November 2013 - Test - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 15 Nov '13

15 Nov '13

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 16 Nov, 2013 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 472903 Prefixes after maximum aggregation: 189382 Deaggregation factor: 2.50 Unique aggregates announced to Internet: 234611 Total ASes present in the Internet Routing Table: 45459 Prefixes per ASN: 10.40 Origin-only ASes present in the Internet Routing Table: 35351 Origin ASes announcing only one prefix: 16281 Transit ASes present in the Internet Routing Table: 5951 Transit-only ASes present in the Internet Routing Table: 164 Average AS path length visible in the Internet Routing Table: 4.6 Max AS path length visible: 35 Max AS path prepend of ASN ( 55644) 31 Prefixes from unregistered ASNs in the Routing Table: 2046 Unregistered ASNs in the Routing Table: 428 Number of 32-bit ASNs allocated by the RIRs: 5358 Number of 32-bit ASNs visible in the Routing Table: 4157 Prefixes from 32-bit ASNs in the Routing Table: 13071 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 1082 Number of addresses announced to Internet: 2655478552 Equivalent to 158 /8s, 71 /16s and 99 /24s Percentage of available address space announced: 71.7 Percentage of allocated address space announced: 71.7 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 95.2 Total number of prefixes smaller than registry allocations: 165126 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 111822 Total APNIC prefixes after maximum aggregation: 33900 APNIC Deaggregation factor: 3.30 Prefixes being announced from the APNIC address blocks: 114037 Unique aggregates announced from the APNIC address blocks: 47694 APNIC Region origin ASes present in the Internet Routing Table: 4878 APNIC Prefixes per ASN: 23.38 APNIC Region origin ASes announcing only one prefix: 1220 APNIC Region transit ASes present in the Internet Routing Table: 833 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 35 Number of APNIC region 32-bit ASNs visible in the Routing Table: 742 Number of APNIC addresses announced to Internet: 730096320 Equivalent to 43 /8s, 132 /16s and 98 /24s Percentage of available APNIC address space announced: 85.3 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-63999, 131072-133631 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 163112 Total ARIN prefixes after maximum aggregation: 81716 ARIN Deaggregation factor: 2.00 Prefixes being announced from the ARIN address blocks: 163887 Unique aggregates announced from the ARIN address blocks: 76079 ARIN Region origin ASes present in the Internet Routing Table: 15916 ARIN Prefixes per ASN: 10.30 ARIN Region origin ASes announcing only one prefix: 6004 ARIN Region transit ASes present in the Internet Routing Table: 1662 Average ARIN Region AS path length visible: 4.1 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 35 Number of ARIN addresses announced to Internet: 1073593728 Equivalent to 63 /8s, 253 /16s and 189 /24s Percentage of available ARIN address space announced: 56.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 119356 Total RIPE prefixes after maximum aggregation: 61017 RIPE Deaggregation factor: 1.96 Prefixes being announced from the RIPE address blocks: 123088 Unique aggregates announced from the RIPE address blocks: 78871 RIPE Region origin ASes present in the Internet Routing Table: 17517 RIPE Prefixes per ASN: 7.03 RIPE Region origin ASes announcing only one prefix: 8304 RIPE Region transit ASes present in the Internet Routing Table: 2836 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 2480 Number of RIPE addresses announced to Internet: 656752868 Equivalent to 39 /8s, 37 /16s and 64 /24s Percentage of available RIPE address space announced: 95.5 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-200191 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 53151 Total LACNIC prefixes after maximum aggregation: 9998 LACNIC Deaggregation factor: 5.32 Prefixes being announced from the LACNIC address blocks: 58393 Unique aggregates announced from the LACNIC address blocks: 27055 LACNIC Region origin ASes present in the Internet Routing Table: 2040 LACNIC Prefixes per ASN: 28.62 LACNIC Region origin ASes announcing only one prefix: 551 LACNIC Region transit ASes present in the Internet Routing Table: 396 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 35 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 894 Number of LACNIC addresses announced to Internet: 143157748 Equivalent to 8 /8s, 136 /16s and 105 /24s Percentage of available LACNIC address space announced: 85.3 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 262144-263679 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 11783 Total AfriNIC prefixes after maximum aggregation: 2598 AfriNIC Deaggregation factor: 4.54 Prefixes being announced from the AfriNIC address blocks: 12416 Unique aggregates announced from the AfriNIC address blocks: 4043 AfriNIC Region origin ASes present in the Internet Routing Table: 682 AfriNIC Prefixes per ASN: 18.21 AfriNIC Region origin ASes announcing only one prefix: 202 AfriNIC Region transit ASes present in the Internet Routing Table: 138 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 6 Number of AfriNIC addresses announced to Internet: 48082176 Equivalent to 2 /8s, 221 /16s and 173 /24s Percentage of available AfriNIC address space announced: 47.8 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2931 11557 943 Korea Telecom (KIX) 17974 2713 902 88 PT TELEKOMUNIKASI INDONESIA 7545 2108 319 110 TPG Internet Pty Ltd 4755 1789 392 190 TATA Communications formerly 9829 1543 1245 45 BSNL National Internet Backbo 9583 1242 94 508 Sify Limited 9498 1215 309 74 BHARTI Airtel Ltd. 7552 1165 1080 13 Vietel Corporation 4808 1146 2124 339 CNCGROUP IP network: China169 24560 1096 380 163 Bharti Airtel Ltd., Telemedia Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3051 3688 55 BellSouth.net Inc. 22773 2198 2939 138 Cox Communications, Inc. 18566 2057 379 178 MegaPath Corporation 1785 2039 685 130 PaeTec Communications, Inc. 20115 1682 1654 607 Charter Communications 4323 1636 1098 417 Time Warner Telecom 701 1507 11146 783 MCI Communications Services, 30036 1382 311 583 Mediacom Communications Corp 7018 1332 17778 871 AT&T WorldNet Services 6983 1293 755 578 ITC^Deltacom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1959 544 17 OJSC "Vimpelcom" 34984 1363 244 223 TELLCOM ILETISIM HIZMETLERI A 20940 1125 417 854 Akamai Technologies European 31148 1005 45 19 FreeNet ISP 13188 895 99 48 TOV "Bank-Inform" 6849 861 356 30 JSC UKRTELECOM, 8551 787 370 41 Bezeq International 6830 774 2328 426 UPC Distribution Services 12479 680 798 55 Uni2 Autonomous System 35228 547 246 16 Avatar Broadband Limited Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3423 1793 87 NET Servicos de Comunicao S.A 10620 2666 432 219 Telmex Colombia S.A. 7303 1728 1150 231 Telecom Argentina Stet-France 18881 1621 908 20 Global Village Telecom 8151 1362 2853 414 UniNet S.A. de C.V. 11830 866 364 15 Instituto Costarricense de El 27947 846 93 90 Telconet S.A 6147 813 373 27 Telefonica Del Peru 6503 793 434 62 AVANTEL, S.A. 7738 780 1498 36 Telecomunicacoes da Bahia S.A Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 36998 1864 112 5 Sudanese Mobile Telephone (ZA 24863 887 338 26 LINKdotNET AS number 6713 554 633 26 Itissalat Al-MAGHRIB 8452 418 956 9 TEDATA 24835 297 144 9 RAYA Telecom - Egypt 3741 256 921 214 The Internet Solution 36992 229 501 29 Etisalat MISR 29571 224 17 12 Ci Telecom Autonomous system 15706 221 32 6 Sudatel Internet Exchange Aut 29975 192 668 21 Vodacom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3423 1793 87 NET Servicos de Comunicao S.A 6389 3051 3688 55 BellSouth.net Inc. 4766 2931 11557 943 Korea Telecom (KIX) 17974 2713 902 88 PT TELEKOMUNIKASI INDONESIA 10620 2666 432 219 Telmex Colombia S.A. 22773 2198 2939 138 Cox Communications, Inc. 7545 2108 319 110 TPG Internet Pty Ltd 18566 2057 379 178 MegaPath Corporation 1785 2039 685 130 PaeTec Communications, Inc. 8402 1959 544 17 OJSC "Vimpelcom" Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6389 3051 2996 BellSouth.net Inc. 17974 2713 2625 PT TELEKOMUNIKASI INDONESIA 10620 2666 2447 Telmex Colombia S.A. 22773 2198 2060 Cox Communications, Inc. 7545 2108 1998 TPG Internet Pty Ltd 4766 2931 1988 Korea Telecom (KIX) 8402 1959 1942 OJSC "Vimpelcom" 1785 2039 1909 PaeTec Communications, Inc. 18566 2057 1879 MegaPath Corporation 36998 1864 1859 Sudanese Mobile Telephone (ZA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 62828 UNALLOCATED 8.21.130.0/24 4323 Time Warner Telecom 62850 UNALLOCATED 8.25.147.0/24 3356 Level 3 Communicatio 62734 UNALLOCATED 8.31.128.0/24 6939 Hurricane Electric 62773 UNALLOCATED 8.35.180.0/22 3356 Level 3 Communicatio 65160 PRIVATE 12.1.58.0/24 17361 Sungard Trading Syst 65160 PRIVATE 12.1.59.0/24 17361 Sungard Trading Syst 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 62719 UNALLOCATED 12.27.130.0/24 4323 Time Warner Telecom 62861 UNALLOCATED 12.37.197.0/24 7018 AT&T WorldNet Servic 13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 100.100.0.0/24 4847 China Networks Inter-Exchange Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.90.128.0/18 27418 OUTOFWALL INC. 23.91.0.0/19 40676 Psychz Networks 23.91.4.0/24 40676 Psychz Networks 23.91.14.0/24 40676 Psychz Networks 23.91.32.0/19 36315 Servpac Inc. 23.91.80.0/20 21560 Capital Technology Services G 23.91.96.0/20 37958 ChinaCache Networks ASN 23.91.112.0/21 32475 MidPhase Inc. 23.91.160.0/19 36493 3757277 Canada Inc. (oa 295.c 23.91.160.0/22 36493 3757277 Canada Inc. (oa 295.c Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:11 /10:31 /11:92 /12:254 /13:474 /14:922 /15:1628 /16:12833 /17:6760 /18:11334 /19:23102 /20:32903 /21:35605 /22:50000 /23:43850 /24:250577 /25:875 /26:997 /27:472 /28:51 /29:81 /30:21 /31:0 /32:14 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 2011 2057 MegaPath Corporation 36998 1829 1864 Sudanese Mobile Telephone (ZA 6389 1705 3051 BellSouth.net Inc. 8402 1622 1959 OJSC "Vimpelcom" 22773 1457 2198 Cox Communications, Inc. 30036 1228 1382 Mediacom Communications Corp 11492 1193 1231 Cable One 1785 1086 2039 PaeTec Communications, Inc. 6983 1034 1293 ITC^Deltacom 22561 965 1242 Digital Teleport, Inc Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:899 2:842 3:3 4:17 5:1025 6:21 8:620 12:1883 13:3 14:891 15:11 16:3 17:17 18:19 20:21 23:560 24:1746 27:1643 31:1445 32:44 33:2 34:5 36:86 37:1923 38:919 39:5 40:182 41:3265 42:274 44:14 46:2032 47:10 49:689 50:846 52:12 54:43 55:7 56:4 57:26 58:1166 59:574 60:378 61:1468 62:1242 63:1979 64:4330 65:2344 66:4148 67:2118 68:1109 69:3299 70:875 71:489 72:2043 74:2563 75:326 76:307 77:1156 78:1077 79:673 80:1300 81:1039 82:646 83:660 84:591 85:1257 86:383 87:1027 88:557 89:1557 90:150 91:5657 92:622 93:1610 94:2066 95:1631 96:512 97:350 98:1039 99:41 100:32 101:643 103:3616 105:527 106:140 107:217 108:536 109:1948 110:972 111:1114 112:595 113:808 114:748 115:1052 116:1013 117:823 118:1179 119:1279 120:336 121:751 122:1859 123:1265 124:1398 125:1429 128:680 129:229 130:332 131:660 132:365 133:158 134:558 135:72 136:283 137:249 138:351 139:176 140:198 141:331 142:545 143:416 144:502 145:90 146:530 147:409 148:782 149:368 150:139 151:653 152:411 153:205 154:53 155:497 156:294 157:421 158:280 159:782 160:361 161:458 162:857 163:223 164:636 165:588 166:260 167:634 168:1044 169:125 170:1119 171:185 172:27 173:1589 174:696 175:526 176:1309 177:2476 178:1975 179:302 180:1591 181:865 182:1376 183:466 184:658 185:1024 186:2610 187:1467 188:1877 189:1265 190:7307 192:7055 193:5426 194:4037 195:3363 196:1342 197:1039 198:4760 199:5489 200:6070 201:2521 202:8982 203:8884 204:4534 205:2651 206:2837 207:2830 208:4002 209:3653 210:3038 211:1568 212:2159 213:1976 214:906 215:91 216:5421 217:1693 218:627 219:323 220:1278 221:578 222:326 223:507 End of report

1 0

Network anomaly research - survey
by Jan Rejchrt 15 Nov '13

15 Nov '13

Dear network experts, We would like to kindly ask you to devote a few minutes of your time to filling out our short survey. Your professional opinion will help to develop better anomaly detection tools. We are trying to learn how the term "network anomaly" is understood by experts and network administrators. Our findings will then be made available to the network monitoring community and posted to this mailing list. The survey is available via the following link till end of this year. https://security.ics.muni.cz/anomaly_survey/ Thank you for your time and best regards, Jan Rejchrt On behalf of CSIRT-MU -- Mgr. Jan Rejchrt rejchrt(a)ics.muni.cz Security Department, CSIRT-MU group http://csirt.muni.cz Institute of Computer Science, Masaryk University, Brno, Czech Republic PGP Key ID: 0x9B5724C8

1 0

Re: Automatic abuse reports
by Hal Murray 13 Nov '13

13 Nov '13

William Herrin <bill(a)herrin.us> said: > That's the main problem: you can generate the report but if it's about > some doofus in Dubai what are the odds of it doing any good? It's much worse than that. Several 500 pound gorillas expect you to jump through various hoops to report abuse. Have you tried reporting a drop box to Yahoo or Google lately? On top of that, many outfits big enough to own a CIDR block are outsourcing their mail to Google. Google has a good spam filter. It's good enough to reject spam reports to abuse@<hosted-by-google> I wonder what would happen if RIRs required working abuse mailboxes. There are two levels of "working". The first is doesn't bounce or get rejected with a sensible reason. The second is actually gets acted upon. If you were magically appointed big-shot in charge of everything, how long would you let an ISP host a spammer's web site or DNS server or ...? What about retail ISPs with zillions of zombied systems? -- These are my opinions. I hate spam.

5 6

Recovery mode on Juniper M7i
by Anurag Bhatia 13 Nov '13

13 Nov '13

Hello everyone! Greetings of the day. I am kind of (badly) stuck with multiple routers and not able to recover the root password. It's Juniper M7i. I have followed the Juniper support page as given here - http://www.juniper.net/techpubs/en_US/junos/topics/task/configuration/authe… strange enough that it worked with one of routers I have but failed on rest all. I am getting stuck on Step #12. As I give "boot -s" to get into single user mode of BSD, system next asks me for root password and hence I am out of luck to get into "recovery mode". I tried pressing enter on that prompt as well but no luck. I am connecting to router via console and do have physical access to router(s). Was wondering if someone has seen similar issues and could guide on what I am doing wrong? Most of other help pages I have seen on net have same exact steps as given on that page. Thanks. -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com

5 6

new collector: route-views.soxrs.routeviews.org
by John Kemp 13 Nov '13

13 Nov '13

Not much there yet, but we are operational and would love to get a few more peers. Serbian Open eXchange http://www.routeviews.org/soxrs.html Thanks, -- John Kemp (kemp(a)routeviews.org) RouteViews Engineer NOC: noc(a)routeviews.org MAIL: help(a)routeviews.org WWW: http://www.routeviews.org

1 0

Automatic abuse reports
by Jonas Björklund 13 Nov '13

13 Nov '13

Hello, We got often abuse reports on hosts that has been involved in DDOS attacks. We contact the owner of the host help them fix the problem. I also would like to start send these abuse report to the ISP of the source. Are there any avaliable tools for this? Is there any plugin for nfsen? Do I need to write my own scripts for this? /Jonas

9 10

IP transit providers @ 625 RL
by A Mekkaoui 12 Nov '13

12 Nov '13

Hi, anyone knows about carrier companies which provides IP transit service and has are located in Cologix data center at 625 Rene Levesque, Montreal, Canada. Thanks in advance for your help. Karim

1 0

CPE dns hijacking malware
by Mike 12 Nov '13

12 Nov '13

Hi, It appears that some of my subscribers DSL modems (which are acting as nat routers) have had their dns settings hijacked and presumably for serving ads or some such nonsense. The dns server addresses are statically programmed in and of the onces I have seen, they are not currently responsive, leading to slow page loads or 404 errors and hence tech support calls to my support desk. I have set up a resolver that will answer dns queries and have done some routing magic to re-direct queries sent from my customer CPE's to these hijacked dns addresses. This is working for the time being and affected clients don't know about the problem (yet). I realise it's highly likely there are more than just the 2 addresses I have identified so far in the realm of dns hijackers, and so I am I am wondering if anyone has a line on dns server addresses that have been used or are currently in use for dns redirecting malware. I would like to maybe script something so that addresses on such a list would automatically get dropped into a routing table pointing at my special dns resolver. In the future I would also likely set up some sort of web redirect so that any client that queries the special resolver would get a web page explaining they have been hijacked and how to handle it. For now however I just want to stem the tide and make sure clients continue to work and to catch as many of these as I can. Anyone ? Mike-

7 9

Re: CPE dns hijacking malware
by Larry Sheldon 12 Nov '13

12 Nov '13

On 11/12/2013 3:54 PM, Larry Sheldon wrote: > On 11/12/2013 3:24 PM, Larry Sheldon wrote: >> On 11/12/2013 12:12 AM, Dobbins, Roland wrote: >>> >>> On Nov 12, 2013, at 12:56 PM, Mike <mike-nanog(a)tiedyenetworks.com> >>> wrote: >>> >>>> It appears that some of my subscribers DSL modems (which are acting >>>> as nat routers) have had their dns settings hijacked and presumably >>>> for serving ads or some such nonsense. >>> >>> How do you think this was accomplished? Via some kind of Web exploit >>> customized for those devices and targeting your user population via >>> email or social media, which tricked users into clicking on something >>> that accessed the Web admin interface via default admin credentials >>> or somsesuch; or via some direct attack on the CPE devices >>> themselves; or via some other method? >> >> I am less well informed here than in a lot of other things, so please be >> gentle. >> >> As a user of such equipment, I don't see or know of anything in the I/F >> that I have access-to that mentions DNSish stuff except the servers I am >> to use. >> >> But interestingly enough, when I tried to look at it to verify my >> belief's just no I got a certificate error that it won't let me past. >> >> That seems odd. >> > > Meant to send this to the list. > > The on-line chat to Linksys was subsatisfying, but for want of something > to do I dropped the "s" IN "https" and go on the router just fine. Makes > you wonder if I understand "certificates". > > But I do not see anything that looks like I can affect DNS beyond which > servers I use. And I don't know a way to get on Cox's "cable modem" at all. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: CPE dns hijacking malware
by Larry Sheldon 12 Nov '13

12 Nov '13

On 11/12/2013 3:24 PM, Larry Sheldon wrote: > On 11/12/2013 12:12 AM, Dobbins, Roland wrote: >> >> On Nov 12, 2013, at 12:56 PM, Mike <mike-nanog(a)tiedyenetworks.com> >> wrote: >> >>> It appears that some of my subscribers DSL modems (which are acting >>> as nat routers) have had their dns settings hijacked and presumably >>> for serving ads or some such nonsense. >> >> How do you think this was accomplished? Via some kind of Web exploit >> customized for those devices and targeting your user population via >> email or social media, which tricked users into clicking on something >> that accessed the Web admin interface via default admin credentials >> or somsesuch; or via some direct attack on the CPE devices >> themselves; or via some other method? > > I am less well informed here than in a lot of other things, so please be > gentle. > > As a user of such equipment, I don't see or know of anything in the I/F > that I have access-to that mentions DNSish stuff except the servers I am > to use. > > But interestingly enough, when I tried to look at it to verify my > belief's just no I got a certificate error that it won't let me past. > > That seems odd. > Meant to send this to the list. The on-line chat to Linksys was subsatisfying, but for want of something to do I dropped the "s" IN "https" and go on the router just fine. Makes you wonder if I understand "certificates". But I do not see anything that looks like I can affect DNS beyond which servers I use. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0