November 2008 - Test - lists.nanog.org

NTP Md5 or AutoKey?
by Glen Kent 15 Nov '08

15 Nov '08

Hi, I was wondering what most folks use for NTP security? Do they use the low cost, light weight symmetric key cryptographic protection method using MD5 or do folks go in for full digital signatures and X.509 certificates (AutoKey Security)? Thanks, Glen

14 17

[funsec] McColo: Major Source of Online Scams and Spams Knocked Offline (fwd)
by Gadi Evron 14 Nov '08

14 Nov '08

---------- Forwarded message ---------- Date: Tue, 11 Nov 2008 18:22:42 -0800 From: Paul Ferguson <fergdawgster(a)gmail.com> To: funsec(a)linuxbox.org Subject: [funsec] McColo: Major Source of Online Scams and Spams Knocked Offline -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Via Security Fix. [snip] A U.S. based Web hosting firm that security experts say was responsible for facilitating more than 75 percent of the junk e-mail blasted out each day globally has been knocked offline following reports from Security Fix on evidence gathered about criminal activity emanating from the network. For the past four months, Security Fix has been gathering data from the security industry about McColo Corp., a San Jose, Calif., based Web hosting service whose client list experts say includes some of the most disreputable cyber-criminal gangs in business today. On Monday, Security Fix contacted the Internet providers that manage more than 90 percent of the company's connection to the larger Internet, sending them information about badness at McColo as documented by the security industry. [snip] More: http://voices.washingtonpost.com/securityfix/2008/11/major_source_of_online _scams_a.html Also, more details will become available real soon now... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFJGj2hq1pz9mNUZTMRAsUaAJ4g4AzgLzD+NB9jvtlQu2kWwxY9UgCfakeM RzvY4TKA6HqN8jePb8AJlOY= =r3Oz -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.

20 24

OSPF with Multiple ABR & ASBR
by devang patel 14 Nov '08

14 Nov '08

Hi All, I am not sure is this the good place to ask this question or not!!! I am looking for feed back on having OSPF multi-area, lets say if you have multiple location in nonbackbone areas and those nonbackbone areas are connected with the one backbone area. For example: OSPF AREA1 has the connectivity to OSPF AREA0 using two ABR, so what is the optimum way to achieve the load balancing or load sharing for traffic entering or leaving the area, what are the possible way to configure it? regards Devang Patel

5 5

Weekly Routing Table Report
by Routing Analysis Role Account 14 Nov '08

14 Nov '08

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 15 Nov, 2008 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 273747 Prefixes after maximum aggregation: 131698 Deaggregation factor: 2.08 Unique aggregates announced to Internet: 132906 Total ASes present in the Internet Routing Table: 29790 Prefixes per ASN: 9.19 Origin-only ASes present in the Internet Routing Table: 25923 Origin ASes announcing only one prefix: 12618 Transit ASes present in the Internet Routing Table: 3867 Transit-only ASes present in the Internet Routing Table: 84 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 25 Max AS path prepend of ASN ( 3816) 15 Prefixes from unregistered ASNs in the Routing Table: 548 Unregistered ASNs in the Routing Table: 201 Number of 32-bit ASNs allocated by the RIRs: 63 Prefixes from 32-bit ASNs in the Routing Table: 8 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 210 Number of addresses announced to Internet: 1954643712 Equivalent to 116 /8s, 129 /16s and 127 /24s Percentage of available address space announced: 52.7 Percentage of allocated address space announced: 63.0 Percentage of available address space allocated: 83.7 Percentage of address space in use by end-sites: 74.3 Total number of prefixes smaller than registry allocations: 134661 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 62656 Total APNIC prefixes after maximum aggregation: 23339 APNIC Deaggregation factor: 2.68 Prefixes being announced from the APNIC address blocks: 59566 Unique aggregates announced from the APNIC address blocks: 26910 APNIC Region origin ASes present in the Internet Routing Table: 3459 APNIC Prefixes per ASN: 17.22 APNIC Region origin ASes announcing only one prefix: 932 APNIC Region transit ASes present in the Internet Routing Table: 534 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 17 Number of APNIC addresses announced to Internet: 381242016 Equivalent to 22 /8s, 185 /16s and 74 /24s Percentage of available APNIC address space announced: 75.7 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 123986 Total ARIN prefixes after maximum aggregation: 64911 ARIN Deaggregation factor: 1.91 Prefixes being announced from the ARIN address blocks: 93363 Unique aggregates announced from the ARIN address blocks: 34747 ARIN Region origin ASes present in the Internet Routing Table: 12583 ARIN Prefixes per ASN: 7.42 ARIN Region origin ASes announcing only one prefix: 4862 ARIN Region transit ASes present in the Internet Routing Table: 1197 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 400498592 Equivalent to 23 /8s, 223 /16s and 31 /24s Percentage of available ARIN address space announced: 82.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 173/8, 174/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 60086 Total RIPE prefixes after maximum aggregation: 36115 RIPE Deaggregation factor: 1.66 Prefixes being announced from the RIPE address blocks: 55709 Unique aggregates announced from the RIPE address blocks: 37297 RIPE Region origin ASes present in the Internet Routing Table: 12184 RIPE Prefixes per ASN: 4.57 RIPE Region origin ASes announcing only one prefix: 6406 RIPE Region transit ASes present in the Internet Routing Table: 1862 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 378515552 Equivalent to 22 /8s, 143 /16s and 176 /24s Percentage of available RIPE address space announced: 86.8 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-49151 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 22297 Total LACNIC prefixes after maximum aggregation: 5569 LACNIC Deaggregation factor: 4.00 Prefixes being announced from the LACNIC address blocks: 20335 Unique aggregates announced from the LACNIC address blocks: 11386 LACNIC Region origin ASes present in the Internet Routing Table: 1030 LACNIC Prefixes per ASN: 19.74 LACNIC Region origin ASes announcing only one prefix: 339 LACNIC Region transit ASes present in the Internet Routing Table: 170 Average LACNIC Region AS path length visible: 4.0 Max LACNIC Region AS path length visible: 18 Number of LACNIC addresses announced to Internet: 58064256 Equivalent to 3 /8s, 117 /16s and 253 /24s Percentage of available LACNIC address space announced: 57.7 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 4195 Total AfriNIC prefixes after maximum aggregation: 1334 AfriNIC Deaggregation factor: 3.14 Prefixes being announced from the AfriNIC address blocks: 4466 Unique aggregates announced from the AfriNIC address blocks: 2142 AfriNIC Region origin ASes present in the Internet Routing Table: 264 AfriNIC Prefixes per ASN: 16.92 AfriNIC Region origin ASes announcing only one prefix: 79 AfriNIC Region transit ASes present in the Internet Routing Table: 52 Average AfriNIC Region AS path length visible: 4.0 Max AfriNIC Region AS path length visible: 25 Number of AfriNIC addresses announced to Internet: 12920064 Equivalent to 0 /8s, 197 /16s and 37 /24s Percentage of available AfriNIC address space announced: 25.7 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 17488 1409 99 106 Hathway IP Over Cable Interne 4755 1193 485 155 TATA Communications formerly 9583 1125 87 479 Sify Limited 4766 899 6409 363 Korea Telecom (KIX) 4134 898 13872 366 CHINANET-BACKBONE 23577 817 35 702 Korea Telecom (ATM-MPLS) 18101 786 167 31 Reliance Infocom Ltd Internet 4780 731 357 63 Digital United Inc. 9498 689 295 50 BHARTI BT INTERNET LTD. 4808 632 1172 143 CNCGROUP IP network: China169 Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4370 3434 344 bellsouth.net, inc. 209 3019 4032 625 Qwest 6298 2094 327 691 Cox Communicatons 1785 1696 717 155 PaeTec Communications, Inc. 6478 1664 365 196 AT&T Worldnet Services 20115 1662 1452 726 Charter Communications 2386 1591 701 901 AT&T Data Communications Serv 4323 1589 1084 377 Time Warner Telecom 7018 1406 5869 974 AT&T WorldNet Services 11492 1214 166 16 Cable One Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 3292 429 1766 380 TDC Tele Danmark 12479 366 578 6 Uni2 Autonomous System 30890 366 95 189 SC Kappa Invexim SRL 3301 333 1429 303 TeliaNet Sweden 8866 331 111 23 Bulgarian Telecommunication C 3320 322 7062 271 Deutsche Telekom AG 3215 316 2788 99 France Telecom Transpac 5462 300 794 27 Telewest Broadband 8452 293 188 11 TEDATA 25233 289 44 24 Awalnet Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1400 2832 224 UniNet S.A. de C.V. 11830 670 299 9 Instituto Costarricense de El 10620 557 126 54 TVCABLE BOGOTA 22047 522 270 14 VTR PUNTO NET S.A. 7303 497 244 70 Telecom Argentina Stet-France 16814 426 27 10 NSS, S.A. 6471 422 87 50 ENTEL CHILE S.A. 11172 406 118 72 Servicios Alestra S.A de C.V 28573 343 468 23 NET Servicos de Comunicao S.A 14117 331 23 9 Telefonica del Sur S.A. Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 560 72 45 LINKdotNET AS number 3741 271 857 227 The Internet Solution 20858 260 34 3 EgyNet 2018 238 215 140 Tertiary Education Network 29571 147 13 8 Ci Telecom Autonomous system 6713 144 135 11 Itissalat Al-MAGHRIB 33783 141 10 15 EEPAD TISP TELECOM & INTERNET 5536 119 7 22 Internet Egypt Network 33776 116 6 3 Starcomms Nigeria Limited 5713 114 555 63 Telkom SA Ltd Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4370 3434 344 bellsouth.net, inc. 209 3019 4032 625 Qwest 6298 2094 327 691 Cox Communicatons 1785 1696 717 155 PaeTec Communications, Inc. 6478 1664 365 196 AT&T Worldnet Services 20115 1662 1452 726 Charter Communications 2386 1591 701 901 AT&T Data Communications Serv 4323 1589 1084 377 Time Warner Telecom 17488 1409 99 106 Hathway IP Over Cable Interne 7018 1406 5869 974 AT&T WorldNet Services Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 209 3019 2394 Qwest 1785 1696 1541 PaeTec Communications, Inc. 6478 1664 1468 AT&T Worldnet Services 6298 2094 1403 Cox Communicatons 17488 1409 1303 Hathway IP Over Cable Interne 4323 1589 1212 Time Warner Telecom 11492 1214 1198 Cable One 8151 1400 1176 UniNet S.A. de C.V. 18566 1059 1049 Covad Communications 4755 1193 1038 TATA Communications formerly Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic 32326 UNALLOCATED 12.40.49.0/24 3549 Global Crossing 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.52.128.0/19 22561 Digital Teleport, Inc 24.75.116.0/22 10796 ServiceCo LLC - Road Runner 24.75.160.0/19 7843 Adelphia Corp. 24.142.40.0/21 7018 AT&T WorldNet Services 24.142.160.0/19 7018 AT&T WorldNet Services 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 62.61.220.0/24 24974 Tachyon Europe BV - Wireless 62.61.221.0/24 24974 Tachyon Europe BV - Wireless 63.140.213.0/24 22555 Universal Talkware Corporatio Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:9 /10:19 /11:53 /12:159 /13:308 /14:547 /15:1077 /16:10156 /17:4457 /18:7687 /19:16553 /20:19396 /21:19150 /22:24122 /23:24829 /24:142451 /25:841 /26:1006 /27:798 /28:93 /29:9 /30:1 /31:0 /32:7 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2858 4370 bellsouth.net, inc. 6298 2068 2094 Cox Communicatons 209 1739 3019 Qwest 2386 1270 1591 AT&T Data Communications Serv 17488 1199 1409 Hathway IP Over Cable Interne 11492 1190 1214 Cable One 1785 1158 1696 PaeTec Communications, Inc. 6478 1106 1664 AT&T Worldnet Services 18566 1040 1059 Covad Communications 9583 992 1125 Sify Limited Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1 4:12 8:153 12:2181 13:2 15:21 16:3 17:5 20:35 24:1088 30:1 32:61 38:512 40:92 41:781 43:1 44:2 47:12 52:3 55:3 56:3 57:27 58:515 59:550 60:452 61:1032 62:1121 63:2012 64:3280 65:2433 66:3480 67:1326 68:818 69:2351 70:888 71:138 72:2067 73:2 74:1294 75:167 76:290 77:880 78:520 79:292 80:928 81:844 82:594 83:397 84:586 85:1040 86:505 87:705 88:347 89:1357 90:27 91:1670 92:300 93:980 94:395 95:38 96:88 97:132 98:387 99:15 113:40 114:127 115:150 116:1010 117:406 118:252 119:529 120:103 121:610 122:868 123:445 124:870 125:1229 128:353 129:217 130:137 131:408 132:72 133:9 134:186 135:31 136:223 137:106 138:144 139:85 140:413 141:111 142:392 143:321 144:302 145:51 146:372 147:140 148:601 149:210 150:130 151:210 152:148 153:137 154:10 155:275 156:174 157:301 158:168 159:301 160:272 161:140 162:249 163:135 164:517 165:508 166:363 167:341 168:631 169:154 170:452 171:40 172:10 173:138 174:17 187:18 188:1 189:318 190:2390 192:5825 193:4140 194:3288 195:2626 196:1021 198:3711 199:3309 200:5509 201:1471 202:7679 203:8044 204:3930 205:2180 206:2297 207:2773 208:3727 209:3445 210:2608 211:1093 212:1547 213:1633 214:68 215:25 216:4382 217:1249 218:351 219:426 220:1059 221:419 222:303 End of report

1 0

Re: McColo: Major Source of Online Scams and Spams Knocked Offline
by Fred Heutte 14 Nov '08

14 Nov '08

>p.s. McColo's upstream providers are completely within their rights to >terminate connectivity if they feel that they have violated their >contractual terms of service. Indeed. I also want to nominate fergdawg for the NANOG Order of Merit for getting the phrase "purge the badness" into the LA Times. "People thought the first community-source effort was a fluke," Ferguson said. "Now they see with McColo, it's not a fluke. The community can police its own backyard and purge the badness." http://www.latimes.com/business/la-fi-spam14-2008nov14,0,1012756.story cheers fh PS Spam counts on my own incoming mail are down about 70% right now. Enjoy the moment while we can ... ----------------- >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On Wed, Nov 12, 2008 at 9:30 AM, Kee Hinckley <nazgul(a)somewhere.com> wrote: > >> After reading this, and the (Washington Post I believe--I'm away from my >> laptop right now) article on this, two things are bothering me. >> >> The article expressed a good deal of frustration with the (lack of) speed >> with which law enforcement has been tackling these issues. What wasn't >> clear was whether any attempt had been made to involve them prior to the >> shutdown. > >Don't assume what you don't know. :-) > >- - ferg > >p.s. McColo's upstream providers are completely within their rights to >terminate connectivity if they feel that they have violated their >contractual terms of service. > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.6.3 (Build 3017) > >wj8DBQFJGxggq1pz9mNUZTMRAsAwAKCUWdQAbTEZ+O5nWA/d1ED2fGSCQQCeJMUS >PmOiEoLms6r/V1IxJqcLMlk>=2xEG >-----END PGP SIGNATURE----- > > >-- >"Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawgster(at)gmail.com > ferg's tech blog: http://fergdawg.blogspot.com/ > >

1 0

BGP Update Report
by cidr-report＠potaroo.net 14 Nov '08

14 Nov '08

BGP Update Report Interval: 13-Oct-08 -to- 13-Nov-08 (32 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS9583 192824 1.6% 169.3 -- SIFY-AS-IN Sify Limited 2 - AS4538 185313 1.5% 36.4 -- ERX-CERNET-BKB China Education and Research Network Center 3 - AS10396 153901 1.3% 2653.5 -- COQUI-NET - DATACOM CARIBE, INC. 4 - AS6389 130178 1.1% 29.5 -- BELLSOUTH-NET-BLK - BellSouth.net Inc. 5 - AS1803 89603 0.8% 63.6 -- ICMNET-5 - Sprint 6 - AS6629 85589 0.7% 1316.8 -- NOAA-AS - NOAA 7 - AS20115 66122 0.6% 29.6 -- CHARTER-NET-HKY-NC - Charter Communications 8 - AS23126 64323 0.5% 278.5 -- CENTURYTEL-SOLUTIONS-LLC - CenturyTel Solutions, LLC 9 - AS8151 62013 0.5% 43.1 -- Uninet S.A. de C.V. 10 - AS209 58003 0.5% 18.3 -- ASN-QWEST - Qwest Communications Corporation 11 - AS6298 56546 0.5% 26.7 -- ASN-CXA-PH-6298-CBS - Cox Communications Inc. 12 - AS2386 52486 0.4% 31.8 -- INS-AS - AT&T Data Communications Services 13 - AS29282 47473 0.4% 15824.3 -- EMENTOR-AS Enfo Oyj 14 - AS9051 45081 0.4% 280.0 -- IDM Autonomous System 15 - AS34116 43926 0.4% 439.3 -- CYBER-AS Cyber Net AS 16 - AS7643 43390 0.4% 24.5 -- VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 17 - AS1785 42164 0.3% 24.6 -- AS-PAETEC-NET - PaeTec Communications, Inc. 18 - AS14106 41600 0.3% 20800.0 -- LEPMED01 - Leprechaun, LLC 19 - AS6458 41193 0.3% 97.2 -- Telgua 20 - AS17488 40525 0.3% 26.2 -- HATHWAY-NET-AP Hathway IP Over Cable Internet TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS14106 41600 0.3% 20800.0 -- LEPMED01 - Leprechaun, LLC 2 - AS29282 47473 0.4% 15824.3 -- EMENTOR-AS Enfo Oyj 3 - AS14593 14797 0.1% 14797.0 -- BRAND-INSTITUTE - Brand Instiute, Inc. 4 - AS43299 13760 0.1% 13760.0 -- TELECONTACT-AS Telecontact Ltd. 5 - AS22492 25284 0.2% 8428.0 -- 6 - AS37026 15335 0.1% 7667.5 -- SALT-ASN 7 - AS30287 5813 0.1% 5813.0 -- ALON-USA - ALON USA, LP 8 - AS40194 4229 0.0% 4229.0 -- INHOUSE-ASSOCIATES-LC - Inhouse Associates, L.C. 9 - AS14220 18062 0.1% 3612.4 -- I2A - I 20 Access 10 - AS4130 16410 0.1% 3282.0 -- UPITT-AS - University of Pittsburgh 11 - AS30969 26091 0.2% 3261.4 -- TAN-NET TransAfrica Networks 12 - AS41007 16046 0.1% 3209.2 -- CTCASTANA CTC ASTANA, KZ 13 - AS21603 30105 0.2% 3010.5 -- Universidad La Salle, AC 14 - AS25799 3001 0.0% 3001.0 -- HOLMAN - Holman Enterprises 15 - AS5691 38614 0.3% 2970.3 -- MITRE-AS-5 - The MITRE Corporation 16 - AS5033 25159 0.2% 2795.4 -- ISW - Internet Specialties West Inc. 17 - AS10396 153901 1.3% 2653.5 -- COQUI-NET - DATACOM CARIBE, INC. 18 - AS23917 2334 0.0% 2334.0 -- BRIBIE-NET-AS-AP Bribie Island Net Multihomed, Brisbane 19 - AS22247 2036 0.0% 2036.0 -- LETOURNEAUUNIVERSITY - LeTourneau University 20 - AS48131 2020 0.0% 2020.0 -- VANGUARD-BG-AS Vanguard SA TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 221.134.222.0/24 62636 0.5% AS9583 -- SIFY-AS-IN Sify Limited 2 - 210.214.151.0/24 59751 0.5% AS9583 -- SIFY-AS-IN Sify Limited 3 - 221.135.80.0/24 42657 0.3% AS9583 -- SIFY-AS-IN Sify Limited 4 - 192.12.120.0/24 38228 0.3% AS5691 -- MITRE-AS-5 - The MITRE Corporation 5 - 194.126.143.0/24 35011 0.3% AS9051 -- IDM Autonomous System 6 - 77.95.144.0/22 33245 0.3% AS29282 -- EMENTOR-AS Enfo Oyj 7 - 200.33.104.0/23 29597 0.2% AS21603 -- Universidad La Salle, AC 8 - 192.102.88.0/24 27198 0.2% AS6629 -- NOAA-AS - NOAA 9 - 192.35.129.0/24 26950 0.2% AS6629 -- NOAA-AS - NOAA 10 - 198.77.177.0/24 26932 0.2% AS6629 -- NOAA-AS - NOAA 11 - 12.2.46.0/24 25239 0.2% AS22492 -- 12 - 64.162.116.0/24 24935 0.2% AS5033 -- ISW - Internet Specialties West Inc. 13 - 221.128.192.0/18 23082 0.2% AS18231 -- EXATT-AS-AP IOL NETCOM LTD 14 - 8.192.154.0/24 22681 0.2% AS14106 -- LEPMED01 - Leprechaun, LLC 15 - 65.44.76.0/24 18919 0.1% AS14106 -- LEPMED01 - Leprechaun, LLC 16 - 150.212.224.0/19 16291 0.1% AS4130 -- UPITT-AS - University of Pittsburgh 17 - 72.50.96.0/20 14905 0.1% AS10396 -- COQUI-NET - DATACOM CARIBE, INC. 18 - 196.42.0.0/20 14871 0.1% AS10396 -- COQUI-NET - DATACOM CARIBE, INC. 19 - 12.8.7.0/24 14797 0.1% AS14593 -- BRAND-INSTITUTE - Brand Instiute, Inc. 20 - 217.69.48.0/20 14206 0.1% AS29282 -- EMENTOR-AS Enfo Oyj Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

The Cidr Report
by cidr-report＠potaroo.net 14 Nov '08

14 Nov '08

This report has been generated at Fri Nov 14 21:24:10 2008 AEST. The report analyses the BGP Routing Table of AS2.0 router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org for a current version of this report. Recent Table History Date Prefixes CIDR Agg 07-11-08 287743 177595 08-11-08 288027 178006 09-11-08 288049 176846 10-11-08 286254 177123 11-11-08 286541 175643 12-11-08 287066 175835 13-11-08 286772 176362 14-11-08 287463 175543 AS Summary 29973 Number of ASes in routing system 12681 Number of ASes announcing only one prefix 5058 Largest number of prefixes announced by an AS AS4538 : ERX-CERNET-BKB China Education and Research Network Center 89832448 Largest address span announced by an AS (/32s) AS27064: DDN-ASNBLK1 - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 14Nov08 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 287942 175499 112443 39.1% All ASes AS4538 5058 875 4183 82.7% ERX-CERNET-BKB China Education and Research Network Center AS6389 4375 357 4018 91.8% BELLSOUTH-NET-BLK - BellSouth.net Inc. AS209 3020 1356 1664 55.1% ASN-QWEST - Qwest Communications Corporation AS1785 1697 277 1420 83.7% AS-PAETEC-NET - PaeTec Communications, Inc. AS6298 2101 743 1358 64.6% ASN-CXA-PH-6298-CBS - Cox Communications Inc. AS4323 1586 437 1149 72.4% TWTC - tw telecom holdings, inc. AS17488 1410 285 1125 79.8% HATHWAY-NET-AP Hathway IP Over Cable Internet AS4755 1196 191 1005 84.0% TATACOMM-AS TATA Communications formerly VSNL is Leading ISP AS6478 1664 751 913 54.9% ATT-INTERNET3 - AT&T WorldNet Services AS8151 1402 566 836 59.6% Uninet S.A. de C.V. AS22773 1006 199 807 80.2% ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. AS11492 1213 447 766 63.1% CABLEONE - CABLE ONE, INC. AS2386 1594 920 674 42.3% INS-AS - AT&T Data Communications Services AS19262 929 275 654 70.4% VZGNI-TRANSIT - Verizon Internet Services Inc. AS18101 788 195 593 75.3% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS9498 691 113 578 83.6% BBIL-AP BHARTI Airtel Ltd. AS3356 1066 505 561 52.6% LEVEL3 Level 3 Communications AS18566 1059 549 510 48.2% COVAD - Covad Communications Co. AS4766 939 453 486 51.8% KIXS-AS-KR Korea Telecom AS7545 633 157 476 75.2% TPG-INTERNET-AP TPG Internet Pty Ltd AS855 595 121 474 79.7% CANET-ASN-4 - Bell Aliant AS4808 625 154 471 75.4% CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network AS24560 608 163 445 73.2% AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services AS7011 923 480 443 48.0% FRONTIER-AND-CITIZENS - Frontier Communications of America, Inc. AS17676 522 79 443 84.9% GIGAINFRA BB TECHNOLOGY Corp. AS9443 524 83 441 84.2% INTERNETPRIMUS-AS-AP Primus Telecommunications AS22047 568 127 441 77.6% VTR BANDA ANCHA S.A. AS7018 1432 993 439 30.7% ATT-INTERNET4 - AT&T WorldNet Services AS4134 899 477 422 46.9% CHINANET-BACKBONE No.31,Jin-rong Street AS4668 688 275 413 60.0% LGNET-AS-KR LG CNS Total 40811 12603 28208 69.1% Top 30 total Possible Bogus Routes 24.75.116.0/22 AS10796 SCRR-10796 - Road Runner HoldCo LLC 24.75.160.0/19 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 24.142.40.0/21 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.142.160.0/19 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.245.128.0/17 AS11492 CABLEONE - CABLE ONE, INC. 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 50.0.0.0/16 AS6858 COMLINK-AS Comlink ISP Autonomous System 62.61.220.0/23 AS24974 TACHYON-EU Tachyon Europe BV - Wireless Broadband via Satellite 62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV - Wireless Broadband via Satellite 62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV - Wireless Broadband via Satellite 63.140.213.0/24 AS22555 UTC - Universal Talkware Corporation 63.143.251.0/24 AS22555 UTC - Universal Talkware Corporation 63.248.0.0/16 AS3356 LEVEL3 Level 3 Communications 64.7.112.0/21 AS6453 GLOBEINTERNET TATA Communications 64.7.120.0/21 AS6453 GLOBEINTERNET TATA Communications 64.64.159.0/24 AS32004 BIG-ASN - Business Information Group, Inc. 64.79.88.0/24 AS26096 LODDEN - Lodden Services 64.79.89.0/24 AS26096 LODDEN - Lodden Services 64.188.0.0/16 AS3356 LEVEL3 Level 3 Communications 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.40.0/21 AS6261 VISINET - Visionary Systems, Inc. 66.54.91.0/24 AS30506 BLACKSUN-1 - Blacksun Technologies LLC 66.55.160.0/19 AS29994 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.199.32.0/20 AS10397 WISP-AS - Wispnet, LLC 66.206.32.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.33.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.34.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.35.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.40.0/22 AS174 COGENT Cogent/PSI 66.206.44.0/23 AS174 COGENT Cogent/PSI 66.206.47.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 66.207.32.0/20 AS23011 69.71.192.0/20 AS13818 PHX-INTL-TELEPORT - Phoenix International Teleport 69.80.0.0/17 AS3043 AMPHIB-AS - Amphibian Media Corporation 80.88.0.0/21 AS33774 DJAWEB 80.88.8.0/22 AS33774 DJAWEB 80.88.10.0/24 AS33774 DJAWEB 80.88.12.0/24 AS33779 wataniya-telecom-as 87.244.128.0/18 AS8733 CHELLO-BELGIUM UPC Belgium - Chello Belgium 91.207.222.0/23 AS9138 94.229.96.0/20 AS41546 INTRASTAR-AS CJSC "IntraStar" 95.52.0.0/14 AS8997 ASN-SPBNIT OJSC North-West Telecom Autonomous System 95.52.0.0/18 AS8997 ASN-SPBNIT OJSC North-West Telecom Autonomous System 95.52.64.0/18 AS8997 ASN-SPBNIT OJSC North-West Telecom Autonomous System 95.52.128.0/18 AS8997 ASN-SPBNIT OJSC North-West Telecom Autonomous System 95.53.0.0/18 AS8997 ASN-SPBNIT OJSC North-West Telecom Autonomous System 95.53.128.0/18 AS8997 ASN-SPBNIT OJSC North-West Telecom Autonomous System 98.96.0.0/13 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 119.31.232.0/21 AS38870 121.50.168.0/21 AS9931 CAT-AP The Communication Authoity of Thailand, CAT 124.109.16.0/21 AS38137 137.0.0.0/13 AS27064 DDN-ASNBLK1 - DoD Network Information Center 151.135.0.0/16 AS4768 CLIX-NZ TelstraClear Ltd 163.142.0.0/16 AS2500 WIDE-BB WIDE Project 169.254.0.0/16 AS13184 HANSENET HanseNet Telekommunikation GmbH 172.7.0.0/24 AS28175 172.10.1.0/30 AS18305 POSNET POSDATA Co.,Ltd 188.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 188.0.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 188.0.0.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 192.9.0.0/16 AS11479 BRM-SUN-AS - Sun Microsystems, Inc 192.9.200.0/24 AS3602 AS3602-RTI - Rogers Telecom Inc. 192.40.105.0/24 AS12582 TSF-DATANET-NGD-AS TSF MPLS VPN Services 192.64.85.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.107.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.108.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.177.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.96.36.0/24 AS5713 SAIX-NET 192.96.37.0/24 AS10474 NETACTIVE 192.96.135.0/24 AS2018 TENET-1 192.96.136.0/23 AS2018 TENET-1 192.96.141.0/24 AS2018 TENET-1 192.96.143.0/24 AS2018 TENET-1 192.96.145.0/24 AS2018 TENET-1 192.96.177.0/24 AS6083 POSIX-AFRICA 192.101.45.0/24 AS2905 TICSA-ASN 192.101.46.0/24 AS6503 Avantel, S.A. 192.101.47.0/24 AS6503 Avantel, S.A. 192.101.64.0/21 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.70.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.71.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.72.0/24 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.73.0/24 AS4765 WORLDNET-AS World Net & Services Co., Ltd. 192.101.74.0/24 AS1239 SPRINTLINK - Sprint 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.131.233.0/24 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.153.144.0/21 AS27064 DDN-ASNBLK1 - DoD Network Information Center 192.154.32.0/19 AS81 NCREN - MCNC 192.188.208.0/20 AS27064 DDN-ASNBLK1 - DoD Network Information Center 196.6.108.0/24 AS5713 SAIX-NET 196.10.119.0/24 AS2018 TENET-1 196.10.122.0/23 AS2018 TENET-1 196.10.251.0/24 AS2018 TENET-1 196.10.252.0/23 AS2018 TENET-1 196.10.254.0/24 AS2018 TENET-1 196.13.101.0/24 AS2018 TENET-1 196.13.102.0/23 AS2018 TENET-1 196.13.104.0/24 AS2018 TENET-1 196.13.121.0/24 AS2018 TENET-1 196.13.125.0/24 AS2018 TENET-1 196.13.126.0/24 AS2018 TENET-1 196.13.169.0/24 AS2018 TENET-1 196.13.174.0/23 AS2018 TENET-1 196.13.176.0/21 AS2018 TENET-1 196.13.192.0/22 AS2018 TENET-1 196.13.196.0/24 AS2018 TENET-1 196.201.98.0/24 AS29571 CITelecom-AS 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET-1 198.54.92.0/24 AS2018 TENET-1 198.54.222.0/24 AS2018 TENET-1 198.97.72.0/21 AS27064 DDN-ASNBLK1 - DoD Network Information Center 198.97.80.0/20 AS27064 DDN-ASNBLK1 - DoD Network Information Center 198.97.96.0/19 AS27064 DDN-ASNBLK1 - DoD Network Information Center 198.97.240.0/20 AS27064 DDN-ASNBLK1 - DoD Network Information Center 198.144.96.0/20 AS12185 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 198.169.0.0/16 AS803 SASKTEL - Saskatchewan Telecommunications 198.180.198.0/24 AS23715 SEOUL-INTGW-GXS-AP Global Exchange Services 199.10.0.0/16 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.0.0/21 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.128.0/18 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.130.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.131.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.132.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DoD Network Information Center 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DoD Network Information Center 199.114.142.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.144.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.148.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.150.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - 754th Electronic Systems Group 199.114.156.0/24 AS1733 CENTAF-SWA - 754th Electronic Systems Group 199.114.160.0/24 AS1733 CENTAF-SWA - 754th Electronic Systems Group 199.121.0.0/16 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.123.0.0/18 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.123.16.0/20 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.123.80.0/21 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.202.216.0/21 AS577 BACOM - Bell Canada 199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 200.0.187.0/24 AS19132 200.5.32.0/21 AS19132 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.72.40.0/21 AS38205 202.72.40.0/24 AS38205 202.72.41.0/24 AS38205 202.72.47.0/24 AS38205 202.73.144.0/20 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 202.80.192.0/20 AS2706 HKSUPER-HK-AP Pacific Internet (Hong Kong) Limited 202.86.252.0/22 AS4748 RESOLINK-AS-AP Resources Link Network Limited 202.86.252.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.94.70.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.150.56.0/24 AS38722 202.150.57.0/24 AS38722 202.176.228.0/24 AS17988 SINOSAT-AS-AP SINOSAT (HONG KONG) LIMITED 202.176.232.0/24 AS17988 SINOSAT-AS-AP SINOSAT (HONG KONG) LIMITED 202.181.32.0/24 AS4645 ASN-HKNET-AP HKNet Co. Ltd 202.191.8.0/21 AS10223 UECOMM-AU Uecomm Ltd 203.12.45.0/24 AS4854 NETSPACE-AS-AP Netspace Online Systems 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecommunications Ltd 203.112.111.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.113.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.114.0/24 AS4802 ASN-IINET iiNet Limited 203.112.116.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.117.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.118.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.119.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.120.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.121.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.127.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.128.128.0/19 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 203.128.128.0/24 AS23849 CNNIC-NET263-AP Beijing Capital-online science development Co.,Ltd. 204.9.216.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.9.217.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.9.218.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.13.140.0/22 AS7270 NET2PHONE - Net2Phone Corp. 204.16.120.0/23 AS12077 204.16.122.0/23 AS12077 204.19.14.0/23 AS577 BACOM - Bell Canada 204.48.58.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.48.60.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 206.162.224.0/19 AS23464 ILCSNET - Interlink Computer Services 206.180.240.0/20 AS12083 KNOLOGY-NET - Knology Holdings 206.220.240.0/24 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.240.64/26 AS22335 MREN - Metropolitan Research and Education Network 206.220.240.128/25 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.240.220/32 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.241.0/24 AS10764 STARTAP - National Center for Supercomputing Applications 207.191.128.0/19 AS10887 BPSI-AS - BPSI Internet Services 207.204.168.0/24 AS15150 BELLTECH-AS - BELLWETHER TECHNOLOGY CORPORATION 207.204.222.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc. 208.38.192.0/18 AS3043 AMPHIB-AS - Amphibian Media Corporation 208.38.192.0/21 AS14237 BEAMSPEED1 - Beamspeed 208.38.202.0/24 AS14237 BEAMSPEED1 - Beamspeed 208.38.203.0/24 AS14237 BEAMSPEED1 - Beamspeed 208.38.204.0/22 AS14237 BEAMSPEED1 - Beamspeed 209.54.93.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 209.54.111.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 209.54.123.0/24 AS6062 NETPLEX - NETPLEX 209.54.240.0/21 AS10887 BPSI-AS - BPSI Internet Services 209.74.96.0/19 AS10912 INTERNAP-BLK - Internap Network Services Corporation 209.140.90.0/24 AS14461 NTSL - NET SOLUTIONS 209.140.224.0/21 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.234.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.235.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.236.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.237.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.238.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.239.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.141.16.0/21 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.141.48.0/22 AS14461 NTSL - NET SOLUTIONS 209.145.192.0/18 AS3043 AMPHIB-AS - Amphibian Media Corporation 210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone 216.37.114.0/23 AS3549 GBLX Global Crossing Ltd. 216.37.120.0/23 AS13377 216.59.0.0/17 AS3356 LEVEL3 Level 3 Communications 216.99.16.0/24 AS6395 LVLT-6395 - Level 3 Communications, Inc. 216.99.20.0/24 AS6395 LVLT-6395 - Level 3 Communications, Inc. 216.162.96.0/19 AS7393 CYBERCON - CYBERCON, INC. 216.172.198.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.172.199.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.210.86.0/24 AS577 BACOM - Bell Canada 216.229.51.0/24 AS15211 216.240.240.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.241.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.251.207.0/24 AS1239 SPRINTLINK - Sprint 217.78.71.0/24 AS12491 IPPLANET-AS IPPlanet 217.78.72.0/24 AS12491 IPPLANET-AS IPPlanet 217.78.73.0/24 AS12491 IPPLANET-AS IPPlanet Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Re: Prefix Hijack Tool Comaprision
by Mohit Lad 13 Nov '08

13 Nov '08

Sorry for the subject line in the previous message :-) Since this thread started as comparison of the tools, there are two issues 1. Which BGP feeds the tools use? RIPE, RouteViews, other private feeds. 2. How they decide what to send and what not to send? In this case, BGPMon detected an event that was not detected by others, and there might be other hijacks that were local in scope where PHAS or Watchmy might catch something that BGPMon does not. But that does not make one tool better than the other, unless this pattern is repeated. Eventually all tools will catch up with each other on the feeds (or so is the hope), so the difference will then lie in "the decision of what to send and what to drop". Mohit Date: Thu, 13 Nov 2008 20:27:32 +0000 > From: "Alexander Harrowell" <a.harrowell(a)gmail.com> > Subject: Re: Prefix Hijack Tool Comaprision > To: Todd Underwood <todd(a)renesys.com> > Cc: nanog(a)nanog.org > > OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay is great. > > - original message - > Subject: Re: Prefix Hijack Tool Comaprision > From: Todd Underwood <todd(a)renesys.com> > Date: 13/11/2008 8:05 pm > > alexander, all, > > On Thu, Nov 13, 2008 at 07:56:26PM +0000, Alexander Harrowell wrote: > > It may be the North American NOG, but it's been said before that it > > functions as a GNOG, G for Global. I don't think Brazil is > > insignificant. I respect Todd's work greatly, but I think he's wrong > > on this point. > > you misread me. > > i did not say that brazil was insignificant. it's not. it has some of > the fastest growing internet in latin america. > > i said that *this* hijacking took place in an insignificant corner of > the internet. i mean this AS-map wise rather than geographically. > this hijacking didn't even spread beyond one or two ASes, one of whom > just happened to be a RIPE RIS peer. > > real hijackings leak into dozens or hundreds or thousands of ASNs. > they spread far and wide. that's why people carry them out, when they > do. this one was stopped in its tracks in a very small portion of one > corner of the AS graph. > > as such, i don't count it as a hijacking or leak of any great > significance and wouldn't want to alert anyone about it. that's why i > recommend that prefix hijacking detection systems do thresholding of > peers to prevent a single, rogue, unrepresentative peer from reporting > a hijacking when none is really happening. others may have a > different approach, but without thresholding prefix alert systems can > be noisy and more trouble than they are worth. > > sorry if it appears that i was denegrating .br . i was not. > > t. > > -- > _____________________________________________________________________ > todd underwood +1 603 643 9300 x101 > renesys corporation > todd(a)renesys.com http://www.renesys.com/blog > > > >

2 1

Re: NANOG Digest, Vol 10, Issue 46
by Mohit Lad 13 Nov '08

13 Nov '08

Since this thread started as comparison of the tools, there are two issues 1. Which BGP feeds the tools use? RIPE, RouteViews, other private feeds. 2. How they decide what to send and what not to send? In this case, BGPMon detected an event that was not detected by others, and there might be other hijacks that were local in scope where PHAS or Watchmy might catch something that BGPMon does not. But that does not make one tool better than the other, unless this pattern is repeated. Eventually all tools will catch up with each other on the feeds (or so is the hope), so the difference will then lie in "the decision of what to send and what to drop", and as Todd mentioned, thresholding is very critical here. Mohit Date: Thu, 13 Nov 2008 20:27:32 +0000 > From: "Alexander Harrowell" <a.harrowell(a)gmail.com> > Subject: Re: Prefix Hijack Tool Comaprision > To: Todd Underwood <todd(a)renesys.com> > Cc: nanog(a)nanog.org > > OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay is great. > > - original message - > Subject: Re: Prefix Hijack Tool Comaprision > From: Todd Underwood <todd(a)renesys.com> > Date: 13/11/2008 8:05 pm > > alexander, all, > > On Thu, Nov 13, 2008 at 07:56:26PM +0000, Alexander Harrowell wrote: > > It may be the North American NOG, but it's been said before that it > > functions as a GNOG, G for Global. I don't think Brazil is > > insignificant. I respect Todd's work greatly, but I think he's wrong > > on this point. > > you misread me. > > i did not say that brazil was insignificant. it's not. it has some of > the fastest growing internet in latin america. > > i said that *this* hijacking took place in an insignificant corner of > the internet. i mean this AS-map wise rather than geographically. > this hijacking didn't even spread beyond one or two ASes, one of whom > just happened to be a RIPE RIS peer. > > real hijackings leak into dozens or hundreds or thousands of ASNs. > they spread far and wide. that's why people carry them out, when they > do. this one was stopped in its tracks in a very small portion of one > corner of the AS graph. > > as such, i don't count it as a hijacking or leak of any great > significance and wouldn't want to alert anyone about it. that's why i > recommend that prefix hijacking detection systems do thresholding of > peers to prevent a single, rogue, unrepresentative peer from reporting > a hijacking when none is really happening. others may have a > different approach, but without thresholding prefix alert systems can > be noisy and more trouble than they are worth. > > sorry if it appears that i was denegrating .br . i was not. > > t. > > -- > _____________________________________________________________________ > todd underwood +1 603 643 9300 x101 > renesys corporation > todd(a)renesys.com http://www.renesys.com/blog > > > >

1 0

Re: Prefix Hijack Tool Comaprision
by Alexander Harrowell 13 Nov '08

13 Nov '08

OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay is great. - original message - Subject: Re: Prefix Hijack Tool Comaprision From: Todd Underwood <todd(a)renesys.com> Date: 13/11/2008 8:05 pm alexander, all, On Thu, Nov 13, 2008 at 07:56:26PM +0000, Alexander Harrowell wrote: > It may be the North American NOG, but it's been said before that it > functions as a GNOG, G for Global. I don't think Brazil is > insignificant. I respect Todd's work greatly, but I think he's wrong > on this point. you misread me. i did not say that brazil was insignificant. it's not. it has some of the fastest growing internet in latin america. i said that *this* hijacking took place in an insignificant corner of the internet. i mean this AS-map wise rather than geographically. this hijacking didn't even spread beyond one or two ASes, one of whom just happened to be a RIPE RIS peer. real hijackings leak into dozens or hundreds or thousands of ASNs. they spread far and wide. that's why people carry them out, when they do. this one was stopped in its tracks in a very small portion of one corner of the AS graph. as such, i don't count it as a hijacking or leak of any great significance and wouldn't want to alert anyone about it. that's why i recommend that prefix hijacking detection systems do thresholding of peers to prevent a single, rogue, unrepresentative peer from reporting a hijacking when none is really happening. others may have a different approach, but without thresholding prefix alert systems can be noisy and more trouble than they are worth. sorry if it appears that i was denegrating .br . i was not. t. -- _____________________________________________________________________ todd underwood +1 603 643 9300 x101 renesys corporation todd(a)renesys.com http://www.renesys.com/blog

2 1