September 2008 - Test - lists.nanog.org

Re: New Intercage upstream
by md＠Linux.IT 13 Sep '08

13 Sep '08

On Sep 13, "Jon O." <nanog(a)networkcommand.com> wrote: > Looks like this might be somewhat bulletproof, check the other sites off this "AS" > http://www.robtex.com/dns/pacificinternetexchange.net.html#a2 It may be, yes. Look at what else this AS is announcing: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL36453 (cernel/esthost) http://www.spamhaus.org/sbl/sbl.lasso?query=SBL36702 (the infamous UkrTeleGroup network) http://www.spamhaus.org/sbl/sbl.lasso?query=SBL53319 (inhoster) Interested parties can consult http://www.bofh.it/~md/drop-stats.txt (randomly updated, I am still looking for a permanent home for it) for a detailed list of who is announcing the networks listed in SBL DROP, what else they announce and who is providing transit to the ASes announcing them. The code used to generate it is available on request. Hint: there is not just Intercage. -- ciao, Marco

2 1

New Intercage upstream
by marcus.sachs＠verizon.com 12 Sep '08

12 Sep '08

Looks like they found a new willing partner. AS32335 PACIFICINTERNETEXCHANGE-NET - Pacific Internet Exchange LLC. http://cidr-report.org/cgi-bin/as-report?as=AS27595 http://www.pacificinternetexchange.net/ Marc

10 11

Re: community real-time BGP hijack notification service
by Avi Freedman 12 Sep '08

12 Sep '08

Hmm, I'm trying to figure out the application here. You have single prefixes originated or originate-able by more than 5 or 6 ASs? I see - is it that you have, say a /16 with 13 potential ASs that might be seen as originating more specifics inside that /16? Hadn't considered that; we were envisioning that those specifics would be set up as separate alerts. It's easy enough to extend the # of ASNs that can be listed, however. That'll be done this weekend. Thanks, Avi > Looks interesting, but it only takes a fairly short list of ASNs for a > prefix. For our big CIDR blocks, we have WAY too many ASNs to enter them > all, so it's pretty useless for me. I need to be able to enter at very > least a dozen ASes and I suspect may folks have a LOT more then that. > > For now, I'll enter some shorter pieces from the block, but I'm most > concerned with the pieces that are not currently assigned, so are > available for hijack. I have added the larger, unassigned blocks. I'll > start adding assigned bits and pieces as well as unassigned pieces, but > being able to put all valid origin ASes in the list for the full blocks > would be a lot nicer. > R. Kevin Oberman, Network Engineer

1 0

L(3) / 4/8 / multihoming
by Jay R. Ashworth 12 Sep '08

12 Sep '08

I see in http://www.onesc.net/communities/as3356/ that L3 doesn't permit customers to multihome the 4/8 space that they inherited from BBN, via GTE, etc, ad nauseum... and I'm curious whether anyone knows why? It sounds like something there might be an interesting story in... Off-list is fine; I'll summarize if anyone else cares. Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com '87 e24 St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274 Those who cast the vote decide nothing. Those who count the vote decide everything. -- (Josef Stalin)

3 3

Weekly Routing Table Report
by Routing Analysis Role Account 12 Sep '08

12 Sep '08

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 13 Sep, 2008 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 268412 Prefixes after maximum aggregation: 129628 Deaggregation factor: 2.07 Unique aggregates announced to Internet: 130442 Total ASes present in the Internet Routing Table: 29220 Prefixes per ASN: 9.19 Origin-only ASes present in the Internet Routing Table: 25414 Origin ASes announcing only one prefix: 12361 Transit ASes present in the Internet Routing Table: 3806 Transit-only ASes present in the Internet Routing Table: 87 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 26 Max AS path prepend of ASN ( 3816) 15 Prefixes from unregistered ASNs in the Routing Table: 561 Unregistered ASNs in the Routing Table: 209 Number of 32-bit ASNs allocated by the RIRs: 60 Prefixes from 32-bit ASNs in the Routing Table: 8 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 767 Number of addresses announced to Internet: 1916473632 Equivalent to 114 /8s, 59 /16s and 17 /24s Percentage of available address space announced: 51.7 Percentage of allocated address space announced: 62.8 Percentage of available address space allocated: 82.3 Percentage of address space in use by end-sites: 73.5 Total number of prefixes smaller than registry allocations: 131675 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 62162 Total APNIC prefixes after maximum aggregation: 22841 APNIC Deaggregation factor: 2.72 Prefixes being announced from the APNIC address blocks: 59072 Unique aggregates announced from the APNIC address blocks: 26366 APNIC Region origin ASes present in the Internet Routing Table: 3375 APNIC Prefixes per ASN: 17.50 APNIC Region origin ASes announcing only one prefix: 908 APNIC Region transit ASes present in the Internet Routing Table: 531 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 19 Number of APNIC addresses announced to Internet: 376051488 Equivalent to 22 /8s, 106 /16s and 23 /24s Percentage of available APNIC address space announced: 80.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 121875 Total ARIN prefixes after maximum aggregation: 64530 ARIN Deaggregation factor: 1.89 Prefixes being announced from the ARIN address blocks: 91148 Unique aggregates announced from the ARIN address blocks: 34980 ARIN Region origin ASes present in the Internet Routing Table: 12439 ARIN Prefixes per ASN: 7.33 ARIN Region origin ASes announcing only one prefix: 4806 ARIN Region transit ASes present in the Internet Routing Table: 1193 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 361286880 Equivalent to 21 /8s, 136 /16s and 204 /24s Percentage of available ARIN address space announced: 74.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 173/8, 174/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 58112 Total RIPE prefixes after maximum aggregation: 35166 RIPE Deaggregation factor: 1.65 Prefixes being announced from the RIPE address blocks: 53245 Unique aggregates announced from the RIPE address blocks: 35726 RIPE Region origin ASes present in the Internet Routing Table: 11863 RIPE Prefixes per ASN: 4.49 RIPE Region origin ASes announcing only one prefix: 6234 RIPE Region transit ASes present in the Internet Routing Table: 1805 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 26 Number of RIPE addresses announced to Internet: 371846720 Equivalent to 22 /8s, 41 /16s and 238 /24s Percentage of available RIPE address space announced: 85.2 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-48127 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 21616 Total LACNIC prefixes after maximum aggregation: 5369 LACNIC Deaggregation factor: 4.03 Prefixes being announced from the LACNIC address blocks: 19815 Unique aggregates announced from the LACNIC address blocks: 10925 LACNIC Region origin ASes present in the Internet Routing Table: 997 LACNIC Prefixes per ASN: 19.87 LACNIC Region origin ASes announcing only one prefix: 330 LACNIC Region transit ASes present in the Internet Routing Table: 171 Average LACNIC Region AS path length visible: 4.1 Max LACNIC Region AS path length visible: 21 Number of LACNIC addresses announced to Internet: 55251968 Equivalent to 3 /8s, 75 /16s and 20 /24s Percentage of available LACNIC address space announced: 54.9 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 4086 Total AfriNIC prefixes after maximum aggregation: 1260 AfriNIC Deaggregation factor: 3.24 Prefixes being announced from the AfriNIC address blocks: 4403 Unique aggregates announced from the AfriNIC address blocks: 2012 AfriNIC Region origin ASes present in the Internet Routing Table: 256 AfriNIC Prefixes per ASN: 17.20 AfriNIC Region origin ASes announcing only one prefix: 83 AfriNIC Region transit ASes present in the Internet Routing Table: 53 Average AfriNIC Region AS path length visible: 4.0 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 12717312 Equivalent to 0 /8s, 194 /16s and 13 /24s Percentage of available AfriNIC address space announced: 37.9 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4755 1718 538 181 Videsh Sanchar Nigam Ltd. Aut 17488 1378 93 98 Hathway IP Over Cable Interne 9583 1146 89 487 Sify Limited 4766 876 6408 360 Korea Telecom (KIX) 4134 841 13651 345 CHINANET-BACKBONE 23577 818 34 693 Korea Telecom (ATM-MPLS) 18101 766 152 51 Reliance Infocom Ltd Internet 4780 714 353 61 Digital United Inc. 9498 676 291 54 BHARTI BT INTERNET LTD. 4808 629 1156 138 CNCGROUP IP network: China169 Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4298 3416 339 bellsouth.net, inc. 209 2918 3873 620 Qwest 6298 1965 314 757 Cox Communicatons 20115 1677 1414 719 Charter Communications 1785 1653 710 156 AppliedTheory Corporation 2386 1555 691 895 AT&T Data Communications Serv 4323 1520 1073 375 Time Warner Telecom 7018 1405 5801 974 AT&T WorldNet Services 11492 1210 151 19 Cable One 6478 1155 240 185 AT&T Worldnet Services Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 3292 420 1777 377 TDC Tele Danmark 3301 334 1460 305 TeliaNet Sweden 8452 328 188 11 TEDATA 3215 327 2756 106 France Telecom Transpac 3320 326 7063 274 Deutsche Telekom AG 30890 323 87 176 SC Kappa Invexim SRL 8866 317 77 21 Bulgarian Telecommunication C 5462 296 794 27 Telewest Broadband 8551 286 270 37 Bezeq International 680 275 2047 265 DFN-IP service G-WiN Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1604 2607 222 UniNet S.A. de C.V. 11830 667 299 9 Instituto Costarricense de El 22047 564 270 14 VTR PUNTO NET S.A. 7303 486 239 67 Telecom Argentina Stet-France 16814 426 27 10 NSS, S.A. 10620 424 104 62 TVCABLE BOGOTA 6471 420 85 48 ENTEL CHILE S.A. 11172 409 118 72 Servicios Alestra S.A de C.V 28573 350 442 29 NET Servicos de Comunicao S.A 14117 345 23 9 Telefonica del Sur S.A. Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 512 67 32 LINKdotNET AS number 20858 403 34 3 EgyNet 3741 265 855 223 The Internet Solution 2018 231 214 138 Tertiary Education Network 6713 143 135 11 Itissalat Al-MAGHRIB 33783 137 10 13 EEPAD TISP TELECOM & INTERNET 5536 120 8 17 Internet Egypt Network 5713 118 555 68 Telkom SA Ltd 33776 116 6 3 Starcomms Nigeria Limited 29571 107 13 8 Ci Telecom Autonomous system Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4298 3416 339 bellsouth.net, inc. 209 2918 3873 620 Qwest 6298 1965 314 757 Cox Communicatons 4755 1718 538 181 Videsh Sanchar Nigam Ltd. Aut 20115 1677 1414 719 Charter Communications 1785 1653 710 156 AppliedTheory Corporation 8151 1604 2607 222 UniNet S.A. de C.V. 2386 1555 691 895 AT&T Data Communications Serv 4323 1520 1073 375 Time Warner Telecom 7018 1405 5801 974 AT&T WorldNet Services Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 209 2918 2298 Qwest 4755 1718 1537 Videsh Sanchar Nigam Ltd. Aut 1785 1653 1497 AppliedTheory Corporation 8151 1604 1382 UniNet S.A. de C.V. 17488 1378 1280 Hathway IP Over Cable Interne 6298 1965 1208 Cox Communicatons 11492 1210 1191 Cable One 4323 1520 1145 Time Warner Telecom 18566 1048 1038 Covad Communications 6478 1155 970 AT&T Worldnet Services Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 22492 UNALLOCATED 12.2.46.0/24 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13632 UNALLOCATED 12.20.55.0/24 6517 Yipes Communications 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 13632 UNALLOCATED 12.31.25.0/24 6517 Yipes Communications 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.75.116.0/22 10796 ServiceCo LLC - Road Runner 24.75.160.0/19 7843 Adelphia Corp. 24.142.40.0/21 7018 AT&T WorldNet Services 24.142.160.0/19 7018 AT&T WorldNet Services 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 62.61.220.0/24 24974 Tachyon Europe BV - Wireless 63.140.213.0/24 22555 Universal Talkware Corporatio 63.143.71.0/24 701 UUNET Technologies, Inc. 63.143.115.0/24 701 UUNET Technologies, Inc. Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:9 /10:17 /11:45 /12:146 /13:294 /14:525 /15:1069 /16:10073 /17:4381 /18:7696 /19:16085 /20:19021 /21:18546 /22:23244 /23:24388 /24:140269 /25:784 /26:948 /27:747 /28:89 /29:9 /30:1 /31:0 /32:7 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2851 4298 bellsouth.net, inc. 6298 1940 1965 Cox Communicatons 209 1684 2918 Qwest 2386 1232 1555 AT&T Data Communications Serv 11492 1191 1210 Cable One 17488 1185 1378 Hathway IP Over Cable Interne 1785 1122 1653 AppliedTheory Corporation 4755 1053 1718 Videsh Sanchar Nigam Ltd. Aut 6478 1048 1155 AT&T Worldnet Services 18566 1029 1048 Covad Communications Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:8 8:139 12:2140 13:2 15:21 16:3 17:5 18:13 20:35 24:1089 32:59 38:493 40:92 41:725 43:1 44:2 47:12 52:3 55:3 56:3 57:27 58:525 59:517 60:451 61:969 62:1213 63:2039 64:3193 65:2375 66:3454 67:1228 68:774 69:2274 70:844 71:164 72:1990 73:7 74:1150 75:164 76:265 77:793 78:824 79:265 80:947 81:833 82:580 83:366 84:575 85:1021 86:400 87:714 88:335 89:1360 90:21 91:1480 92:262 93:819 94:140 96:65 97:77 98:315 99:8 114:97 115:44 116:1015 117:362 118:243 119:488 120:83 121:591 122:845 123:438 124:853 125:1194 128:356 129:201 130:134 131:411 132:70 133:9 134:178 135:32 136:223 137:93 138:140 139:81 140:505 141:102 142:408 143:306 144:363 145:51 146:370 147:157 148:517 149:207 150:128 151:182 152:146 153:136 154:10 155:283 156:175 157:299 158:162 159:302 160:274 161:139 162:253 163:155 164:516 165:494 166:364 167:331 168:632 169:143 170:438 171:33 172:10 173:33 186:1 187:1 188:1 189:610 190:2210 192:5707 193:4145 194:3252 195:2573 196:996 198:3725 199:3294 200:5592 201:1528 202:7841 203:8071 204:3931 205:2120 206:2354 207:2738 208:3577 209:3421 210:2600 211:1093 212:1427 213:1625 214:179 215:50 216:4333 217:1213 218:346 219:437 220:1060 221:426 222:316 End of report

1 0

Re: community real-time BGP hijack notification service
by Avi Freedman 12 Sep '08

12 Sep '08

Hi Erik - There's a great button about Usenet - "Reading Usenet is like drinking from a firehose; Posting to Usenet is like shouting from a mountaintop; Archiving Usenet is like saving used toilet tissue." BGP may be somewhat more important, useful, and the results consumable in the short-term, but for long-term archiving I think it devolves to being more interested to researchers and other ubernerds who can use the libraries and the very valuable data store and service that RIPE provides (which is appreciated)! I was thinking more for the medium term "what's normal" that goes back beyond whatever's in the routing table this second, probably for a few weeks to months max in most cases. And I think for actual diagnosis what's needed is a great tool to ask network and business questions of historic BGP data. That's the context in which I mention Renesys tools+data. So I'd say to help the networkers of the world, it's probably more about tools than history. Thanks, Avi > RIS provides data in a searchable MySQL database for three months. > > All we've ever collected is kept in a raw data format. This archive > starts in 1999, and we maintain a library to read the data. > This data is free to use for any purpose and we will not remove any of > our raw data as it gets older. > > We are also carefully looking into whether we should reduce or increase > the amount of data in our MySQL database - as that's easy to search for > our users. > > However, any increase obviously comes with increased resource usage - so > this is something that requires careful thinking and planning. > Another option is to store aggregated info on older data, instead of > keeping every update that ever occured. > > But, this is just an idea that crosses our minds from time to time - I'm > not making promises on what we will implement :) > > Of course, any ideas on how much more history would help you, are very > welcome. > > cheers, > -- > Erik Romijn RIPE NCC software engineer >

1 0

Re: community real-time BGP hijack notification service
by Avi Freedman 12 Sep '08

12 Sep '08

> Nathan wrote: > It is trivially easy for an attacker to falsify the origin AS. If 'they' are > not doing it already, then I'm quite surprised. > This isn't really a good thing to alarm on, in my opinion. Or, maybe it is, but > there should be big bold text explaining that it's not reliable as it's > trivially easy to falsify. Yep, true. However, there's the case that someone's just typo'd you, which has happened to, near, around, and by me more frequently than an actual jackification. There was the time I fumble-fingered some net99 space and Karl Denninger started tracking me down to threaten lawsuits (before, I might add, asking me to log into the offending device and change the config). Anyway, the other case is where there shouldn't be a more specific, and you still win. Otherwise, yes, origin AS can be forged but the transit part is even messier, I think. > My best idea is looking at the AS_PATH for changes, and alerting whenever that > happens. You'd obviously get a different path whenever there is churn in the > network though. I'm sure there's a way to do this, and I suspect having BGP > feeds from many many places is the most reliable way for it to happen, I just > haven't figured out why yet. As you point out, the Internet is a really noisy and messy place. Just doing the "different than usual" is something I resisted here because there's so much hidden partial transit that doesn't normally expose. More BGP feeds might just amplify that behavior, though the idea is to get more feeds in. > This seems like a service that Renesys etc. could/should (or maybe do?) offer, > they seem well placed with all their BGP feeds.. Not sure who else offers it; it seemed reasonable to do and see if it's useful. Gadi told me there was no free real-time alerting out there but I didn't really look into it. Certainly if anyone wants to see the dynamics, who has advertised what now and in the deep dark past, etc Renesys would be the place to go as far as I know. > Nathan Ward Avi

2 1

Re: community real-time BGP hijack notification service
by Avi Freedman 12 Sep '08

12 Sep '08

> Nathan wrote: > My best quick hack solution so far is to fire off a traceroute and make sure > that the traceroute gets ICMP TTL expire messages from IP addresses that are in > prefixes originated from all the ASes in the ASPATH. > Still forgeable, but a bit more difficult.. still far from perfect though. An interesting idea although I think the false positive rate would be very high with all of the filtering (and mismatch between traceroute and BGP topologies) that exists out there. It'd be interesting for someone to try and see how well it works though. (Any researchers hanging out on NANOG want to try a weekend project...) > Nathan Ward Avi

1 0

Re: community real-time BGP hijack notification service (fwd)
by Avi Freedman 12 Sep '08

12 Sep '08

Hi, Arnaud. The design is to only watch the origin ASN, not the other ASNs in the path. Support for doing something with the transit portion wof the AS_PATH will be added, probably a very simple "alert if X is in there" or "alert if Y is not in there". As others have said it's imperfect so ideas are welcome but the goal here is to try to keep it useful but simple. Thanks, Avi > Date: Fri, 12 Sep 2008 14:18:58 +0200 > From: Arnaud de Prelle <arnaud(a)pnzone.net> > To: Gadi Evron <ge(a)linuxbox.org> > Cc: nanog(a)merit.edu > Subject: Re: community real-time BGP hijack notification service > > Hello Gadi, > > Gadi Evron wrote: > > Hi, WatchMy.Net is a new community service to alert you when your prefix > > has been hijacked, in real-time. > > Very good initiative. You can count on me as one of your users. > > Note that apparently it doesn't seem to be working as expected yet. > Indeed I already received two false alerts: > > 1. > Subject: > watchmy.net BGP Alert - seeing {91.198.99.0/24, 6450 3737 701 702 43751} > > Body: > Hello, we are seeing 91.198.99.0/24 being advertised with aspath 6450 > 3737 701 702 43751. > > We are alerting you because of the rule you set that is watching for > prefixes that match or are more specific than 91.198.99.0/24, and are > originated with any origin AS other than one of 702,6661,8220

1 0

RE: NTT/ChinaTelCom troubleshooting
by Andrew Staples 12 Sep '08

12 Sep '08

Many thanks to all the replies and help. There are some star performers working for NTT, kudos to them for their professionalism and brainpower. Follow-up question: We've seen great improvement by testing throughput using ChinaNetworkCommunications, AS4837. Before we switch service, does anyone have experience with their network/service/administration? Thanks, Andrew -----Original Message----- From: Andrew Staples [mailto:andrews@ltinet.net] Sent: Monday, September 08, 2008 8:33 AM To: nanog(a)nanog.org Subject: NTT/ChinaTelCom troubleshooting Our connectivity from the US to ChinaTelCom has been in the toilet for 2 months. The Olympics are over, and I'm assured by my Shanghai contacts that The Great Firewall of China has been relaxed, yet the problem remains. Local loops on each end test fine to other localized ip space. Symptoms include large-email delivery delays/failures, large file transfer failures. Firewalls and VPNs have been reviewed, NOCS have been contacted. Fingerpointing is raging at its finest. US endpoint is AS7358 Transit is AS2914 CN endpoint is AS4134 If there is anyone from those three networks who can help us figure out why large packets are dropping on transmits from the US to CN, I would really appreciate an off-list reply. Heck, I'll take any replies from anyone that might have some inside information or similar experiences, or give me some ideas on the best way to do some external black-hole router/mtu munging detective work on these networks. Thanks, Andrew

1 0