November 2009 - Test - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 27 Nov '09

27 Nov '09

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 28 Nov, 2009 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 304342 Prefixes after maximum aggregation: 142008 Deaggregation factor: 2.14 Unique aggregates announced to Internet: 150155 Total ASes present in the Internet Routing Table: 32808 Prefixes per ASN: 9.28 Origin-only ASes present in the Internet Routing Table: 28489 Origin ASes announcing only one prefix: 13901 Transit ASes present in the Internet Routing Table: 4319 Transit-only ASes present in the Internet Routing Table: 103 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 39 Max AS path prepend of ASN (22394) 36 Prefixes from unregistered ASNs in the Routing Table: 690 Unregistered ASNs in the Routing Table: 150 Number of 32-bit ASNs allocated by the RIRs: 338 Prefixes from 32-bit ASNs in the Routing Table: 278 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 206 Number of addresses announced to Internet: 2137469824 Equivalent to 127 /8s, 103 /16s and 51 /24s Percentage of available address space announced: 57.7 Percentage of allocated address space announced: 65.4 Percentage of available address space allocated: 88.2 Percentage of address space in use by end-sites: 80.2 Total number of prefixes smaller than registry allocations: 146251 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 72689 Total APNIC prefixes after maximum aggregation: 25380 APNIC Deaggregation factor: 2.86 Prefixes being announced from the APNIC address blocks: 69408 Unique aggregates announced from the APNIC address blocks: 30885 APNIC Region origin ASes present in the Internet Routing Table: 3882 APNIC Prefixes per ASN: 17.88 APNIC Region origin ASes announcing only one prefix: 1062 APNIC Region transit ASes present in the Internet Routing Table: 595 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 23 Number of APNIC addresses announced to Internet: 482336544 Equivalent to 28 /8s, 191 /16s and 223 /24s Percentage of available APNIC address space announced: 79.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 55296-56319, 131072-132095 APNIC Address Blocks 43/8, 58/8, 59/8, 60/8, 61/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 128214 Total ARIN prefixes after maximum aggregation: 67287 ARIN Deaggregation factor: 1.91 Prefixes being announced from the ARIN address blocks: 102380 Unique aggregates announced from the ARIN address blocks: 38817 ARIN Region origin ASes present in the Internet Routing Table: 13369 ARIN Prefixes per ASN: 7.66 ARIN Region origin ASes announcing only one prefix: 5172 ARIN Region transit ASes present in the Internet Routing Table: 1330 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 39 Number of ARIN addresses announced to Internet: 731696160 Equivalent to 43 /8s, 156 /16s and 204 /24s Percentage of available ARIN address space announced: 64.1 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 70605 Total RIPE prefixes after maximum aggregation: 41017 RIPE Deaggregation factor: 1.72 Prefixes being announced from the RIPE address blocks: 63782 Unique aggregates announced from the RIPE address blocks: 42335 RIPE Region origin ASes present in the Internet Routing Table: 13820 RIPE Prefixes per ASN: 4.62 RIPE Region origin ASes announcing only one prefix: 7179 RIPE Region transit ASes present in the Internet Routing Table: 2082 Average RIPE Region AS path length visible: 3.9 Max RIPE Region AS path length visible: 20 Number of RIPE addresses announced to Internet: 405627328 Equivalent to 24 /8s, 45 /16s and 97 /24s Percentage of available RIPE address space announced: 75.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 196608-197631 RIPE Address Blocks 2/8, 25/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 178/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 26457 Total LACNIC prefixes after maximum aggregation: 6452 LACNIC Deaggregation factor: 4.10 Prefixes being announced from the LACNIC address blocks: 24770 Unique aggregates announced from the LACNIC address blocks: 13634 LACNIC Region origin ASes present in the Internet Routing Table: 1214 LACNIC Prefixes per ASN: 20.40 LACNIC Region origin ASes announcing only one prefix: 394 LACNIC Region transit ASes present in the Internet Routing Table: 201 Average LACNIC Region AS path length visible: 4.0 Max LACNIC Region AS path length visible: 23 Number of LACNIC addresses announced to Internet: 68329472 Equivalent to 4 /8s, 18 /16s and 160 /24s Percentage of available LACNIC address space announced: 67.9 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 262144-263167 plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 5868 Total AfriNIC prefixes after maximum aggregation: 1557 AfriNIC Deaggregation factor: 3.77 Prefixes being announced from the AfriNIC address blocks: 4252 Unique aggregates announced from the AfriNIC address blocks: 1436 AfriNIC Region origin ASes present in the Internet Routing Table: 333 AfriNIC Prefixes per ASN: 12.77 AfriNIC Region origin ASes announcing only one prefix: 94 AfriNIC Region transit ASes present in the Internet Routing Table: 70 Average AfriNIC Region AS path length visible: 3.8 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 13325568 Equivalent to 0 /8s, 203 /16s and 85 /24s Percentage of available AfriNIC address space announced: 39.7 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 1767 7507 461 Korea Telecom (KIX) 17488 1447 143 133 Hathway IP Over Cable Interne 4755 1278 296 148 TATA Communications formerly 4134 1013 19459 395 CHINANET-BACKBONE 9583 1007 75 495 Sify Limited 18101 984 204 35 Reliance Infocom Ltd Internet 7545 911 198 98 TPG Internet Pty Ltd 17974 861 265 60 PT TELEKOMUNIKASI INDONESIA 9829 848 664 24 BSNL National Internet Backbo 24560 806 293 175 Bharti Airtel Ltd., Telemedia Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4244 3879 311 bellsouth.net, inc. 4323 3751 1069 399 Time Warner Telecom 1785 1780 714 136 PaeTec Communications, Inc. 7018 1589 5808 1034 AT&T WorldNet Services 20115 1520 1483 666 Charter Communications 2386 1297 632 933 AT&T Data Communications Serv 3356 1229 10966 447 Level 3 Communications, LLC 6478 1188 251 315 AT&T Worldnet Services 11492 1142 222 14 Cable One 22773 1123 2600 66 Cox Communications, Inc. Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 30890 514 98 207 Evolva Telecom 9198 471 138 12 Kazakhtelecom Data Network Ad 35805 467 40 5 United Telecom of Georgia 3292 448 1906 393 TDC Tele Danmark 702 417 1837 335 UUNET - Commercial IP service 8551 377 354 41 Bezeq International 8866 371 110 23 Bulgarian Telecommunication C 3320 358 7067 304 Deutsche Telekom AG 3215 349 3144 111 France Telecom Transpac 3301 347 1427 303 TeliaNet Sweden Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1567 2899 233 UniNet S.A. de C.V. 10620 1004 224 138 TVCABLE BOGOTA 28573 814 666 82 NET Servicos de Comunicao S.A 7303 664 350 95 Telecom Argentina Stet-France 22047 546 302 14 VTR PUNTO NET S.A. 11830 474 308 59 Instituto Costarricense de El 11172 445 99 70 Servicios Alestra S.A de C.V 14117 437 29 11 Telefonica del Sur S.A. 7738 431 858 29 Telecomunicacoes da Bahia S.A 6503 424 162 184 AVANTEL, S.A. Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1022 188 7 TEDATA 24863 753 130 46 LINKdotNET AS number 3741 274 857 234 The Internet Solution 2018 190 188 118 Tertiary Education Network 6713 176 167 12 Itissalat Al-MAGHRIB 29975 134 506 15 Vodacom 29571 133 15 8 Ci Telecom Autonomous system 33776 124 7 11 Starcomms Nigeria Limited 5536 121 8 18 Internet Egypt Network 5713 116 508 67 Telkom SA Ltd Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4244 3879 311 bellsouth.net, inc. 4323 3751 1069 399 Time Warner Telecom 1785 1780 714 136 PaeTec Communications, Inc. 4766 1767 7507 461 Korea Telecom (KIX) 7018 1589 5808 1034 AT&T WorldNet Services 8151 1567 2899 233 UniNet S.A. de C.V. 20115 1520 1483 666 Charter Communications 17488 1447 143 133 Hathway IP Over Cable Interne 2386 1297 632 933 AT&T Data Communications Serv 4755 1278 296 148 TATA Communications formerly Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 3751 3352 Time Warner Telecom 1785 1780 1644 PaeTec Communications, Inc. 8151 1567 1334 UniNet S.A. de C.V. 17488 1447 1314 Hathway IP Over Cable Interne 4766 1767 1306 Korea Telecom (KIX) 4755 1278 1130 TATA Communications formerly 11492 1142 1128 Cable One 22773 1123 1057 Cox Communications, Inc. 18566 1059 1049 Covad Communications 8452 1022 1015 TEDATA Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic 32326 UNALLOCATED 12.40.49.0/24 7018 AT&T WorldNet Servic 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 2.0.0.0/16 12654 RIPE NCC RIS Project 2.1.0.0/21 12654 RIPE NCC RIS Project 2.1.24.0/24 12654 RIPE NCC RIS Project 41.223.92.0/22 36936 >>UNKNOWN<< 41.223.188.0/24 22351 Intelsat 41.223.189.0/24 26452 Local Communications Networks 46.0.0.0/16 12654 RIPE NCC RIS Project 46.1.0.0/21 12654 RIPE NCC RIS Project 46.1.24.0/24 12654 RIPE NCC RIS Project 62.61.220.0/24 24974 Tachyon Europe BV - Wireless Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:20 /9:10 /10:25 /11:65 /12:178 /13:363 /14:642 /15:1224 /16:10738 /17:4984 /18:8576 /19:17619 /20:21420 /21:21367 /22:27577 /23:27485 /24:159184 /25:923 /26:1129 /27:569 /28:217 /29:11 /30:8 /31:0 /32:8 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2776 4244 bellsouth.net, inc. 4323 2367 3751 Time Warner Telecom 4766 1435 1767 Korea Telecom (KIX) 1785 1247 1780 PaeTec Communications, Inc. 17488 1220 1447 Hathway IP Over Cable Interne 11492 1064 1142 Cable One 18566 1040 1059 Covad Communications 7018 954 1589 AT&T WorldNet Services 8452 920 1022 TEDATA 10620 909 1004 TVCABLE BOGOTA Complete listing at http://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 2:1 4:14 8:236 12:2056 13:8 15:22 16:3 17:5 20:36 24:1269 32:49 34:2 38:621 40:99 41:1783 43:1 44:2 46:1 47:20 52:6 55:2 56:2 57:23 58:640 59:611 60:445 61:977 62:958 63:2005 64:3696 65:2365 66:4076 67:1782 68:1002 69:2817 70:630 71:156 72:1755 73:2 74:2014 75:188 76:355 77:849 78:601 79:388 80:944 81:815 82:475 83:439 84:528 85:1010 86:381 87:687 88:443 89:1576 90:63 91:2658 92:447 93:1153 94:1332 95:833 96:201 97:276 98:425 99:27 109:171 110:274 111:466 112:151 113:180 114:277 115:382 116:1086 117:594 118:366 119:802 120:139 121:702 122:1308 123:793 124:1056 125:1353 128:214 129:203 130:134 131:453 132:82 133:16 134:187 135:41 136:232 137:166 138:236 139:84 140:461 141:122 142:381 143:339 144:384 145:52 146:392 147:171 148:558 149:192 150:149 151:172 152:219 153:161 154:2 155:273 156:166 157:314 158:98 159:360 160:294 161:175 162:277 163:163 164:316 165:469 166:490 167:391 168:753 169:159 170:559 171:42 172:1 173:394 174:401 180:202 183:134 184:1 186:185 187:172 188:1354 189:635 190:3283 192:5736 193:4311 194:3354 195:2769 196:1181 198:3568 199:3385 200:5251 201:1408 202:7921 203:8267 204:3982 205:2156 206:2413 207:3042 208:3970 209:3396 210:2531 211:1152 212:1648 213:1614 214:245 215:57 216:4438 217:1360 218:474 219:419 220:1139 221:447 222:300 End of report

1 0

Re: What DNS Is Not
by Scott Weeks 27 Nov '09

27 Nov '09

--- andrew(a)accessplus.com.au wrote: From: Andrew Cox <andrew(a)accessplus.com.au> As a follow up to this, one of the large Australian ISP's has just introduced a DNS redirection "service" for all home customers. "/The BigPond-branded landing page provides BigPond customers with organic search results, sponsored links, display advertisements and intelligent recommendations, all derived from the invalid domain input - much more helpful and friendly than a nasty 404 page error./" http://www.crn.com.au/News/160923,bigpond-redirects-typos-to-unethical-bran… ------------------------------------------------------------------------------ >From AUSNOG: On Thu, Nov 19, 2009 at 2:08 PM, Paul Foote <pfoote(a)gmail.com> wrote: All that's left for them to complete the "404" strategy is to put transparent proxies in place that redirect on real 404's :P Did nobody learn the lessons from when Verisign did this with .com ? baah. In fairness (and I use that term loosly) to BigPond, this is probably a little different to what Verisign did. I haven't seen the BigPond details, but I have seen what Comcast are doing on my US cable connection, and I presume BigPond is doing something similar. The major differences between the two are : * Only responds for "www" addresses. a lookup for "non-existantdomain.com" will still return an NXDOMAIN, but "www.non-existantdomain.com" returns their search page. This means that (the majority of) things like RBL/anti-spam/etc things which broke under Verisign's redirection no longer break. * It's only home users. Business plans/etc are not redirected. Obviously this is different to Verisign where everyone was hit. * You can turn it off, and the page you end up on even gives you the details on how to turn it off. Also despite claims to the contrary, Comcast are not actually "intercepting" DNS traffic - or at least they aren't for me. They are only doing this for traffic sent directly to their DNS servers, and pointing to another DNS server works as expected, as does running your own resolver. I'm still not saying that it's a good thing for them to be doing, but it's not quite as bad or destructive as Verisign's move was...

15 28

Re: Happy Thanksgiving
by Warren Bailey 26 Nov '09

26 Nov '09

I was wondering when someone was gonna tell Paul to go have a stiff drink and relax lol Sent from my Blackberry. Please execute spelling errors. ----- Original Message ----- From: Shane Ronan <sronan(a)fattoc.com> To: nanog <nanog(a)merit.edu> Sent: Thu Nov 26 13:38:43 2009 Subject: Happy Thanksgiving Happy Thanksgiving <eom>

3 2

Re: Multicast LDP or P2MP RSVP & LDP
by devang patel 26 Nov '09

26 Nov '09

Brendan, Thanks for your reply and link. Do you have any good white paper or scenario based example to share? Thanks, Devang On Thu, Nov 26, 2009 at 7:45 PM, Brendan Kelly <bkelly(a)juniper.net> wrote: > Devang here is our guide. > > > http://www.juniper.net/techpubs/en_US/junos10.0/information-products/topic-… > > Thanks > Brendan > On Nov 26, 2009, at 12:53 AM, devang patel wrote: > > > Rob, > > > > Can you share some documentation with me on how to configure as well as > any > > kind of configuration example will be great help. > > > > Thanks, > > Devang > > > > On Thu, Nov 26, 2009 at 12:46 AM, Rob Shakir <rjs(a)eng.gxn.net> wrote: > > > >> > >> On 26 Nov 2009, at 06:27, devang patel wrote: > >> > >> Hi All, > >>> > >>> I just want to know about the deployment of Multicast LDP or P2MP RSVP > and > >>> LDP is available from any vendor or they are still in draft status? > >>> > >> > >> Hi Devang, > >> > >> To the best of my knowledge, the only current P2MP LSP implementation > >> available is in JunOS [0]. The guys at Juniper wrote a draft relating to > >> their experience with scaling and implementing P2MP MVPN [1], which is > worth > >> a look -- this draft mentions that IOS XR has an implementation, > although I > >> struggled to find any documentation that confirms this. > >> > >> Both the LDP-based [2] P2MP standard are still in draft status, but the > >> extensions required in RSVP-TE for signalling P2MP paths are in RFC4875 > [3]. > >> > >> From a couple of discussions I've had, there are not very many people > using > >> this functionality -- with most common application being IPTV. For > >> traditional transport of multicast over an SP core, it's often easier to > >> provide some AToM/L2VPN service. > >> > >> Hope this helps somewhat. > >> > >> Kind regards, > >> Rob > >> > >> [0]: > >> > http://www.juniper.net/techpubs/software/junos/junos91/feature-guide/config… > >> [1]: http://tools.ietf.org/html/draft-joseph-p2mp-mvpn-experience-00 > >> [2]: http://tools.ietf.org/html/draft-ietf-mpls-ldp-p2mp-08 > >> [3]: http://tools.ietf.org/html/rfc4875 > >> > >> -- > >> Rob Shakir <rjs(a)eng.gxn.net> > >> Network Development Engineer GX Networks/Vialtus Solutions > >> ddi: +44208 587 6077 mob: +44797 155 4098 > >> pgp: 0xc07e6deb nic-hdl: RJS-RIPE > >> > >> This email is subject to: http://www.vialtus.com/disclaimer.html > >> > >> > >> > >> > >

1 0

Re: I got a live one! - Spam source
by Michael Peddemors 26 Nov '09

26 Nov '09

> > Could you elaborate on what constitutes correct swip information? > Sure, you just opened the door to my opinions on this :) -- WRONG -- OrgName: FortressITX OrgID: FORTR-5 Address: 100 Delawanna Ave City: Clifton StateProv: NJ PostalCode: 07014 Country: US Found a referral to rwhois.fortressitx.com:4443. Timeout. -- ----------------- The argument that whois information should not be made public, is ridiculous. I here people saying that they don't publish whois information because they don't want the email's made public. Okay, at least the registered company name, or individual who presented the ID should be there. -- WRONG -- OrgName: Peer 1 Dedicated Hosting OrgID: P1DH-1 Address: 101 Marietta Street Address: Suite 500 City: Atlanta StateProv: GA PostalCode: 30303 Country: US NetRange: 216.150.0.0 - 216.150.31.255 CIDR: 216.150.0.0/19 ------------------------------ Okay, you REALLY want people to get tired of playing whack a mole? This is why many list operators block large ranges.. according to this listing, one responsible party for the whole list.. (oh, and don't get me started on reporting.. the quote i heard here was .. 'Oh, we don't do anything about spammers unless it affects other customers') So, how big a range should you block when you start seeing a pattern? Remember, organizations like UCE-PROTECT tend to base a reputation on /24 This is probably because in a lot of cases, you cannot tell does the person own the whole range, or just the top /25 -- RIGHT -- OrgName: Network Operations Center Inc. OrgID: NOC Address: PO Box 591 City: Scranton network:Network-Name:NET-96.9.145.224/28 network:IP-Network:96.9.145.224/28 network:Organization;I:org--6898 network:Org-Name:ServerPlaceNet c/o Network Operations Center, Inc. -------------- Simple, if the IP's reflect some behavior we don't like, we know exactly which ranges should be affected. Basically, if you absolve yourself of the responsibility for the conduct of part of your networks, to a 3rd party.. you should SWIP it. Some hosting companies are really good about this, even as far as SWIP'ing down to the /32. There is a chain of responsbilitly, and when a hosting company has a known offender using portion(s) of their space, it makes it much easier to decide how much of that space should be blocked. Should we block the whole /24 or only a portion? Say you see... 66.104.246.36: mail1.clubdelivery.net 66.104.246.37: mail1.deliverydirect.info 66.104.246.38: mail1.deliverymobile.net 66.104.246.39: mail1.deliveryonline.info 66.104.246.40: mail1.deliveryrama.net 66.104.246.41: mail1.deliveryusa.net 66.104.246.42: mail1.deliveryzilla.net 66.104.246.43: mail1.godelivery.info 66.104.246.44: mail1.instantdelivery.info 66.104.246.45: mail1.date-meet.net 66.104.246.46: mail1.uchatfree.net 66.104.246.47: mail1.secureeasypay.net 66.104.246.48: mail1.idevelopthings.com 66.104.246.49: mail1.whocanvote.com 66.104.246.50: mail1.freedvdz.net 66.104.246.51: mail1.freecybercam.com 66.104.246.53: mail2.clubdelivery.net 66.104.246.54: mail2.deliverydirect.info 66.104.246.55: mail2.deliverymobile.net 66.104.246.56: mail2.deliveryonline.info 66.104.246.57: mail2.deliveryrama.net 66.104.246.58: mail2.deliveryusa.net 66.104.246.59: mail2.deliveryzilla.net 66.104.246.60: mail2.godelivery.info 66.104.246.61: mail2.instantdelivery.info 66.104.246.62: mail2.date-meet.net It's listed as.. network:Organization;I:Precision Technology, Inc (286563-1) network:IP-Network:66.104.244.0/22 Well, we don't have to affect the whole XO block.. but who is the operator responsible for the activities of these servers? The SWIP should reflect that. Also, it makes it easier to see relevant activities from other ranges that the customer might own.. Like older IP Ranges... -- Precision Technology INC mycouponsavingsmailcom MYCOUPONSAVINGSMAILCOM 24.155.144.16 - 24.155.144.31 # 24.155.144.16/28 Guess business was good.. but now of course, with proper SWIP, we know that those IP's are no longer controlled by the same party . (we hope) Of course, it can still be abused.. if the hosting provider is in colusion.. changes the SWIP regularly to hide that it is the same operator.. but even then, we will see such patterns.. if a hosting company 'constantly' gets a new 'problem customer' <sic> then we can see that as well. -- -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors - President/CEO - LinuxMagic Products, Services, Support and Development Visit us at http://www.linuxmagic.com ------------------------------------------------------------------------ A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" is a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-589-0037 Beautiful British Columbia, Canada This email and any electronic data contained are confidential and intended solely for the use of the individual or entity to which they are addressed. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company.

4 5

Re: Happy Thanksgiving
by chaim.rieger＠gmail.com 26 Nov '09

26 Nov '09

Paul, have a stiff one . Sent via BlackBerry from T-Mobile

1 0

Happy Thanksgiving
by Shane Ronan 26 Nov '09

26 Nov '09

Happy Thanksgiving <eom>

1 0

Who has AS 1712?
by Stephane Bortzmeyer 26 Nov '09

26 Nov '09

% whois -h whois.ripe.net AS1712 aut-num: AS1712 as-name: FR-RENATER-ENST descr: Ecole Nationale Superieure des Telecommunications, descr: Paris, France. descr: FR % whois -h whois.arin.net AS1712 OrgName: Twilight Communications City: Wallis StateProv: TX Country: US And, yes, AS 1712 is actually used by both and announced :-(

26 59

I got a live one! - Spam source
by Russell Myba 26 Nov '09

26 Nov '09

Looks like of our customers has decided to turn their /24 into a nice little space spewing machine. Doesn't seem like just one compromised host. Reverse DNS for most of the /24 are suspicious domains. Each domain used in the message-id forwards to a single .net which lists their mailing address as a PO box an single link to an unsubscribe field. I've contacted at least three known contacts for the customer about the abuse without a single response. It would seem there are many layers to this entity: The domains are registered to one business Our billing information for the customer has one name, they colo with another person (whom the cross connect reaches) Our customer has an IT solutions person working for them (Strange since our customer and their colo provider are "IT solutions" people themselves. Abuse handle phone #s are supposedly incorrect (I called it) Besides the obvious of me at the minimum filtering port tcp/25 is their an organization that tracks businesses like these who seem like they are building a web of insulation in which to move? I think this case might interest them.

11 14

Multicast LDP or P2MP RSVP & LDP
by devang patel 26 Nov '09

26 Nov '09

Hi All, I just want to know about the deployment of Multicast LDP or P2MP RSVP and LDP is available from any vendor or they are still in draft status? Also it will be great if some one can give me an idea of Multicast VPN deployment in service providers; are they deployed with draft Rosen GRE based solution or BGP auto discovery mechanism? Thanks in advance for help... regards, Devang

2 2