0/16 AS3356 LEVEL3 Level 3 Communications 64.7.112.0/21 AS6453 GLOBEINTERNET TATA Communications 64.7.120.0/21 AS6453 GLOBEINTERNET TATA Communications 64.64.159.0/24 AS32004 BIG-ASN - Business Information Group, Inc. 64.79.88.0/24 AS26096 LODDEN - Lodden Services 64.79.89.0/24 AS26096 LODDEN - Lodden Services 64.188.0.0/16 AS3356 LEVEL3 Level 3 Communications 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.40.0/21 AS6261 VISINET - Visionary Systems, Inc. 66.54.91.0/24 AS30506 BLACKSUN-1 - Blacksun Technologies LLC 66.55.160.0/19 AS29994 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.199.32.0/20 AS10397 WISP-AS - Wispnet, LLC 66.206.32.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.33.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.34.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.35.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.40.0/22 AS174 COGENT Cogent/PSI 66.206.44.0/23 AS174 COGENT Cogent/PSI 66.206.47.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 66.207.32.0/20 AS23011 69.71.192.0/20 AS13818 PHX-INTL-TELEPORT - Phoenix International Teleport 69.80.0.0/17 AS3043 AMPHIB-AS - Amphibian Media Corporation 80.88.0.0/21 AS33774 DJAWEB 80.88.8.0/22 AS33774 DJAWEB 80.88.10.0/24 AS33774 DJAWEB 80.88.12.0/24 AS33779 wataniya-telecom-as 87.244.128.0/18 AS8733 CHELLO-BELGIUM UPC Belgium - Chello Belgium 98.96.0.0/13 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 100.10.10.0/24 AS14000 AXTEL, S.A. de C.V. 119.31.232.0/21 AS38870 121.50.168.0/21 AS9931 CAT-AP The Communication Authoity of Thailand, CAT 124.109.16.0/21 AS38137 137.0.0.0/13 AS27064 DDN-ASNBLK1 - DoD Network Information Center 151.135.0.0/16 AS4768 CLIX-NZ TelstraClear Ltd 163.142.0.0/16 AS2500 WIDE-BB WIDE Project 169.254.0.0/16 AS13184 HANSENET HanseNet Telekommunikation GmbH 172.7.0.0/24 AS28175 172.10.1.0/30 AS18305 POSNET POSDATA Co.,Ltd 188.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 188.0.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 188.0.0.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 192.9.0.0/16 AS11479 BRM-SUN-AS - Sun Microsystems, Inc 192.9.200.0/24 AS3602 AS3602-RTI - Rogers Telecom Inc. 192.64.85.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.107.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.108.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.177.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.96.36.0/24 AS5713 SAIX-NET 192.96.37.0/24 AS10474 NETACTIVE 192.96.135.0/24 AS2018 TENET-1 192.96.136.0/23 AS2018 TENET-1 192.96.141.0/24 AS2018 TENET-1 192.96.143.0/24 AS2018 TENET-1 192.96.145.0/24 AS2018 TENET-1 192.96.177.0/24 AS6083 POSIX-AFRICA 192.101.45.0/24 AS2905 TICSA-ASN 192.101.46.0/24 AS6503 Avantel, S.A. 192.101.47.0/24 AS6503 Avantel, S.A. 192.101.64.0/21 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.70.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.71.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.72.0/24 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.73.0/24 AS4765 WORLDNET-AS World Net & Services Co., Ltd. 192.101.74.0/24 AS1239 SPRINTLINK - Sprint 192.124.248.0/23 AS680 DFN-IP service G-WiN 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.131.233.0/24 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.153.144.0/21 AS27064 DDN-ASNBLK1 - DoD Network Information Center 192.154.32.0/19 AS81 NCREN - MCNC 192.188.208.0/20 AS27064 DDN-ASNBLK1 - DoD Network Information Center 195.190.146.0/24 AS9167 WEBPARTNER WEBPARTNER A/S is a Danish Internet Service Provider 196.6.108.0/24 AS5713 SAIX-NET 196.10.119.0/24 AS2018 TENET-1 196.10.122.0/23 AS2018 TENET-1 196.10.251.0/24 AS2018 TENET-1 196.10.252.0/23 AS2018 TENET-1 196.10.254.0/24 AS2018 TENET-1 196.13.101.0/24 AS2018 TENET-1 196.13.102.0/23 AS2018 TENET-1 196.13.104.0/24 AS2018 TENET-1 196.13.121.0/24 AS2018 TENET-1 196.13.125.0/24 AS2018 TENET-1 196.13.126.0/24 AS2018 TENET-1 196.13.169.0/24 AS2018 TENET-1 196.13.174.0/23 AS2018 TENET-1 196.13.176.0/21 AS2018 TENET-1 196.13.192.0/22 AS2018 TENET-1 196.13.196.0/24 AS2018 TENET-1 196.201.98.0/24 AS29571 CITelecom-AS 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET-1 198.54.92.0/24 AS2018 TENET-1 198.54.222.0/24 AS2018 TENET-1 198.97.72.0/21 AS27064 DDN-ASNBLK1 - DoD Network Information Center 198.97.80.0/20 AS27064 DDN-ASNBLK1 - DoD Network Information Center 198.97.96.0/19 AS27064 DDN-ASNBLK1 - DoD Network Information Center 198.97.240.0/20 AS27064 DDN-ASNBLK1 - DoD Network Information Center 198.144.96.0/20 AS12185 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 198.169.0.0/16 AS803 SASKTEL - Saskatchewan Telecommunications 198.180.198.0/24 AS23715 SEOUL-INTGW-GXS-AP Global Exchange Services 199.10.0.0/16 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.0.0/21 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.128.0/18 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.130.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.131.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.132.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DoD Network Information Center 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DoD Network Information Center 199.114.142.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.144.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.148.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.150.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - 754th Electronic Systems Group 199.114.156.0/24 AS1733 CENTAF-SWA - 754th Electronic Systems Group 199.114.160.0/24 AS1733 CENTAF-SWA - 754th Electronic Systems Group 199.121.0.0/16 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.123.0.0/18 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.123.16.0/20 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.123.80.0/21 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.202.216.0/21 AS577 BACOM - Bell Canada 199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 200.0.187.0/24 AS19132 200.5.32.0/21 AS19132 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.72.40.0/21 AS38205 202.72.40.0/24 AS38205 202.72.41.0/24 AS38205 202.72.47.0/24 AS38205 202.73.144.0/20 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 202.80.192.0/20 AS2706 HKSUPER-HK-AP Pacific Internet (Hong Kong) Limited 202.86.252.0/22 AS4748 RESOLINK-AS-AP Resources Link Network Limited 202.86.252.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.94.70.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.150.56.0/24 AS38722 202.150.57.0/24 AS38722 202.181.32.0/24 AS4645 ASN-HKNET-AP HKNet Co. Ltd 203.12.45.0/24 AS4854 NETSPACE-AS-AP Netspace Online Systems 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecommunications Ltd 203.112.111.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.113.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.114.0/24 AS4802 ASN-IINET iiNet Limited 203.112.116.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.117.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.118.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.119.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.120.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.121.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.127.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.128.128.0/19 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 203.128.128.0/24 AS23849 CNNIC-NET263-AP Beijing Capital-online science development Co.,Ltd. 204.9.216.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.9.217.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.9.218.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.13.140.0/22 AS7270 NET2PHONE - Net2Phone Corp. 204.16.120.0/23 AS12077 204.16.122.0/23 AS12077 204.19.14.0/23 AS577 BACOM - Bell Canada 204.48.58.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.48.60.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 206.162.224.0/19 AS23464 ILCSNET - Interlink Computer Services 206.180.240.0/20 AS12083 KNOLOGY-NET - Knology Holdings 206.220.240.0/24 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.240.64/26 AS22335 MREN - Metropolitan Research and Education Network 206.220.240.128/25 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.240.220/32 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.241.0/24 AS10764 STARTAP - National Center for Supercomputing Applications 207.191.128.0/19 AS10887 BPSI-AS - BPSI Internet Services 207.204.168.0/24 AS15150 BELLTECH-AS - BELLWETHER TECHNOLOGY CORPORATION 207.204.222.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc. 208.38.192.0/18 AS3043 AMPHIB-AS - Amphibian Media Corporation 208.38.192.0/21 AS14237 BEAMSPEED1 - Beamspeed 208.38.202.0/24 AS14237 BEAMSPEED1 - Beamspeed 208.38.203.0/24 AS14237 BEAMSPEED1 - Beamspeed 208.38.204.0/22 AS14237 BEAMSPEED1 - Beamspeed 209.54.93.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 209.54.111.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 209.54.123.0/24 AS6062 NETPLEX - NETPLEX 209.54.240.0/21 AS10887 BPSI-AS - BPSI Internet Services 209.74.96.0/19 AS10912 INTERNAP-BLK - Internap Network Services Corporation 209.140.90.0/24 AS14461 NTSL - NET SOLUTIONS 209.140.224.0/21 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.234.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.235.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.236.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.237.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.238.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.239.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.141.16.0/21 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.141.48.0/22 AS14461 NTSL - NET SOLUTIONS 209.145.192.0/18 AS3043 AMPHIB-AS - Amphibian Media Corporation 210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone 216.37.114.0/23 AS3549 GBLX Global Crossing Ltd. 216.37.120.0/23 AS13377 216.59.0.0/17 AS3356 LEVEL3 Level 3 Communications 216.99.16.0/24 AS6395 LVLT-6395 - Level 3 Communications, Inc. 216.99.20.0/24 AS6395 LVLT-6395 - Level 3 Communications, Inc. 216.162.96.0/19 AS7393 CYBERCON - CYBERCON, INC. 216.172.198.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.172.199.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.210.86.0/24 AS577 BACOM - Bell Canada 216.229.51.0/24 AS15211 216.240.240.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.241.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.251.207.0/24 AS1239 SPRINTLINK - Sprint 217.78.71.0/24 AS12491 IPPLANET-AS IPPlanet 217.78.72.0/24 AS12491 IPPLANET-AS IPPlanet 217.78.73.0/24 AS12491 IPPLANET-AS IPPlanet Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

DOS attack assistance?
by Pete Templin 27 Nov '08

27 Nov '08

One of my customers, a host at 64.8.105.15, is feeling a "bonus" ~130kpps from 88.191.63.28. I've null-routed the source, though our Engine2 GE cards don't seem to be doing a proper job of that, unfortunately. The attack is a solid 300% more pps than our aggregate traffic levels. It's coming in via 6461, but they don't appear to have any ability to backtrack it. Their only offer is to blackhole the destination until the attack subsides. BGP tells me the source is in AS 12322, a RIPE AS that has little if any information publicly visible. Any pointers on what to do next? Thanks, Pete

7 7

Todd Young is out of the office.
by Todd_Young＠unigroupinc.com 27 Nov '08

27 Nov '08

I will be out of the office starting 11/26/2008 and will not return until 12/01/2008. I will respond to your message when I return. If you are having a network issue, please contact Network Operations at 1-800-825-9585, option 3. ######################################################################## The information contained in this message, and any attachments thereto, is intended solely for the use of the addressee(s) and may contain confidential and/or privileged material. Any review, retransmission, dissemination, copying, or other use of the transmitted information is prohibited. If you received this in error, please contact the sender and delete the material from any computer. UNIGROUPINC.COM ########################################################################

1 0

Re: IPv6 routing /48s
by Mark Andrews 26 Nov '08

26 Nov '08

Mark Andrews writes: > > In message <20081126002425.GO78345(a)burnout.tpb.net>, Niels Bakker writes: > > * alh-ietf(a)tndh.net (Tony Hain) [Wed 26 Nov 2008, 01:03 CET]: > > > In any case, content providers can avoid the confusion if they simply put > u > > p > > > a local 6to4 router alongside their 2001:: prefix, and populate DNS with > > > both. Longest match will cause 2001:: connected systems to chose that dst > , > > > while 6to4 connected systems will chose 2002:: as the dst. There is no ne > ed > > > > Huh? Longest match done by web browsers and other applications? Since > > when? > > FreeBSD 6 has is as part of the standard getaddrinfo() implementation. > > % grep -r in6_addrpolicy /usr/src/lib/libc > /usr/src/lib/libc/net/getaddrinfo.c: struct in6_addrpolicy pc_policy; > /usr/src/lib/libc/net/getaddrinfo.c: struct in6_addrpolicy *pol, *ep; > /usr/src/lib/libc/net/getaddrinfo.c: ep = (struct in6_addrpolicy *)(buf + > l); > /usr/src/lib/libc/net/getaddrinfo.c: for (pol = (struct in6_addrpolicy *)b > uf; pol + 1 <= ep; pol++) { > /usr/src/lib/libc/net/getaddrinfo.c: struct in6_addrpolicy *pol; > /usr/src/lib/libc/net/name6.c: struct in6_addrpolicy pc_policy; > /usr/src/lib/libc/net/name6.c: struct in6_addrpolicy *pol, *ep; > /usr/src/lib/libc/net/name6.c: ep = (struct in6_addrpolicy *)(buf + l); > /usr/src/lib/libc/net/name6.c: for (pol = (struct in6_addrpolicy *)buf; pol > + 1 <= ep; pol++) { > /usr/src/lib/libc/net/name6.c: struct in6_addrpolicy *pol; > % And it was added on 30-Oct-03 according to CVS. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews(a)isc.org

2 2

Black Friday or Cyber Monday
by Fisher, Shawn 26 Nov '08

26 Nov '08

To all the service providers out there, do you historically see a significant uptick in internet traffic on "Black Friday" <http://en.wikipedia.org/wiki/Black_Friday_(shopping)> (the Friday after the US Holiday of Thanksgiving, named supposedly due to retail companies going from in the "red" all year to "black", bottom-line, "normally" lots of shopping occurs both online and traditional) and Cyber Monday <http://en.wikipedia.org/wiki/Cyber_Monday> ? I am curious what percentages of change are typically seen? TIA, Shawn Fisher

1 0

ip access-list e no-nanog-bs (Was Re: Public Assertions)
by jamie rishaw 26 Nov '08

26 Nov '08

These guys need to get a room already. It's clear that the two bills have forgotten that "No U r !!!1" arguments happen on efnet; nanog@ is reserved strictly for "Are any engineers from [insert_company_who_blacklisted_my_company_here] around?" pages. All three of these boys are acting like drama queens[1] : dash-bill, dash-dash-bill and macgyver too for taking a picture of a piece of snail mail so you could post it on a nerdlist. | Bill Woodcock / 5:52 PM | On Tue, 25 Nov 2008, Dean Anderson wrote: | > A photo of Bill Woodcock's refused letter is at [irrelevant] | | Oh my god... What _is_ that sitting on? Is your desk upholstered with the hides of your victims? Soo.. How do I configure my rooter for that? gw(config)#ip drama enable ^ % Invalid input detected at '^' marker. Computer says no........... -j [1] professional history and credentials upon request On Tue, Nov 25, 2008 at 7:18 PM, Jim Popovitch <yahoo(a)jimpop.com> wrote: > On Tue, Nov 25, 2008 at 18:52, Bill Woodcock <woody(a)pch.net> wrote: > > On Tue, 25 Nov 2008, Dean Anderson wrote: > > > A photo of Bill Woodcock's refused letter is at > > > http://www.av8.net/BillWoodcock.jpg > > That's not a refused letter, that's a certified letter that hasn't yet > been mailed. When refused, the item is signed and stamped (in red > ink) by the postal delivery agent. It would be very interesting to > see the image of the other side of the envelope (where postage > stamp/payment info would appear). > > That said... this whole thing has an air of childishness associated with > it. > > -Jim P. > > -- Jamie Rishaw // .com.arpa@j <- reverse it. ish. [Impressive C-level Title Here], arpa / arpa labs

1 0

Re: Public Assertions
by Bill Woodcock 26 Nov '08

26 Nov '08

On Tue, 25 Nov 2008, Dean Anderson wrote: > A photo of Bill Woodcock's refused letter is at > http://www.av8.net/BillWoodcock.jpg Oh my god... What _is_ that sitting on? Is your desk upholstered with the hides of your victims? Also, I suggest you consult a dictionary. The word "refused" does not mean what you think it does. Amusing as this may be, I'm not sure that you need to bother the vast herd of NANOG co-conspirators with it. -Bill

2 1

The DDOS problem & security BOF: Am i mistaken?
by Scott Doty 25 Nov '08

25 Nov '08

First, the good news: so far, the NANOG conference has been very valuable and content-rich, covering a lot of issues that need to be discussed. For that, I am grateful. But now, the bad news(?): Maybe it's just me & my paranoia, but do I detect an inkling of "murk spam" going on with some presentations? Because there seems to be a fundamental misunderstanding, either on my part, or the part of certain vendors: I'm hear to discuss ideas & freely share them, and they are here to discuss (it would seem) their products. Sometimes both goals coincide, and that is fine...but... When a vendor at the security BOF starts showing documents that are "company confidential", and trying to whip up a climate of fear, that we should all deploy their product in front of our recursive name servers, i get this funny feeling that I am being "murk spammed". Perhaps that is my own perspective (& paranoia?), but I found the CERT gentleman's call to monitor icmp backscatter on our authoritative nameservers far more informative -- and open. But I was disappointed with two vendors and their presentations: the first had the tactic of saying "DNSSEC is the actual solution" when asked about why their product would be necessary...completely ignoring the fact that their proprietary "interim solution" was by no means the only way to prevent cache poisoning attacks. Indeed, I would daresay it isn't the best, either by a BCP perspective, or a cost analysis perspective. To put a finer point on this, i should say that i found myself discomforted by a presentation suggesting that I should put their proprietary appliances between my recursive name servers & the Net, and I am grateful that Mr. Vixie stood up and said that there are other ways of dealing with the problem. Then there was the gentleman with the DDOS detection/mitigation appliance, who flipped through several graphs, which were intended to show the number of each type of attack. It's unfortunate that there wasn't more time for questions, because I really wanted to ask why "http GET" and "spidering" attacks weren't listen on their graphs...more on that in a second. Fortunately, said vendor had a table at "beer and gear", so I was able to talk with one of their representatives -- and learned that they have just as much trouble with automatic detection of attacks designed to look like a "slashdotting"...which cleared up the mystery as to why it wasn't on the graphs. Because this is a real problem: anybody, with sufficient knowledge & preparation can vandalize _anybody's_ network. Showing me a graph that ping floods happen all the time doesn't impress me -- what would impress me is going over the actual methods, algorithms (and heuristics?) used in these attack mitigation appliances. Because, the "best" attack mitigation appliance vendor would seem to have 100% of their market, and thus, charge exhorbant prices for their product(s). When I brought this up with Mr. Vendor, his first reaction was to point out that the cost was less than a home-grown solution. When I raised the question of open source software to do the same thing, his reaction was to ask: "oh? who's going to write it?" And that right there would seem to be a bit of bravado, perhaps fueled by a misunderstanding of the role that FOSS has played on the Net. Fortunately -- and again, I am grateful for this -- the ISC was represented in the security BOF, presenting the SIE concept...as well as what applications _already exist_ to detect and mitigate various attacks. One demonstration that blew me away: detecting a botnet being set up for a phishing attack...and preventing the attack before it even started. So in conclusion, I'll say this: the last NANOG I attended was NANOG 9 -- and i remember that being a more challenging environment for vendors. Probably the biggest problem discussed back then was head-of-line blocking on a vendor's switches. _That_ is the kind of content that i have found valuable, both on this list, and at a conference. And so: If I weren't so knock-kneed in public venues, I would probably be doing what i would like to call on conference participants to do: if someone gives a presentation that includes their own proprietary black-box "solution", I think the best benefit for NANOG would be to point out alternatives. -Scott p.s. sorry for the long post.

17 22

AS34012 Contact
by Seth Mattinen 25 Nov '08

25 Nov '08

I'm looking for a contact within AS34012 (Parc Productions Webdesign) in regards to reachability issues from AS11170. The problem feels like 34012 is not seeing a route back to me. I can see 217.195.112.0/20, but as soon as any of my traffic hits 34012, it goes into a black hole. ~Seth

1 0

BCP for Private OUI / address assignments?
by mike 25 Nov '08

25 Nov '08

With the increasing use of virtual machines in my environment, I am needing more and more unique mac addresses to assign to the many virtual Ethernet devices I have attached and visible to my non-virtual physical network. The problem of course is that I don't have an IEEE OUI and therefore can't generate guaranteed to be unique addresses, and while the possible address space is quite large, it occurs to me that there should be something - ala rfc 1918 - for this kind of situation. For now however, I just want to know if anyones got something better than 'pick an oui out of the air' or 'pick an old dead manufacturer oui', or worse, 'pick old 10base2 network cards and destroy them, saving the mac'. In the future however, I think there's going to need to be some sort of extension or modification to dhcp to accomodate virtual machines in this regard (of not having a manufacturer assigned addresses for the virtual ethernets). Mike-

6 5