May 2009 - Test - lists.nanog.org

ASPATH Loop
by yangyang. wang 10 May '09

10 May '09

Hi， NANOG： When I was analyzing the BGP RIB data from RouteViews, I found that there were aspath loop in many bgp rib entries. For example, in the file rib.wide.20090301.0319, the peer 202.249.2.169 in AS2497 observed the following aspaths: 3130 29283 3130 2914 2497 3130 7337 3130 2914 2497 3130 34486 3130 2914 2497 3130 38001 3130 2914 2497 3130 13977 3130 2914 2497 3130 25147 3130 2914 2497 3130 5433 3130 2914 2497 3130 26164 3130 2914 2497 3130 34026 3130 2914 2497 3130 31535 3130 2914 2497 3130 14363 3130 2914 2497 3130 29648 3130 2914 2497 3130 27582 3130 2914 2497 3130 39737 3130 2914 2497 3130 33796 3130 2914 2497 3130 15108 3130 2914 2497 3130 9600 3130 2914 2497 ...... As we know, BGP instance running on routers don't allow loop in ASPATH, why they can be seen in RIBs? It's some particular technical configuration in practice? OR What's wrong with AS3130?? Thanks Yangyang

3 3

[quagga-users 10587] bgpd crash - apologies (fwd)
by Ingo Flaschberger 09 May '09

09 May '09

---------- Forwarded message ---------- Date: Mon, 04 May 2009 00:38:54 +0300 From: Geert Jan de Groot <GeertJan.deGroot(a)xs4all.nl> To: quagga-users(a)lists.quagga.net Subject: [quagga-users 10587] bgpd crash - apologies Hello, I learned today that a BGP announcement for which I am the tech-c, is causing difficulties with Quagga. First of all, I apologise; it's only today that I heard about these difficulties. I arrived less than 20 hours ago in Cairo as part of a setup-team for the upcoming AfNOG-10 meeting. We will be multi-homed this time, and hence applied for (and obtained) an ASN. Per RIR-policy active since 1-1-2009, these ASNs are 32-bit ASNs so AS327686 (AS5.6) is what is used. Currently, the local host team is provisioning links etc and hence you may have seen this problem come and go. I do not know why they choose to do prepending, but suspect it has to do with ability to set policy. I have a very, very long list of things to set up for the conference but will try any of the workarounds that have been suggested to me today. At the same time, I kindly but strongly ask to implement the fix that has been posted on various lists. One of the aims of this setup is to demonstrate that 32-bit ASNs do work and people should not steer away from them, especially since the pool of 16-bit ASNs is shrinking fast. A showcase network goes a long way in this regard. I do apologise for this unexpected, undesired side-effect. This was obviously not intended, and I apologise. It was 1996 when Paul Traina, at that time with Cisco, was doing AS path prepending for the very first time. This caused an assertion error with gated, which (among others) ANS was using at that time. I did administer AS3333 back then and my gated boxes, too, did crash, so I have been "victimized" myself before. It is perhaps ironic that 12 years later I'm again involved. Again, my sincere apologies. Geert Jan _______________________________________________ Quagga-users mailing list Quagga-users(a)lists.quagga.net http://lists.quagga.net/mailman/listinfo/quagga-users

3 2

ADMIN: "UCEProtect" threads moderated.
by Simon Lyall 08 May '09

08 May '09

The thread "UCEProtect Level 3" ( and related threads ) have been moderated. We suggest using the spam-l or www.mailop.org lists to discuss Spam and DNSBLs. Simon Lyall (on behalf of) NANOG MLC -- Simon Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0

Re: massive snowshoe operations may be a cause for concern (was: Re:UCEProtect Level 3)
by Suresh Ramasubramanian 08 May '09

08 May '09

You wont find me holding up uceprotect or apews as fine examples of properly or even competently run lists, I'd point you to spamhaus for that. But, in this day and age, and with the volumes of spam around, I'd counsel you NOT to wait for or expect manual complaints to your abuse desk, almost nobody does that these days. Feel free to signup for AOL etc feedback loops and you'd probably get a much higher volume of complaints - enough that you'd have to dedicate an email address to it, and use the scriptability of the ARF format these feedback loops are sent in, so you can get / generate stats. Periodic rDNS scans of your network, and either making rDNS requests manual, or at least running periodic rDNS scans of your network to spot that kind of customer would make sense too. You must admit that the kind of rDNS Steve Champeon posted in in that very long list upthread sticks out like a sore thumb. --srs On Sat, May 9, 2009 at 4:20 AM, John van Oppen <john(a)vanoppen.com> wrote: > My favorite part of uceprotect was that there was basically no way to get them to send us actual reports or even IPs > (without us paying for them). We canned this customer a month or two ago for abuse but gave them time to migrate > out of our IP space (they were announcing it with their ASN to their other provider even after we cut transit) and > swore up and down they were using it for virtual hosting (as did their ARIN justification forms). I just requested > directly to their other provider that announcements be filtered and removed the SWIP. That /20 had only ever > had about 15 reports for it to our abuse desk and we are actually responsive hence the kicking of the customer

2 1

[NANOG-announce] NANOG46 Updates
by Betty Burke 08 May '09

08 May '09

NANOG Community: On behalf of the Merit NANOG-Support team, we look forward to seeing many of you in Philadelphia for NANOG46. IF you have not, we certainly encourage you to take a look at the meeting agenda. Once again, the NANOG Program Committee has, and continues, to bring a strong program to our meetings! We also encourage you to consider investing in NANOG sponsorship opportunities. The NANOG Marketing Working group along with Merit have a new list of ideas/opportunities your organization may find of interest. The NANOG community clearly benefits from the Sponsorship support, and a great marketing opportunity for your organization. Of importance to those who have not registered, there are JUST DAYS Left to Save $75.00. Early Bird Pricing Expires at Midnight, Sunday, 5-10-09. The Hotel NANOG Group rate at expires May 29, 2009. Do not be left behind, Register now! https://nanog.merit.edu/registration/ Consider sponsorship OPPORTUNITIES! http://nanog.org/meetings/nanog46/agenda.php Make sure to check out... http://nanog.org/meetings/nanog46/agenda.php If you have questions, concerns, comments feel free to send them to nanog-support(a)nanog.org. Sincerely, Betty Burke Merit Network Inc. NANOG Community Project Manager NANOG Steering Committee Member _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 08 May '09

08 May '09

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 09 May, 2009 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 288037 Prefixes after maximum aggregation: 136199 Deaggregation factor: 2.11 Unique aggregates announced to Internet: 140785 Total ASes present in the Internet Routing Table: 31199 Prefixes per ASN: 9.23 Origin-only ASes present in the Internet Routing Table: 27142 Origin ASes announcing only one prefix: 13239 Transit ASes present in the Internet Routing Table: 4057 Transit-only ASes present in the Internet Routing Table: 96 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 33 Max AS path prepend of ASN (43683) 31 Prefixes from unregistered ASNs in the Routing Table: 461 Unregistered ASNs in the Routing Table: 151 Number of 32-bit ASNs allocated by the RIRs: 142 Prefixes from 32-bit ASNs in the Routing Table: 30 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 194 Number of addresses announced to Internet: 2039977920 Equivalent to 121 /8s, 151 /16s and 151 /24s Percentage of available address space announced: 55.0 Percentage of allocated address space announced: 63.7 Percentage of available address space allocated: 86.4 Percentage of address space in use by end-sites: 76.9 Total number of prefixes smaller than registry allocations: 142407 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 67704 Total APNIC prefixes after maximum aggregation: 24092 APNIC Deaggregation factor: 2.81 Prefixes being announced from the APNIC address blocks: 64376 Unique aggregates announced from the APNIC address blocks: 28909 APNIC Region origin ASes present in the Internet Routing Table: 3610 APNIC Prefixes per ASN: 17.83 APNIC Region origin ASes announcing only one prefix: 974 APNIC Region transit ASes present in the Internet Routing Table: 548 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 18 Number of APNIC addresses announced to Internet: 413123104 Equivalent to 24 /8s, 159 /16s and 194 /24s Percentage of available APNIC address space announced: 77.0 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 180/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 125398 Total ARIN prefixes after maximum aggregation: 66155 ARIN Deaggregation factor: 1.90 Prefixes being announced from the ARIN address blocks: 94539 Unique aggregates announced from the ARIN address blocks: 36627 ARIN Region origin ASes present in the Internet Routing Table: 12984 ARIN Prefixes per ASN: 7.28 ARIN Region origin ASes announcing only one prefix: 5014 ARIN Region transit ASes present in the Internet Routing Table: 1264 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 24 Number of ARIN addresses announced to Internet: 428554240 Equivalent to 25 /8s, 139 /16s and 56 /24s Percentage of available ARIN address space announced: 82.4 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 65823 Total RIPE prefixes after maximum aggregation: 38233 RIPE Deaggregation factor: 1.72 Prefixes being announced from the RIPE address blocks: 60147 Unique aggregates announced from the RIPE address blocks: 39883 RIPE Region origin ASes present in the Internet Routing Table: 12974 RIPE Prefixes per ASN: 4.64 RIPE Region origin ASes announcing only one prefix: 6798 RIPE Region transit ASes present in the Internet Routing Table: 1959 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 33 Number of RIPE addresses announced to Internet: 393192480 Equivalent to 23 /8s, 111 /16s and 164 /24s Percentage of available RIPE address space announced: 83.7 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 178/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 23762 Total LACNIC prefixes after maximum aggregation: 5894 LACNIC Deaggregation factor: 4.03 Prefixes being announced from the LACNIC address blocks: 21941 Unique aggregates announced from the LACNIC address blocks: 12057 LACNIC Region origin ASes present in the Internet Routing Table: 1107 LACNIC Prefixes per ASN: 19.82 LACNIC Region origin ASes announcing only one prefix: 361 LACNIC Region transit ASes present in the Internet Routing Table: 184 Average LACNIC Region AS path length visible: 4.0 Max LACNIC Region AS path length visible: 26 Number of LACNIC addresses announced to Internet: 63068288 Equivalent to 3 /8s, 194 /16s and 88 /24s Percentage of available LACNIC address space announced: 62.7 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247 plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 4921 Total AfriNIC prefixes after maximum aggregation: 1487 AfriNIC Deaggregation factor: 3.31 Prefixes being announced from the AfriNIC address blocks: 4562 Unique aggregates announced from the AfriNIC address blocks: 1412 AfriNIC Region origin ASes present in the Internet Routing Table: 295 AfriNIC Prefixes per ASN: 15.46 AfriNIC Region origin ASes announcing only one prefix: 92 AfriNIC Region transit ASes present in the Internet Routing Table: 58 Average AfriNIC Region AS path length visible: 3.9 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC addresses announced to Internet: 11303168 Equivalent to 0 /8s, 172 /16s and 121 /24s Percentage of available AfriNIC address space announced: 33.7 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 1700 6930 405 Korea Telecom (KIX) 17488 1573 127 101 Hathway IP Over Cable Interne 4755 1243 466 126 TATA Communications formerly 9583 1077 86 539 Sify Limited 4134 898 16676 373 CHINANET-BACKBONE 7545 792 166 102 TPG Internet Pty Ltd 23577 780 34 663 Korea Telecom (ATM-MPLS) 18101 756 217 32 Reliance Infocom Ltd Internet 24560 685 229 176 Bharti Airtel Ltd. 9829 654 560 18 BSNL National Internet Backbo Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4306 3653 342 bellsouth.net, inc. 209 2559 4149 604 Qwest 4323 1848 1035 373 Time Warner Telecom 1785 1758 717 139 PaeTec Communications, Inc. 20115 1631 1449 728 Charter Communications 7018 1464 5911 1014 AT&T WorldNet Services 6478 1398 309 414 AT&T Worldnet Services 2386 1264 698 911 AT&T Data Communications Serv 3356 1235 10981 469 Level 3 Communications, LLC 11492 1102 192 11 Cable One Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8452 1231 188 7 TEDATA 30890 541 88 200 Evolva Telecom 3292 455 1893 394 TDC Tele Danmark 12479 448 578 6 Uni2 Autonomous System 8866 368 110 24 Bulgarian Telecommunication C 3320 348 7082 299 Deutsche Telekom AG 3215 343 3041 108 France Telecom Transpac 3301 340 1668 304 TeliaNet Sweden 35805 338 24 4 United Telecom of Georgia 29049 317 26 3 AzerSat LLC. Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1449 2848 232 UniNet S.A. de C.V. 10620 930 207 106 TVCABLE BOGOTA 22047 616 302 14 VTR PUNTO NET S.A. 7303 524 272 76 Telecom Argentina Stet-France 11830 516 294 34 Instituto Costarricense de El 28573 456 562 26 NET Servicos de Comunicao S.A 11172 443 102 72 Servicios Alestra S.A de C.V 6471 435 95 31 ENTEL CHILE S.A. 7738 397 794 28 Telecomunicacoes da Bahia S.A 3816 349 163 73 Empresa Nacional de Telecomun Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 823 76 48 LINKdotNET AS number 20858 302 34 5 This AS will be used to conne 3741 278 860 238 The Internet Solution 2018 243 215 143 Tertiary Education Network 6713 159 150 15 Itissalat Al-MAGHRIB 29571 139 15 9 Ci Telecom Autonomous system 5536 123 8 9 Internet Egypt Network 33783 120 8 40 EEPAD TISP TELECOM & INTERNET 5713 115 507 66 Telkom SA Ltd 24835 107 46 9 RAYA Telecom - Egypt Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4306 3653 342 bellsouth.net, inc. 209 2559 4149 604 Qwest 4323 1848 1035 373 Time Warner Telecom 1785 1758 717 139 PaeTec Communications, Inc. 4766 1700 6930 405 Korea Telecom (KIX) 20115 1631 1449 728 Charter Communications 17488 1573 127 101 Hathway IP Over Cable Interne 7018 1464 5911 1014 AT&T WorldNet Services 8151 1449 2848 232 UniNet S.A. de C.V. 6478 1398 309 414 AT&T Worldnet Services Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 209 2559 1955 Qwest 1785 1758 1619 PaeTec Communications, Inc. 4323 1848 1475 Time Warner Telecom 17488 1573 1472 Hathway IP Over Cable Interne 4766 1700 1295 Korea Telecom (KIX) 8452 1231 1224 TEDATA 8151 1449 1217 UniNet S.A. de C.V. 4755 1243 1117 TATA Communications formerly 11492 1102 1091 Cable One 18566 1062 1052 Covad Communications Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic 32326 UNALLOCATED 12.40.49.0/24 7018 AT&T WorldNet Servic 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 41.223.112.0/22 5713 Telkom SA Ltd 41.223.176.0/22 36981 >>UNKNOWN<< 41.223.188.0/24 22351 Intelsat 41.223.189.0/24 26452 Local Communications Networks 62.61.220.0/24 24974 Tachyon Europe BV - Wireless 62.61.221.0/24 24974 Tachyon Europe BV - Wireless 63.140.213.0/24 22555 Universal Talkware Corporatio 63.143.251.0/24 22555 Universal Talkware Corporatio Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:10 /10:20 /11:58 /12:166 /13:337 /14:597 /15:1146 /16:10463 /17:4724 /18:8128 /19:17124 /20:20385 /21:20268 /22:25947 /23:25487 /24:150459 /25:900 /26:1041 /27:543 /28:160 /29:37 /30:10 /31:0 /32:8 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2804 4306 bellsouth.net, inc. 4766 1391 1700 Korea Telecom (KIX) 17488 1306 1573 Hathway IP Over Cable Interne 209 1295 2559 Qwest 8452 1207 1231 TEDATA 1785 1163 1758 PaeTec Communications, Inc. 18566 1043 1062 Covad Communications 11492 1038 1102 Cable One 2386 962 1264 AT&T Data Communications Serv 4323 952 1848 Time Warner Telecom Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:13 8:199 12:2222 13:10 15:19 16:3 17:4 20:35 24:1063 32:50 38:528 40:97 41:2015 43:1 44:2 47:22 52:4 55:2 56:3 57:25 58:581 59:637 60:459 61:1121 62:1112 63:2075 64:3664 65:2393 66:3621 67:1630 68:754 69:2590 70:531 71:144 72:1654 73:2 74:1499 75:171 76:311 77:833 78:561 79:336 80:971 81:814 82:530 83:417 84:613 85:1083 86:403 87:652 88:355 89:1442 90:47 91:2191 92:317 93:1003 94:1181 95:961 96:125 97:205 98:221 99:22 109:1 110:92 112:112 113:102 114:251 115:271 116:1162 117:520 118:290 119:691 120:142 121:721 122:1011 123:689 124:967 125:1315 128:221 129:232 130:126 131:414 132:73 133:9 134:185 135:214 136:242 137:152 138:159 139:81 140:444 141:107 142:377 143:357 144:362 145:47 146:373 147:152 148:518 149:237 150:181 151:200 152:147 153:139 154:2 155:274 156:169 157:300 158:115 159:310 160:281 161:135 162:274 163:149 164:482 165:503 166:278 167:363 168:685 169:167 170:475 171:40 172:10 173:276 174:204 178:1 186:10 187:88 188:13 189:343 190:2605 192:5797 193:4236 194:3305 195:2701 196:1075 198:3656 199:3348 200:5346 201:1367 202:7867 203:8197 204:3818 205:2144 206:2450 207:2814 208:3921 209:3391 210:2710 211:1112 212:1510 213:1706 214:74 215:30 216:4642 217:1264 218:368 219:432 220:1220 221:475 222:296 End of report

1 0

Call for interested parties: Switching BOF NANOG 46 June 14-17
by Joel Jaeggli 08 May '09

08 May '09

Greetings NANOG, We're closing in on the 1 month mark and as I see the BOF that I am trying to organize now has a slot I thought I'd see if there's anyone I haven't bugged in person who'd like to participate. In rough terms the topic is as follows. Best hopes for low cost high density routers, what feature mix can we expect from .1 to ~.5Tb/s top of the rack sized l3 switches. To expand on that idea a little bit I think subject areas might include: Where these things can be appropriately deployed How network architecture changes as a result of them The outlook for their future I am of course open to suggestions, as well. If you are a consumer of these products and you have an experience to relate (favorable bad or other) there are other's at nanog who would be interested in your experience. We are presuming that the NANOG audience is wider than simply transit backbone providers, but rather includes, CDN's and asp/content people, metro-e, consumer isp and some large enterprise users etc. If you are a switch vendor that participates at NANOG and I missed you or never connected with the right person, Don't take it personally and please drop me a line. Thanks for your consideration, and I look forward to seeing you all in Philadelphia. joel

1 0

Responsible blocklist usage
by Claus v. Wolfhausen 08 May '09

08 May '09

Seriously if you want to stop most of the spam with only a very minimal risk of false positives you will have to use a combination of list, because there is really *NO BLOCKLIST* which always does 0 False Positives if measured against an mixed but real mailflow: See: http://stats.uceprotect.net What you see there is the the real mailflow of those UCEPROTECT-customers that have freely chosen to select "Transmit Statistics and nominate Spammers in their Appliances. Actually 45 Systems are running the upcoming Release V4.1 in Betatest and what you see there is their real traffic. What you can't see yet is the traffic from all other customers that are still running the latest official Release V4.07 This is how we are counting Spamtrap hits and also False positives: All Lists are queried at every connection after RCPT TO: Spamtrap hits (Displayed in green): Every mail send to a spamtrap is counted as hit for those blocklists that reports the IP / domain as listed. False positives (Displayed in red): Every mail send to an existing recipient is counted as false positive for those blocklists that report the IP / domain as listed and the sender is in the recipients automatic or manual whitelist. Counters for the nonexisting (virtual) zone: uceprotect.combined are counted ONE only according to the description above if any of the 4 real existing dnsbl-*.uceprotect.net zones would report listed. As you can see the most accurate and effective single blocklist in our comparison is cbl.abuseat.org but even it would have rejected 14 of 8475031 HAM's last week while catching 73.3% spam. That is excellent for a single blocklist, but you can get a better result if you are using following combination of lists: Delay any incoming connection which is listed at dnsbl-0.uceprotect.net aka UCEPROTECT Level 0 with a tempfail (450) after RCPT TO. This is important because Level 0 is a delaylist, not a blocklist. Listings there will expire as soon as an Operator has moved them to UCEPROTECT Level 1 otherwise latest after 3 hours. Block if at least 2 of the following 8 lists are indicating "listed": bl.spamcop.net, cbl.abuseat.org, dnsbl-1.uceprotect.net, dnsbl-2.uceprotect.net, dnsbl-3.uceprotect.net, dnsbl.sorbs.net, ix.dnsbl.manitu.net and psbl.surriel.com. If you follow my instruction, you will end up with a system that has as good as no false positives and will block most of all spams. As always YMMV. -- Claus von Wolfhausen Technical Director UCEPROTECT-Network http://www.uceprotect.net

1 0

UCEProtect Level 3
by Raleigh Apple 08 May '09

08 May '09

Is anyone else out there aware that the UCEProtect Level 3 email blacklist blocks entire AS? r

12 11

Re: UCEProtect Level 3
by Claus v. Wolfhausen 08 May '09

08 May '09

Why do you believe people which are using Level 3 are not aware what it is doing? We have given a very detailed description how it works and also recommendations how to use it. See: http://www.uceprotect.net/en/index.php?m=3&s=5 Additionaly we are writing BIG FAT warnings also into the downloadable zonefile See: http://wget-mirrors.uceprotect.net/rbldnsd-all/dnsbl-3.uceprotect.net gz As you can see we don't make a secret out of what it is: A boycottlist. Therefore we have to assume that those which are using it for blocking do exactly know what they are doing. It clearly depends on where you are and where you expect mail from, if you can or cannot use it for blocking.According to Al Iverson's stats (which didn't get updated since summer 2008) it looks like it is not doing so much false positives if used in North America.See: http://stats.dnsbl.com/uce3 html If used in Germany, Austria or Switzerland it even looks better: See our stats: http://stats.uceprotect.net/week.html Of course it will almost always be necessary to use a whitelist in combination with ASN-Blocking. YMMV Claus von Wolfhausen UCEPROTECT-Network -----Original Message----- From: Raleigh Apple [mailto:rapple at rapidlink.com] Sent: Thursday, May 07, 2009 1:34 PM To: nanog at nanog.org Subject: UCEProtect Level 3 Is anyone else out there aware that the UCEProtect Level 3 email blacklist blocks entire AS? r

4 3