February 2012 - Test - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 10 Feb '12

10 Feb '12

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 11 Feb, 2012 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 397602 Prefixes after maximum aggregation: 169606 Deaggregation factor: 2.34 Unique aggregates announced to Internet: 192311 Total ASes present in the Internet Routing Table: 40086 Prefixes per ASN: 9.92 Origin-only ASes present in the Internet Routing Table: 32739 Origin ASes announcing only one prefix: 15528 Transit ASes present in the Internet Routing Table: 5400 Transit-only ASes present in the Internet Routing Table: 147 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 33 Max AS path prepend of ASN (48687) 24 Prefixes from unregistered ASNs in the Routing Table: 328 Unregistered ASNs in the Routing Table: 127 Number of 32-bit ASNs allocated by the RIRs: 2272 Number of 32-bit ASNs visible in the Routing Table: 1947 Prefixes from 32-bit ASNs in the Routing Table: 4674 Special use prefixes present in the Routing Table: 2 Prefixes being announced from unallocated address space: 137 Number of addresses announced to Internet: 2513929424 Equivalent to 149 /8s, 215 /16s and 132 /24s Percentage of available address space announced: 67.8 Percentage of allocated address space announced: 67.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 92.0 Total number of prefixes smaller than registry allocations: 168841 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 98087 Total APNIC prefixes after maximum aggregation: 31681 APNIC Deaggregation factor: 3.10 Prefixes being announced from the APNIC address blocks: 94410 Unique aggregates announced from the APNIC address blocks: 39147 APNIC Region origin ASes present in the Internet Routing Table: 4652 APNIC Prefixes per ASN: 20.29 APNIC Region origin ASes announcing only one prefix: 1239 APNIC Region transit ASes present in the Internet Routing Table: 737 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 20 Number of APNIC region 32-bit ASNs visible in the Routing Table: 143 Number of APNIC addresses announced to Internet: 635706656 Equivalent to 37 /8s, 228 /16s and 29 /24s Percentage of available APNIC address space announced: 80.6 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 131072-132095, 132096-133119 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 148238 Total ARIN prefixes after maximum aggregation: 75329 ARIN Deaggregation factor: 1.97 Prefixes being announced from the ARIN address blocks: 120188 Unique aggregates announced from the ARIN address blocks: 49415 ARIN Region origin ASes present in the Internet Routing Table: 14905 ARIN Prefixes per ASN: 8.06 ARIN Region origin ASes announcing only one prefix: 5689 ARIN Region transit ASes present in the Internet Routing Table: 1576 Average ARIN Region AS path length visible: 4.0 Max ARIN Region AS path length visible: 22 Number of ARIN region 32-bit ASNs visible in the Routing Table: 15 Number of ARIN addresses announced to Internet: 804413120 Equivalent to 47 /8s, 242 /16s and 94 /24s Percentage of available ARIN address space announced: 63.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 98764 Total RIPE prefixes after maximum aggregation: 52358 RIPE Deaggregation factor: 1.89 Prefixes being announced from the RIPE address blocks: 90594 Unique aggregates announced from the RIPE address blocks: 56087 RIPE Region origin ASes present in the Internet Routing Table: 16308 RIPE Prefixes per ASN: 5.56 RIPE Region origin ASes announcing only one prefix: 7997 RIPE Region transit ASes present in the Internet Routing Table: 2598 Average RIPE Region AS path length visible: 4.7 Max RIPE Region AS path length visible: 33 Number of RIPE region 32-bit ASNs visible in the Routing Table: 1344 Number of RIPE addresses announced to Internet: 500587080 Equivalent to 29 /8s, 214 /16s and 90 /24s Percentage of available RIPE address space announced: 80.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 196608-198655 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 176/8, 178/8, 185/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 38648 Total LACNIC prefixes after maximum aggregation: 8064 LACNIC Deaggregation factor: 4.79 Prefixes being announced from the LACNIC address blocks: 38261 Unique aggregates announced from the LACNIC address blocks: 19517 LACNIC Region origin ASes present in the Internet Routing Table: 1572 LACNIC Prefixes per ASN: 24.34 LACNIC Region origin ASes announcing only one prefix: 439 LACNIC Region transit ASes present in the Internet Routing Table: 290 Average LACNIC Region AS path length visible: 4.4 Max LACNIC Region AS path length visible: 24 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 441 Number of LACNIC addresses announced to Internet: 96512392 Equivalent to 5 /8s, 192 /16s and 169 /24s Percentage of available LACNIC address space announced: 63.9 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 262144-263167 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 9015 Total AfriNIC prefixes after maximum aggregation: 2096 AfriNIC Deaggregation factor: 4.30 Prefixes being announced from the AfriNIC address blocks: 7029 Unique aggregates announced from the AfriNIC address blocks: 2148 AfriNIC Region origin ASes present in the Internet Routing Table: 511 AfriNIC Prefixes per ASN: 13.76 AfriNIC Region origin ASes announcing only one prefix: 164 AfriNIC Region transit ASes present in the Internet Routing Table: 117 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 25 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 4 Number of AfriNIC addresses announced to Internet: 30893056 Equivalent to 1 /8s, 215 /16s and 100 /24s Percentage of available AfriNIC address space announced: 46.0 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2471 11101 979 Korea Telecom (KIX) 17974 1729 503 36 PT TELEKOMUNIKASI INDONESIA 7545 1642 303 85 TPG Internet Pty Ltd 4755 1532 385 156 TATA Communications formerly 7552 1393 1064 7 Vietel Corporation 9829 1172 989 28 BSNL National Internet Backbo 4808 1149 2112 314 CNCGROUP IP network: China169 9583 1124 83 482 Sify Limited 24560 1014 385 167 Bharti Airtel Ltd., Telemedia 18101 950 130 155 Reliance Infocom Ltd Internet Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3442 3807 201 bellsouth.net, inc. 7029 3391 1014 159 Windstream Communications Inc 18566 2093 382 177 Covad Communications 1785 1868 680 125 PaeTec Communications, Inc. 20115 1625 1550 631 Charter Communications 4323 1610 1062 385 Time Warner Telecom 22773 1511 2910 109 Cox Communications, Inc. 30036 1392 244 751 Mediacom Communications Corp 19262 1386 4687 396 Verizon Global Networks 7018 1307 6995 849 AT&T WorldNet Services Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1719 480 15 Corbina telecom 2118 1385 97 13 EUnet/RELCOM Autonomous Syste 15557 1095 2161 63 LDCOM NETWORKS 34984 650 188 172 BILISIM TELEKOM 6830 644 1927 413 UPC Distribution Services 20940 608 195 470 Akamai Technologies European 12479 584 642 53 Uni2 Autonomous System 31148 538 37 9 FreeNet ISP 3320 533 8450 399 Deutsche Telekom AG 8551 530 360 81 Bezeq International Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 1751 324 162 TVCABLE BOGOTA 28573 1655 1085 69 NET Servicos de Comunicao S.A 8151 1475 3003 342 UniNet S.A. de C.V. 7303 1263 758 182 Telecom Argentina Stet-France 26615 896 664 33 Tim Brasil S.A. 11172 694 95 75 Servicios Alestra S.A de C.V 27947 655 67 105 Telconet S.A 22047 581 322 17 VTR PUNTO NET S.A. 3816 551 237 91 Empresa Nacional de Telecomun 7738 550 1050 31 Telecomunicacoes da Bahia S.A Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1235 958 13 TEDATA 24863 829 155 43 LINKdotNET AS number 6713 485 649 18 Itissalat Al-MAGHRIB 3741 278 939 229 The Internet Solution 15706 238 32 6 Sudatel Internet Exchange Aut 33776 236 13 14 Starcomms Nigeria Limited 12258 197 28 62 Vodacom Internet Company 24835 193 80 8 RAYA Telecom - Egypt 29571 189 17 11 Ci Telecom Autonomous system 16637 163 664 82 MTN Network Solutions Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3442 3807 201 bellsouth.net, inc. 7029 3391 1014 159 Windstream Communications Inc 4766 2471 11101 979 Korea Telecom (KIX) 18566 2093 382 177 Covad Communications 1785 1868 680 125 PaeTec Communications, Inc. 10620 1751 324 162 TVCABLE BOGOTA 17974 1729 503 36 PT TELEKOMUNIKASI INDONESIA 8402 1719 480 15 Corbina telecom 28573 1655 1085 69 NET Servicos de Comunicao S.A 7545 1642 303 85 TPG Internet Pty Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 7029 3391 3232 Windstream Communications Inc 18566 2093 1916 Covad Communications 1785 1868 1743 PaeTec Communications, Inc. 8402 1719 1704 Corbina telecom 17974 1729 1693 PT TELEKOMUNIKASI INDONESIA 10620 1751 1589 TVCABLE BOGOTA 28573 1655 1586 NET Servicos de Comunicao S.A 7545 1642 1557 TPG Internet Pty Ltd 4766 2471 1492 Korea Telecom (KIX) 22773 1511 1402 Cox Communications, Inc. Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 4323 Time Warner Telecom 32567 UNALLOCATED 12.25.107.0/24 4323 Time Warner Telecom 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic 13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic 23502 UNALLOCATED 12.44.44.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.103.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.110.0/24 701 UUNET Technologies, 16476 UNALLOCATED 12.46.27.0/24 7018 AT&T WorldNet Servic 32873 UNALLOCATED 12.46.100.0/23 10912 InterNAP Network Ser Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 128.0.0.0/21 12654 RIPE NCC RIS Project 128.0.24.0/24 12654 RIPE NCC RIS Project Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.192.0.0/22 45464 Room 201, TGU Bldg 14.192.4.0/22 45464 Room 201, TGU Bldg 14.192.8.0/22 45464 Room 201, TGU Bldg 14.192.12.0/22 45464 Room 201, TGU Bldg 14.192.16.0/22 45464 Room 201, TGU Bldg 14.192.20.0/22 45464 Room 201, TGU Bldg 14.192.24.0/22 45464 Room 201, TGU Bldg 14.192.28.0/22 45464 Room 201, TGU Bldg 37.98.200.0/21 56687 Nimad Rah Khoozestan PLC 37.98.208.0/20 8374 Polkomtel S.A. Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:12 /10:27 /11:80 /12:231 /13:458 /14:816 /15:1469 /16:12130 /17:6197 /18:10311 /19:20471 /20:28291 /21:29233 /22:39842 /23:37018 /24:207333 /25:1195 /26:1434 /27:775 /28:169 /29:59 /30:14 /31:0 /32:18 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 7029 3047 3391 Windstream Communications Inc 6389 2112 3442 bellsouth.net, inc. 18566 2042 2093 Covad Communications 8402 1698 1719 Corbina telecom 10620 1645 1751 TVCABLE BOGOTA 30036 1351 1392 Mediacom Communications Corp 11492 1118 1155 Cable One 1785 1065 1868 PaeTec Communications, Inc. 15557 1045 1095 LDCOM NETWORKS 8452 1041 1235 TEDATA Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:505 2:689 4:14 5:1 6:3 8:385 12:1958 13:1 14:596 15:11 16:3 17:7 20:9 23:133 24:1724 27:1197 31:901 32:65 33:2 34:2 36:9 37:177 38:776 40:115 41:3174 42:93 43:1 44:3 46:1281 47:3 49:322 50:512 52:13 54:2 55:9 56:3 57:38 58:962 59:491 60:344 61:1195 62:949 63:2008 64:4130 65:2285 66:4426 67:2039 68:1174 69:3159 70:927 71:412 72:1795 74:2654 75:463 76:322 77:976 78:936 79:502 80:1228 81:881 82:569 83:529 84:582 85:1154 86:742 87:919 88:334 89:1547 90:271 91:4479 92:538 93:1328 94:1357 95:1084 96:418 97:310 98:814 99:38 100:4 101:141 103:776 106:65 107:152 108:150 109:1486 110:694 111:848 112:432 113:530 114:597 115:763 116:868 117:727 118:899 119:1254 120:361 121:683 122:1621 123:1071 124:1337 125:1369 128:542 129:189 130:212 131:589 132:164 133:21 134:231 135:60 136:216 137:153 138:286 139:145 140:488 141:262 142:385 143:411 144:520 145:70 146:484 147:242 148:728 149:274 150:165 151:196 152:447 153:170 154:7 155:403 156:211 157:368 158:156 159:515 160:322 161:244 162:341 163:187 164:529 165:391 166:556 167:457 168:762 169:147 170:832 171:111 172:2 173:1733 174:603 175:416 176:515 177:481 178:1247 180:1180 181:65 182:715 183:278 184:425 185:1 186:2050 187:842 188:1031 189:1169 190:5474 192:5970 193:5525 194:4327 195:3393 196:1299 197:181 198:3619 199:4378 200:5718 201:1736 202:8496 203:8625 204:4346 205:2440 206:2736 207:2804 208:4069 209:3566 210:2747 211:1477 212:2042 213:1847 214:864 215:96 216:5000 217:1477 218:548 219:340 220:1252 221:558 222:325 223:280 End of report

1 0

UDP port 80 DDoS attack
by Ray Gasnick III 10 Feb '12

10 Feb '12

We just saw a huge flux of traffic occur this morning that spiked one of our upstream ISPs gear and killed the layer 2 link on another becuase of a DDoS attack on UDP port 80. Wireshark shows this appears to be from a compromised game server (call of duty) with source IPs in a variety of different prefixes. Only solution thus far was to dump the victim IP address in our block into the BGP Black hole community with one of our 2 providers and completely stop advertising to the other. Anybody see this recently and have any tips on mitigation, reply on or off list. Thank You, Ray Gasnick III CISSP, Technology Specialist: Network Security & Infrastructure Miles Technologies www.milestechnologies.com<http://www.milestechnologies.com/> Phone: (856) 439-0999 x127 Direct: (856) 793-3821 How am I doing? Email my manager at itmanager(a)milestechnologies.com<mailto:itmanager@milestechnologies.com> Computer Networking – IT Support – Business Software – Website Design – Online Marketing & PR

16 46

Middlebox Report and Thank You!
by Justine Sherry 10 Feb '12

10 Feb '12

Hello NANOG! I emailed you a few months ago asking for help understanding typical middlebox deployments in enterprise networks. 57 of you responded - thank you so much! Several of you asked if I'd share the data post-study; I've put together a brief report on our findings here: http://www.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-24.pdf If you have any questions, comments, or feedback, please don't hesitate to contact me. Thanks again for your help and support for our research! Best, Justine

3 2

10G switchrecommendaton
by Deric Kwok 09 Feb '12

09 Feb '12

Hi all I would like to have 10G switchrecommendaton Ipref software can test around 9.2G but we can have congestion over 6G in single port! Thank you

26 41

Slow IN-ADDR.ARPA responses
by John Levine 09 Feb '12

09 Feb '12

I'm seeing surprisingly slow responses from some of the IN-ADDR servers, like 300ms or more. Are they being attacked by script kiddies of something? R's, John

4 5

BGP history in enterprise?
by Andrey Khomyakov 09 Feb '12

09 Feb '12

Looking for something to keep track of BGP route changes in a large enterprise. Found http://www.ibgplay.org/, but I can't seem to get in touch with them to obtain that free license needed to start the service. Does anyone know of something that would do what bgplay does or alternatively how to get in touch with the ibgplay folks for that license... Thanks, --Andrey

2 1

Firewalls in service provider environments
by Matthew Reath 09 Feb '12

09 Feb '12

All, Looking for some recommendations on firewall placement in service provider environments. I'm of the school of thought that in my SP network I do as little firewalling/packet filtering as possible. As in none, leave that to my end users or offer a "managed" firewall solution where if a customer signs up for the extra service I put him in a VRF or VLAN that is "behind" a firewall and manage that solution for them. Otherwise I don't prefer to have a firewall inline in my service provider network for all customer traffic to go through. I can accomplish filtering of known bad ports on my edge routers either facing my customers or upstream providers. What is the group's thought on this? -Matt -- Matt Reath CCIE #27316 (SP) matt(a)mattreath.com | http://mattreath.com Twitter: http://twitter.com/mpreath

13 19

report botnet C&C?
by Ryan Rawdon 09 Feb '12

09 Feb '12

Assuming it is not a futile/wasted effort, where is the current best place/resource to report an active botnet C&C to?

6 5

RoadRunner/Adelphia AS14065 contact
by chk 09 Feb '12

09 Feb '12

If there is a Roadrunner contact monitoring the list can you please contact me off list regarding a routing issue from ns1/2.adelphia.net Thanks.

3 2

2012.02.08 NANOG54 day 3 morning session notes
by Matthew Petach 08 Feb '12

08 Feb '12

I've posted my notes from this morning's session at http://kestrel3.netflight.com/2012.02.08-nanog54-morning-session.txt I wonder if perhaps we don't keep asking for NEBS compliance just because we don't have another easy acronym to put on the RFQs that represents what *our* industry needs, vs the telco industry? Thanks again for another awesome NANOG! Matt

2 1