May 2012 - Test - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 11 May '12

11 May '12

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 12 May, 2012 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 407563 Prefixes after maximum aggregation: 173478 Deaggregation factor: 2.35 Unique aggregates announced to Internet: 199037 Total ASes present in the Internet Routing Table: 40961 Prefixes per ASN: 9.95 Origin-only ASes present in the Internet Routing Table: 33155 Origin ASes announcing only one prefix: 15644 Transit ASes present in the Internet Routing Table: 5484 Transit-only ASes present in the Internet Routing Table: 137 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 64 Max AS path prepend of ASN ( 9902) 56 Prefixes from unregistered ASNs in the Routing Table: 374 Unregistered ASNs in the Routing Table: 130 Number of 32-bit ASNs allocated by the RIRs: 2687 Number of 32-bit ASNs visible in the Routing Table: 2322 Prefixes from 32-bit ASNs in the Routing Table: 5860 Special use prefixes present in the Routing Table: 2 Prefixes being announced from unallocated address space: 108 Number of addresses announced to Internet: 2547853104 Equivalent to 151 /8s, 221 /16s and 39 /24s Percentage of available address space announced: 68.7 Percentage of allocated address space announced: 68.8 Percentage of available address space allocated: 99.9 Percentage of address space in use by end-sites: 92.6 Total number of prefixes smaller than registry allocations: 173961 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 100290 Total APNIC prefixes after maximum aggregation: 32360 APNIC Deaggregation factor: 3.10 Prefixes being announced from the APNIC address blocks: 96740 Unique aggregates announced from the APNIC address blocks: 39871 APNIC Region origin ASes present in the Internet Routing Table: 4683 APNIC Prefixes per ASN: 20.66 APNIC Region origin ASes announcing only one prefix: 1234 APNIC Region transit ASes present in the Internet Routing Table: 729 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 20 Number of APNIC region 32-bit ASNs visible in the Routing Table: 203 Number of APNIC addresses announced to Internet: 644595328 Equivalent to 38 /8s, 107 /16s and 190 /24s Percentage of available APNIC address space announced: 81.7 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 131072-132095, 132096-133119 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 150584 Total ARIN prefixes after maximum aggregation: 76455 ARIN Deaggregation factor: 1.97 Prefixes being announced from the ARIN address blocks: 121585 Unique aggregates announced from the ARIN address blocks: 50780 ARIN Region origin ASes present in the Internet Routing Table: 15088 ARIN Prefixes per ASN: 8.06 ARIN Region origin ASes announcing only one prefix: 5739 ARIN Region transit ASes present in the Internet Routing Table: 1596 Average ARIN Region AS path length visible: 4.0 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 17 Number of ARIN addresses announced to Internet: 812031680 Equivalent to 48 /8s, 102 /16s and 158 /24s Percentage of available ARIN address space announced: 64.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 100227 Total RIPE prefixes after maximum aggregation: 54165 RIPE Deaggregation factor: 1.85 Prefixes being announced from the RIPE address blocks: 92408 Unique aggregates announced from the RIPE address blocks: 58733 RIPE Region origin ASes present in the Internet Routing Table: 16564 RIPE Prefixes per ASN: 5.58 RIPE Region origin ASes announcing only one prefix: 8064 RIPE Region transit ASes present in the Internet Routing Table: 2649 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 1551 Number of RIPE addresses announced to Internet: 512885448 Equivalent to 30 /8s, 146 /16s and 2 /24s Percentage of available RIPE address space announced: 82.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 196608-198655 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 176/8, 178/8, 185/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 41419 Total LACNIC prefixes after maximum aggregation: 8278 LACNIC Deaggregation factor: 5.00 Prefixes being announced from the LACNIC address blocks: 41394 Unique aggregates announced from the LACNIC address blocks: 20500 LACNIC Region origin ASes present in the Internet Routing Table: 1598 LACNIC Prefixes per ASN: 25.90 LACNIC Region origin ASes announcing only one prefix: 441 LACNIC Region transit ASes present in the Internet Routing Table: 300 Average LACNIC Region AS path length visible: 4.5 Max LACNIC Region AS path length visible: 21 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 546 Number of LACNIC addresses announced to Internet: 100238984 Equivalent to 5 /8s, 249 /16s and 134 /24s Percentage of available LACNIC address space announced: 66.4 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 262144-263167 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 8993 Total AfriNIC prefixes after maximum aggregation: 2154 AfriNIC Deaggregation factor: 4.18 Prefixes being announced from the AfriNIC address blocks: 7041 Unique aggregates announced from the AfriNIC address blocks: 2219 AfriNIC Region origin ASes present in the Internet Routing Table: 532 AfriNIC Prefixes per ASN: 13.23 AfriNIC Region origin ASes announcing only one prefix: 166 AfriNIC Region transit ASes present in the Internet Routing Table: 122 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 25 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 5 Number of AfriNIC addresses announced to Internet: 31782656 Equivalent to 1 /8s, 228 /16s and 247 /24s Percentage of available AfriNIC address space announced: 47.4 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2540 11114 1040 Korea Telecom (KIX) 17974 1869 510 73 PT TELEKOMUNIKASI INDONESIA 7545 1678 301 85 TPG Internet Pty Ltd 4755 1593 388 162 TATA Communications formerly 9829 1283 1069 30 BSNL National Internet Backbo 7552 1164 1062 11 Vietel Corporation 9583 1156 86 500 Sify Limited 4808 1104 2049 315 CNCGROUP IP network: China169 24560 1027 385 167 Bharti Airtel Ltd., Telemedia 9498 965 291 64 BHARTI Airtel Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3415 3807 193 bellsouth.net, inc. 7029 3376 986 159 Windstream Communications Inc 18566 2093 382 179 Covad Communications 1785 1903 681 131 PaeTec Communications, Inc. 20115 1638 1566 620 Charter Communications 4323 1606 1044 383 Time Warner Telecom 22773 1597 2911 115 Cox Communications, Inc. 30036 1407 262 752 Mediacom Communications Corp 7018 1251 10038 820 AT&T WorldNet Services 11492 1186 216 364 Cable One Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1728 544 16 Corbina telecom 34984 693 188 172 BILISIM TELEKOM 31148 685 37 9 FreeNet ISP 12479 679 671 69 Uni2 Autonomous System 20940 657 216 511 Akamai Technologies European 6830 656 2215 426 UPC Distribution Services 8551 573 360 80 Bezeq International 3320 485 8442 401 Deutsche Telekom AG 3292 473 2108 407 TDC Tele Danmark 8866 436 134 27 Bulgarian Telecommunication C Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 1869 334 175 TVCABLE BOGOTA 28573 1849 1137 58 NET Servicos de Comunicao S.A 6503 1524 418 66 AVANTEL, S.A. 8151 1480 3003 342 UniNet S.A. de C.V. 7303 1371 837 188 Telecom Argentina Stet-France 26615 903 761 33 Tim Brasil S.A. 27947 693 74 98 Telconet S.A 11172 642 91 73 Servicios Alestra S.A de C.V 22047 582 326 15 VTR PUNTO NET S.A. 3816 576 243 98 Empresa Nacional de Telecomun Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1307 958 13 TEDATA 24863 845 274 35 LINKdotNET AS number 6713 496 649 18 Itissalat Al-MAGHRIB 3741 263 921 223 The Internet Solution 12258 197 28 62 Vodacom Internet Company 33776 197 12 21 Starcomms Nigeria Limited 24835 179 80 8 RAYA Telecom - Egypt 16637 170 666 83 MTN Network Solutions 15706 169 32 6 Sudatel Internet Exchange Aut 29571 158 15 16 Ci Telecom Autonomous system Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3415 3807 193 bellsouth.net, inc. 7029 3376 986 159 Windstream Communications Inc 4766 2540 11114 1040 Korea Telecom (KIX) 18566 2093 382 179 Covad Communications 1785 1903 681 131 PaeTec Communications, Inc. 10620 1869 334 175 TVCABLE BOGOTA 17974 1869 510 73 PT TELEKOMUNIKASI INDONESIA 28573 1849 1137 58 NET Servicos de Comunicao S.A 8402 1728 544 16 Corbina telecom 7545 1678 301 85 TPG Internet Pty Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 7029 3376 3217 Windstream Communications Inc 18566 2093 1914 Covad Communications 17974 1869 1796 PT TELEKOMUNIKASI INDONESIA 28573 1849 1791 NET Servicos de Comunicao S.A 1785 1903 1772 PaeTec Communications, Inc. 8402 1728 1712 Corbina telecom 10620 1869 1694 TVCABLE BOGOTA 7545 1678 1593 TPG Internet Pty Ltd 4766 2540 1500 Korea Telecom (KIX) 22773 1597 1482 Cox Communications, Inc. Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 4323 Time Warner Telecom 32567 UNALLOCATED 12.25.107.0/24 4323 Time Warner Telecom 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic 13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic 23502 UNALLOCATED 12.44.44.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.103.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.110.0/24 701 UUNET Technologies, 16476 UNALLOCATED 12.46.27.0/24 7018 AT&T WorldNet Servic 32873 UNALLOCATED 12.46.100.0/23 10912 InterNAP Network Ser Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 128.0.0.0/21 12654 RIPE NCC RIS Project 128.0.24.0/24 12654 RIPE NCC RIS Project Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 5.32.168.0/21 15836 ARAX Autonomous System 14.192.0.0/22 45464 Room 201, TGU Bldg 14.192.4.0/22 45464 Room 201, TGU Bldg 14.192.8.0/22 45464 Room 201, TGU Bldg 14.192.12.0/22 45464 Room 201, TGU Bldg 14.192.16.0/22 45464 Room 201, TGU Bldg 14.192.20.0/22 45464 Room 201, TGU Bldg 14.192.24.0/22 45464 Room 201, TGU Bldg 14.192.28.0/22 45464 Room 201, TGU Bldg 27.112.114.0/24 23884 Proimage Engineering and Comm Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:12 /10:29 /11:81 /12:235 /13:460 /14:831 /15:1496 /16:12241 /17:6253 /18:10573 /19:20706 /20:29319 /21:30533 /22:39962 /23:38226 /24:212903 /25:1197 /26:1433 /27:787 /28:164 /29:66 /30:17 /31:0 /32:20 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 7029 3033 3376 Windstream Communications Inc 6389 2134 3415 bellsouth.net, inc. 18566 2042 2093 Covad Communications 10620 1715 1869 TVCABLE BOGOTA 8402 1706 1728 Corbina telecom 30036 1348 1407 Mediacom Communications Corp 6503 1282 1524 AVANTEL, S.A. 11492 1149 1186 Cable One 8452 1108 1307 TEDATA 7011 1069 1184 Citizens Utilities Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:543 2:704 4:14 5:2 6:3 8:411 12:2001 13:1 14:610 15:12 16:3 17:5 20:23 23:166 24:1769 27:1298 31:953 32:57 33:2 34:2 36:8 37:440 38:808 40:120 41:3115 42:136 44:3 46:1417 47:3 49:402 50:546 52:13 54:10 55:13 56:3 57:32 58:961 59:509 60:255 61:1280 62:986 63:2056 64:4181 65:2241 66:4468 67:2019 68:1166 69:3209 70:905 71:484 72:1818 74:2592 75:492 76:319 77:948 78:985 79:489 80:1215 81:909 82:667 83:554 84:487 85:1224 86:438 87:918 88:334 89:1694 90:292 91:4810 92:539 93:1469 94:1519 95:903 96:369 97:316 98:873 99:38 100:7 101:186 103:1059 106:103 107:187 108:284 109:1337 110:769 111:915 112:409 113:605 114:631 115:898 116:938 117:715 118:911 119:1236 120:352 121:805 122:1668 123:1102 124:1382 125:1246 128:561 129:197 130:252 131:629 132:179 133:22 134:247 135:62 136:214 137:178 138:334 139:183 140:493 141:243 142:413 143:432 144:526 145:70 146:497 147:282 148:772 149:306 150:157 151:176 152:466 153:172 154:12 155:400 156:219 157:381 158:179 159:545 160:338 161:260 162:347 163:191 164:588 165:386 166:572 167:467 168:859 169:126 170:770 171:131 172:2 173:1738 174:583 175:432 176:696 177:735 178:1361 180:1208 181:82 182:974 183:290 184:486 185:1 186:2282 187:1074 188:1264 189:1791 190:5572 192:6002 193:5288 194:3807 195:3217 196:1283 197:135 198:3640 199:4605 200:5855 201:1936 202:8565 203:8595 204:4327 205:2526 206:2763 207:2798 208:4078 209:3616 210:2752 211:1489 212:2026 213:1935 214:851 215:103 216:5104 217:1546 218:544 219:338 220:1231 221:558 222:322 223:339 End of report

1 0

eircom.net contact
by Christopher Singhaus 11 May '12

11 May '12

Not sure if this is the right list to send this out to, but I figured I'd give it a try. I'm looking for anyone with a contact at Eircom.net. Customers on their network are continually trying to brute force RDP machines on our network. Fail2ban does automatically null route them and send them an email, however all I get is a rfc-ignorant auto reply stating to fill out a form on their website. In fact, they have been listed as rfc ignorant since 2006. http://www.rfc-ignorant.org/tools/detail.php?domain=eircom.net&submitted=11… I've also sent emails to noc(a)eircom.net but received no reply whatsoever. Just looking for a human to talk to at this point or any other advice. -- Christopher Singhaus, Systems Administrator / Abuse Dept HopOne Internet Corp. - AS 14361 - www.hopone.net "Yesterday's weirdness is tomorrow's reason why." -Hunter S Thompson

5 6

VPN over satellite
by Rens 10 May '12

10 May '12

Dear, Could anybody recommend any hardware that can build a VPN that works well over satellite connections? (TCP enhancements) I want to setup a L3 VPN between 2 satellite connections Even additionally if that hardware would also support WAN bonding even better because I also have a scenario to connect 2 times 2 satellites to have more capacity for my L3 VPN Regards, Rens

8 8

Question about peering
by Anurag Bhatia 10 May '12

10 May '12

Hello everyone I am curious to know how small ISPs plan peering with other interested parties. E.g if ISP A is connected to ISP C via big backbone ISP B, and say A and C both have open peering policy and assuming the exist in same exchange or nearby. Now at this point is there is any "minimum bandwidth" considerations? Say if A and C have 1Gbps + of flowing traffic - very likely peering would be good idea to save transit costs to B. But if A and C have very low levels - does it still makes sense? Does peering costs anything if ISPs are in same exchange? Does at low traffic level it makes more sense to keep on reaching other ISPs via big transit provider? Thanks. -- Anurag Bhatia anuragbhatia.com or simply - http://[2001:470:26:78f::5] if you are on IPv6 connected network! Twitter: @anurag_bhatia <https://twitter.com/#!/anurag_bhatia> Linkedin: http://linkedin.anuragbhatia.com

10 13

Re: Looking for W7 whois freeware
by Hank Nussbacher 10 May '12

10 May '12

At 12:54 10/05/2012 +0530, Suresh Ramasubramanian wrote: >Did you try this one Hank? > >http://www.mcafee.com/us/downloads/free-tools/trout.aspx That is not a whois client. Doesn't come close to what I need. Thanks anyway. -Hank >On Thu, May 10, 2012 at 12:19 PM, Hank Nussbacher <hank(a)efes.iucc.ac.il> >wrote: > > I am looking for a Window 7 GUI utility that does raw whois - not the > > standard domain lookup, but rather allows me to specify and change the > whois > > server I am talking to and allows me to customize the whois search string > > for IPs or ASNs or anything else a whois server will accept, like: > > "-B -G as378". > > > > I know of ezwhois but am looking for something better (for example - they > > don't have whois.ripe.net listed - one can add it but not save it). > > > > Thanks, > > Hank > > > > > >-- >Suresh Ramasubramanian (ops.lists(a)gmail.com)

2 1

ICMP Redirects from residential customer subnets?
by ML 09 May '12

09 May '12

Last night I was troubleshooting a strange issue where Apple products (So far just MacOS and Airports) were losing internet connectivity sporadically. Originally I thought it was an IPv6 transition technology causing the problem but the customer couldn't even ping their default GW via v4. To rule out the customer mistyping/giving us wrong information on what they were seeing I attempted to verify IP connectivity from my DHCP server to them. I pinged the IP they had retrieved via DHCP earlier. What I got back were ICMP redirects interspersed with echo replies from the customer I was pinging. The redirects were of the form: "Redirect Host(New nexthop: x.y.z.23)" The nexthop being an IP of the customer I was troubleshooting. Thinking that was very odd I setup an ACL on the vlan serving that subnet to log ICMP redirects. What I found was one IP x.y.z.56 sending redirects to IPs on my network as well as several IPs outside my network. As far as I know there is no legitimate reason for a residential PC or home gateway to send ICMP redirects. There were also a few dozen other IPs on that subnet sending ICMP redirects. A majority of them had 68:7f:74 (Cisco-Linksys) OUIs. There were also some Belkins and one ASUStek OUIs. The 68:7f:74 source MACs were dispersed amongst many customers not all from the same customer. Which leads me to believe there is either a bugged Linksys firmware or an exploited Linksys home gateway causing trouble. Has anyone ever seen something like this before? Is there any reason to see ICMP redirects on a single homed residential subnet? I'm considering adding ICMP redirects to my customer edge ACL unless there is a legitimate purpose for these packets. Thanks -ML

4 3

Manhole fire, Pittsburgh PA
by Justin M. Streiner 09 May '12

09 May '12

There was a manhole/electrical vault fire this morning in Pittsburgh on Fifth Ave in the Oakland area. Numerous telcos/dark fiber providers affected (Level3, Verizon, DQE Communications, Fibertech Networks, possibly others). Initial outage accurred at about 03:15 EDT today. Current restoration estimate is 15:00-16:00 EDT today. jms

1 0

Operation Ghost Click
by Jeroen van Aart 09 May '12

09 May '12

Excuse the horrible subject :-) Anyone have anything insightful to say about it? Is it just lots of fuss about nothing or is it an actual substantial problem? http://www.fbi.gov/news/stories/2011/november/malware_110911 "Update on March 12, 2012: To assist victims affected by the DNSChanger malicious software, the FBI obtained a court order authorizing the Internet Systems Consortium (ISC) to deploy and maintain temporary clean DNS servers. This solution is temporary, providing additional time for victims to clean affected computers and restore their normal DNS settings. The clean DNS servers will be turned off on July 9, 2012, and computers still impacted by DNSChanger may lose Internet connectivity at that time." -- Earthquake Magnitude: 5.5 Date: Thursday, April 26, 2012 19:21:45 UTC Location: off the west coast of northern Sumatra Latitude: 2.6946; Longitude: 94.5307 Depth: 26.00 km

42 93

Network Solutions IPv6 DNS Admin needed
by Jeff Fisher 09 May '12

09 May '12

Hi, I've been sending e-mails to IPV6Req(a)networksolutions.com; however, it's been months now and my IPv6 glue records have not been changed. If anyone knows somebody at Network Solutions who can help, please send me an off-list reply. Thanks, Jeff

1 0

Anyone have a layman's guide to writing an rwhois daemon?
by Landon Stewart 08 May '12

08 May '12

Hi All, I just wrote a perl daemon that seems to be a working rwhois server but the RFC is quite difficult to read for me. When talking about the protocol it mentions a bunch of requirements and describes them quite strangely (see rfc2167 section 3.1.9). Is there a layman's guide around somewhere or can anyone lend some advice here? Is what I wrote acting like a real rwhois server - at least partially? $ whois -h sirt.hopone.net -p rwhois 66.235.162.21 %rwhois V-1.5:00ffff:00 rwhois.hopone.net (HopOne Internet Corp) servername:sls-cf7p17 domain:rac13a.com ipaddress:66.235.162.21 ipaddress:66.235.166.15 ipaddress:66.235.179.110 abusename:Abuse Department abusephone:206-438-5909 abusemail:abuse@hopone.net %ok (If you try running the command above it may or may not be running and may not succeed) If anyone knows where to get an rwhois daemon that has hooks for looking up the data in an external database (not a .cdb database or flat file) I'd appreciate it a great deal. I won't want to waste too much time on this if I can help it but I want a functioning rwhois server. Our rwhoisd at rwhois.hopone.net has been broken for a while and for the life of me I cannot figure out what's wrong with the data formatting it's using. I attempted to join the mailing list for ISC's rwhoisd daemon but it's dead (no volume on the list). -- Landon Stewart <LStewart(a)Superb.Net> Sr. Administrator Systems Engineering Superb Internet Corp - 888-354-6128 x 4199 Web hosting and more "Ahead of the Rest": http://www.superbhosting.net

2 2