December 2013 - Test - lists.nanog.org

The Cidr Report
by cidr-report＠potaroo.net 20 Dec '13

20 Dec '13

This report has been generated at Fri Dec 20 21:13:36 2013 AEST. The report analyses the BGP Routing Table of AS2.0 router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/2.0 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 13-12-13 485835 274502 14-12-13 486126 274562 15-12-13 486152 274400 16-12-13 486445 274456 17-12-13 486333 274429 18-12-13 486595 275312 19-12-13 486898 274827 20-12-13 486354 275172 AS Summary 45927 Number of ASes in routing system 18824 Number of ASes announcing only one prefix 4201 Largest number of prefixes announced by an AS AS7029 : WINDSTREAM - Windstream Communications Inc 118834944 Largest address span announced by an AS (/32s) AS4134 : CHINANET-BACKBONE No.31,Jin-rong Street Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 20Dec13 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 487262 275096 212166 43.5% All ASes AS28573 3429 92 3337 97.3% NET Serviços de Comunicação S.A. AS6389 3027 56 2971 98.1% BELLSOUTH-NET-BLK - BellSouth.net Inc. AS17974 2730 195 2535 92.9% TELKOMNET-AS2-AP PT Telekomunikasi Indonesia AS7029 4201 1734 2467 58.7% WINDSTREAM - Windstream Communications Inc AS4766 2946 960 1986 67.4% KIXS-AS-KR Korea Telecom AS36998 1819 6 1813 99.7% SDN-MOBITEL AS1785 2146 390 1756 81.8% AS-PAETEC-NET - PaeTec Communications, Inc. AS18881 1778 31 1747 98.3% Global Village Telecom AS10620 2691 1080 1611 59.9% Telmex Colombia S.A. AS18566 2049 565 1484 72.4% MEGAPATH5-US - MegaPath Corporation AS4323 2945 1516 1429 48.5% TWTC - tw telecom holdings, inc. AS7303 1743 466 1277 73.3% Telecom Argentina S.A. AS4755 1803 594 1209 67.1% TATACOMM-AS TATA Communications formerly VSNL is Leading ISP AS22773 2306 1143 1163 50.4% ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. AS22561 1252 225 1027 82.0% AS22561 - CenturyTel Internet Holdings, Inc. AS7552 1205 188 1017 84.4% VIETEL-AS-AP Viettel Corporation AS9829 1557 634 923 59.3% BSNL-NIB National Internet Backbone AS35908 916 88 828 90.4% VPLSNET - Krypt Technologies AS7545 2122 1307 815 38.4% TPG-INTERNET-AP TPG Telecom Limited AS18101 990 186 804 81.2% RELIANCE-COMMUNICATIONS-IN Reliance Communications Ltd.DAKC MUMBAI AS4808 1145 388 757 66.1% CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network AS701 1508 781 727 48.2% UUNET - MCI Communications Services, Inc. d/b/a Verizon Business AS8151 1380 654 726 52.6% Uninet S.A. de C.V. AS24560 1098 373 725 66.0% AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services AS6983 1295 580 715 55.2% ITCDELTA - ITC^Deltacom AS13977 855 143 712 83.3% CTELCO - FAIRPOINT COMMUNICATIONS, INC. AS4780 1003 324 679 67.7% SEEDNET Digital United Inc. AS855 733 57 676 92.2% CANET-ASN-4 - Bell Aliant Regional Communications, Inc. AS4788 884 209 675 76.4% TMNET-AS-AP TM Net, Internet Service Provider AS6147 788 113 675 85.7% Telefonica del Peru S.A.A. Total 54344 15078 39266 72.3% Top 30 total Possible Bogus Routes 27.54.116.0/22 AS55452 27.54.116.0/24 AS55452 27.54.119.0/24 AS55452 27.100.7.0/24 AS56096 41.76.48.0/21 AS36969 MTL-AS 62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV 62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV 62.122.216.0/22 AS48727 63.247.0.0/19 AS226 LOS-NETTOS-AS - Los Nettos 63.247.0.0/24 AS27609 63.247.1.0/24 AS27609 63.247.2.0/24 AS27609 63.247.3.0/24 AS27609 63.247.4.0/24 AS27609 63.247.5.0/24 AS27609 63.247.6.0/24 AS27609 63.247.7.0/24 AS27609 63.247.8.0/24 AS27609 63.247.9.0/24 AS27609 63.247.10.0/24 AS27609 63.247.11.0/24 AS27609 63.247.13.0/24 AS27609 63.247.14.0/24 AS27609 63.247.15.0/24 AS27609 63.247.16.0/24 AS27609 63.247.17.0/24 AS27609 63.247.18.0/24 AS27609 63.247.19.0/24 AS27609 63.247.20.0/24 AS27609 63.247.21.0/24 AS27609 63.247.22.0/24 AS27609 63.247.23.0/24 AS27609 63.247.24.0/24 AS27609 63.247.25.0/24 AS27609 63.247.26.0/24 AS27609 63.247.27.0/24 AS27609 63.247.28.0/24 AS27609 63.247.29.0/24 AS27609 64.25.16.0/23 AS19535 64.25.20.0/24 AS19535 64.25.21.0/24 AS19535 64.25.22.0/24 AS19535 64.25.27.0/24 AS7046 RFC2270-UUNET-CUSTOMER - MCI Communications Services, Inc. d/b/a Verizon Business 64.111.0.0/20 AS8039 CCC-ASN-1 - Cinergy Communications 64.111.160.0/20 AS40551 64.111.160.0/24 AS40551 64.111.161.0/24 AS40551 64.111.162.0/24 AS40551 64.111.167.0/24 AS40551 64.111.169.0/24 AS40551 64.111.170.0/24 AS40551 64.111.171.0/24 AS40551 64.111.172.0/24 AS40551 64.111.173.0/24 AS40551 64.111.174.0/24 AS40551 64.111.175.0/24 AS40551 64.119.240.0/22 AS26072 64.119.240.0/23 AS26072 64.119.242.0/23 AS26072 64.185.224.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.225.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.226.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.227.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.228.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.229.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.230.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.231.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.232.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.233.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.234.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.235.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.236.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.237.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.238.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.239.0/24 AS27431 JTLNET - JTL Networks Inc. 64.202.48.0/22 AS23380 64.202.52.0/23 AS23380 64.202.54.0/24 AS23380 64.202.55.0/24 AS23380 64.202.56.0/22 AS23380 64.202.60.0/24 AS23380 64.202.61.0/24 AS23380 64.202.62.0/24 AS23380 64.202.63.0/24 AS23380 65.75.216.0/23 AS10494 AAI - Accurate Automation, Inc. 65.75.217.0/24 AS10494 AAI - Accurate Automation, Inc. 65.111.1.0/24 AS32258 SDNGLOBAL - SDN Global 66.11.112.0/20 AS14572 66.55.96.0/23 AS17203 66.55.98.0/24 AS17203 66.55.99.0/24 AS17203 66.55.100.0/22 AS17203 66.55.102.0/23 AS17203 66.55.104.0/21 AS17203 66.180.64.0/21 AS32558 ZEUTER - Zeuter Development Corporation 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.187.240.0/20 AS14552 ACS-SOUTHEASTDATACENTER - Affiliated Computer Services, Inc. 66.205.224.0/19 AS16526 BIRCH-TELECOM - Birch Telecom, Inc. 66.206.208.0/22 AS23380 66.206.211.0/24 AS14288 MPINET - MPInet 66.206.212.0/24 AS23380 66.206.213.0/24 AS14288 MPINET - MPInet 66.206.214.0/24 AS23380 66.206.215.0/24 AS23380 66.206.216.0/23 AS14288 MPINET - MPInet 66.206.218.0/23 AS23380 66.206.220.0/22 AS23380 66.251.128.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.133.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.134.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.136.0/21 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.140.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.141.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.142.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.254.160.0/20 AS11402 CCCAS-1 - Charlotte Colocation Center, LLc 66.254.176.0/21 AS11402 CCCAS-1 - Charlotte Colocation Center, LLc 66.254.184.0/22 AS11402 CCCAS-1 - Charlotte Colocation Center, LLc 66.254.188.0/22 AS35916 MULTA-ASN1 - MULTACOM CORPORATION 67.21.144.0/22 AS174 COGENT Cogent/PSI 67.21.148.0/22 AS174 COGENT Cogent/PSI 69.46.224.0/20 AS32592 HUNT-BROTHERS-OF-LOUISIANA-LLC - Hunt Brothers 69.46.236.0/24 AS32592 HUNT-BROTHERS-OF-LOUISIANA-LLC - Hunt Brothers 71.19.134.0/23 AS3313 INET-AS BT Italia S.p.A. 72.19.0.0/19 AS16526 BIRCH-TELECOM - Birch Telecom, Inc. 72.35.224.0/22 AS30097 NUWAVE - NuWave 72.35.232.0/21 AS6246 AVALONTEL - AvalonTel 72.44.16.0/20 AS15054 NORTHEAST-TEXAS-BROADBAND-LLC - Northeast Texas Broadband, LLC 74.112.100.0/22 AS16764 74.113.200.0/23 AS46939 74.114.52.0/22 AS40818 74.114.52.0/23 AS40818 74.114.52.0/24 AS40818 74.114.53.0/24 AS40818 74.114.54.0/23 AS40818 74.114.54.0/24 AS40818 74.114.55.0/24 AS40818 74.114.140.0/22 AS32757 74.115.124.0/23 AS46540 NARSASN - National Asset Recovery Services, Inc 74.118.132.0/22 AS5117 80.250.32.0/22 AS37106 ODUA-AS 91.193.60.0/22 AS3356 LEVEL3 Level 3 Communications 91.195.66.0/23 AS3356 LEVEL3 Level 3 Communications 91.197.36.0/22 AS43359 91.199.90.0/24 AS44330 91.199.185.0/24 AS29076 CITYTELECOM-AS Filanco LTD 91.207.1.0/24 AS174 COGENT Cogent/PSI 91.207.152.0/24 AS64100 91.207.153.0/24 AS64100 91.209.115.0/24 AS31103 KEYWEB-AS Keyweb AG 93.190.8.0/24 AS47254 93.190.9.0/24 AS47254 93.190.10.0/24 AS47254 102.2.88.0/22 AS38456 PACTEL-AS-AP Pacific Teleports. 103.11.1.0/24 AS9822 AMNET-AU-AP Amnet IT Services Pty Ltd 103.13.184.0/23 AS58674 103.15.228.0/22 AS38809 NXGNET-AS-AP Nextgen Networks 103.15.228.0/23 AS38809 NXGNET-AS-AP Nextgen Networks 103.15.230.0/23 AS38809 NXGNET-AS-AP Nextgen Networks 103.21.72.0/22 AS13244 103.21.75.0/24 AS13244 116.206.72.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 116.206.85.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 116.206.103.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 117.120.56.0/21 AS4755 TATACOMM-AS TATA Communications formerly VSNL is Leading ISP 121.46.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 124.64.0.0/10 AS4847 CNIX-AP China Networks Inter-Exchange 164.40.184.0/24 AS19821 172.85.0.0/24 AS29571 CITelecom-AS 172.102.0.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 172.116.0.0/24 AS7018 ATT-INTERNET4 - AT&T Services, Inc. 174.136.192.0/18 AS14572 176.111.168.0/22 AS50586 MACROSOLUTIONS MacroSolution SRL 178.218.240.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.241.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.242.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.243.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.244.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.245.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.246.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.247.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.248.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.249.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.250.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.251.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.252.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.253.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.254.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 178.218.255.0/24 AS44109 PROJECT-A-AS Stroy-Industria-1 LLC 185.43.184.0/22 AS29611 ELITE-AS Elite Limited 190.3.160.0/21 AS27975 SYNAPSIS COLOMBIA SAS 190.15.72.0/21 AS15146 CABLEBAHAMAS - Cable Bahamas 190.107.238.0/24 AS27765 TRANSNEXA S.A. E.M.A. 190.124.252.0/22 AS7303 Telecom Argentina S.A. 192.166.32.0/20 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 193.9.59.0/24 AS1257 TELE2 193.16.106.0/24 AS31539 193.22.224.0/20 AS3322 193.22.238.0/23 AS62383 LDS-AS Lambrechts Data Services VOF 193.109.15.0/24 AS12690 MKSNET-AS MKS Autonomous System 193.164.152.0/24 AS3356 LEVEL3 Level 3 Communications 193.178.217.0/24 AS20737 193.188.252.0/24 AS8697 JTC-AS8697 Jordan Telecommunications Company 193.202.8.0/21 AS3322 193.254.218.0/23 AS25229 VOLIA-AS Kyivski Telekomunikatsiyni Merezhi LLC 194.34.56.0/24 AS3549 GBLX Global Crossing Ltd. 194.34.56.0/25 AS3549 GBLX Global Crossing Ltd. 194.34.56.128/26 AS3549 GBLX Global Crossing Ltd. 194.50.82.0/24 AS16276 OVH OVH Systems 194.63.152.0/22 AS3356 LEVEL3 Level 3 Communications 194.99.67.0/24 AS9083 CARPENET carpeNet Information Technologies GmbH 194.113.27.0/24 AS12518 SHLINK SHLINK Internet Service 194.126.219.0/24 AS34545 195.28.168.0/23 AS8655 195.114.4.0/23 AS41158 195.128.240.0/23 AS21202 DCSNET-AS Bredband2 AB 195.130.208.0/24 AS16265 LEASEWEB LeaseWeb B.V. 195.216.234.0/24 AS31309 NMV-AS New Media Ventures BVBA 195.234.156.0/24 AS25028 200.1.112.0/24 AS29754 GO2TEL GO2TEL.COM INC. 200.18.112.0/20 AS1916 Associação Rede Nacional de Ensino e Pesquisa 200.23.189.0/24 AS57792 PROVITEX-AS PE Glazunov Yuriy Anatol'yevich 200.58.248.0/21 AS27849 201.71.16.0/20 AS28638 EMTEC EMPRESA DE TECNOLOGIA EMPREENDIMENTOS DE COM 202.8.106.0/24 AS9530 SHINSEGAE-AS SHINSEGAE I&C Co., Ltd. 202.58.113.0/24 AS19161 202.83.120.0/21 AS37972 202.83.124.0/24 AS37972 202.83.125.0/24 AS37972 202.83.126.0/24 AS37972 202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.158.251.0/24 AS9255 CONNECTPLUS-AS Singapore Telecom 202.174.125.0/24 AS9498 BBIL-AP BHARTI Airtel Ltd. 202.179.134.0/24 AS23966 LDN-AS-PK LINKdotNET Telecom Limited 203.142.219.0/24 AS45149 203.191.56.0/21 AS38042 INCOMNET-MONGOLIA-AS-AP Incomnet LLC, Mongolia, VSAT and Wireless service 204.9.32.0/24 AS25617 204.9.33.0/24 AS25617 204.9.34.0/24 AS25617 204.9.35.0/24 AS25617 204.9.116.0/22 AS30097 NUWAVE - NuWave 204.10.88.0/21 AS3356 LEVEL3 Level 3 Communications 204.10.92.0/23 AS30097 NUWAVE - NuWave 204.10.94.0/23 AS30097 NUWAVE - NuWave 204.15.208.0/22 AS13706 COMPLETEWEBNET - CompleteWeb.Net LLC 204.69.144.0/24 AS27283 RJF-INTERNET - Raymond James Financial, Inc. 204.106.16.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.115.110.0/23 AS53709 204.187.11.0/24 AS51113 ELEKTA-AS Elekta 204.225.173.0/24 AS6407 PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 205.159.44.0/24 AS40157 ADESA-CORP-AS - ADESA Corp 205.207.66.0/24 AS15290 ALLST-15290 - Allstream Corp. 205.211.160.0/24 AS30045 UHN-ASN - University Health Network 205.236.71.0/24 AS852 ASN852 - TELUS Communications Inc. 206.81.112.0/20 AS32618 ADKNO-KC - Adknowledge, Inc. 206.197.184.0/24 AS23304 DATOTEL-STL-AS - Datotel LLC, a NetLabs LLC Company 206.221.176.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.177.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.178.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.179.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.180.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.181.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.182.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.183.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.184.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.185.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.186.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.187.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.188.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.189.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.190.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.191.0/24 AS27431 JTLNET - JTL Networks Inc. 207.2.120.0/21 AS6221 USCYBERSITES - US Cybersites, Inc 207.174.131.0/24 AS26116 INDRA - Indra's Net Inc 207.174.132.0/23 AS26116 INDRA - Indra's Net Inc 207.174.152.0/23 AS26116 INDRA - Indra's Net Inc 207.174.154.0/24 AS26116 INDRA - Indra's Net Inc 207.174.155.0/24 AS26116 INDRA - Indra's Net Inc 207.174.200.0/24 AS22658 EARTHNET - Earthnet, Inc. 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc. 207.254.128.0/21 AS30689 FLOW-NET - FLOW 207.254.128.0/24 AS30689 FLOW-NET - FLOW 207.254.136.0/21 AS30689 FLOW-NET - FLOW 208.66.120.0/22 AS32757 208.68.180.0/22 AS4323 TWTC - tw telecom holdings, inc. 208.74.224.0/22 AS174 COGENT Cogent/PSI 208.75.152.0/21 AS32146 208.76.20.0/24 AS31812 208.76.21.0/24 AS31812 208.77.164.0/24 AS22659 208.77.165.0/24 AS22659 208.77.166.0/24 AS22659 208.77.167.0/24 AS22659 208.83.53.0/24 AS40569 YGOMI-AS - Ygomi LLC 208.84.232.0/24 AS33131 208.84.234.0/24 AS33131 208.84.237.0/24 AS33131 208.84.238.0/24 AS33131 208.85.116.0/23 AS25956 ALPHEUS - Alpheus Data Services, L.L.C. 208.85.212.0/22 AS32618 ADKNO-KC - Adknowledge, Inc. 208.89.32.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.33.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.34.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.35.0/24 AS27431 JTLNET - JTL Networks Inc. 208.91.72.0/24 AS17361 BRASS - Sungard Trading System (ASC) 208.91.73.0/24 AS17361 BRASS - Sungard Trading System (ASC) 208.91.76.0/23 AS21681 ANDOVER-TRADING - ANDOVER TRADING 208.91.164.0/22 AS46099 208.92.224.0/22 AS32757 208.92.226.0/24 AS32757 209.161.96.0/20 AS8039 CCC-ASN-1 - Cinergy Communications 209.177.64.0/20 AS6461 MFNX MFN - Metromedia Fiber Network 209.193.112.0/20 AS209 ASN-QWEST-US NOVARTIS-DMZ-US 209.209.51.0/24 AS18687 MPOWER-2 - MPOWER COMMUNICATIONS CORP. 209.212.63.0/24 AS16467 ASN-NEXTWEB-R1 - Nextweb, Inc 209.213.0.0/20 AS33005 ELTOPIA - Eltopia.com, LLC 209.234.112.0/23 AS32252 209.234.114.0/23 AS32252 209.234.116.0/24 AS32252 209.234.117.0/24 AS32252 209.234.118.0/24 AS32252 209.234.119.0/24 AS32252 209.234.120.0/24 AS32252 209.234.121.0/24 AS32252 209.234.122.0/24 AS32252 212.119.32.0/19 AS12550 213.184.64.0/24 AS13071 213.184.65.0/24 AS13071 213.184.66.0/24 AS13071 213.184.67.0/24 AS13071 213.184.68.0/24 AS13071 213.184.69.0/24 AS13071 213.184.70.0/24 AS13071 213.184.71.0/24 AS13071 213.184.72.0/24 AS13071 213.184.73.0/24 AS13071 213.184.74.0/24 AS13071 213.184.75.0/24 AS13071 213.184.76.0/24 AS13071 213.184.77.0/24 AS13071 213.184.78.0/24 AS13071 216.12.163.0/24 AS26627 AS-PILOSOFT - Pilosoft, Inc. 216.14.64.0/20 AS14728 216.146.0.0/19 AS11915 TELWEST-NETWORK-SVCS-STATIC - TEL WEST COMMUNICATIONS LLC 216.152.24.0/22 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.170.96.0/24 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 216.170.101.0/24 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 216.170.104.0/24 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 216.170.105.0/24 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 216.234.128.0/22 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. 216.234.132.0/24 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. 216.234.139.0/24 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Verizon mail IP blacklist contact?
by Tim Burke 20 Dec '13

20 Dec '13

Anyone happen to have a contact at Verizon that can actually get an IP delisted in their mail blacklist? I've been attempting to get an IP delisted with Verizon for quite some time, and haven't had luck through their web form ( http://my.verizon.com/micro/whitelist/RequestForm.aspx?id=isp) their abuse address, etc. Their autoresponder claims the IP is a dynamic address, when this range is considered static with SORBS, Spamhaus, etc. --Tim

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 20 Dec '13

20 Dec '13

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 21 Dec, 2013 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 475800 Prefixes after maximum aggregation: 190361 Deaggregation factor: 2.50 Unique aggregates announced to Internet: 236234 Total ASes present in the Internet Routing Table: 45782 Prefixes per ASN: 10.39 Origin-only ASes present in the Internet Routing Table: 35490 Origin ASes announcing only one prefix: 16278 Transit ASes present in the Internet Routing Table: 5971 Transit-only ASes present in the Internet Routing Table: 177 Average AS path length visible in the Internet Routing Table: 4.6 Max AS path length visible: 53 Max AS path prepend of ASN ( 50404) 51 Prefixes from unregistered ASNs in the Routing Table: 1068 Unregistered ASNs in the Routing Table: 305 Number of 32-bit ASNs allocated by the RIRs: 5558 Number of 32-bit ASNs visible in the Routing Table: 4321 Prefixes from 32-bit ASNs in the Routing Table: 13537 Number of bogon 32-bit ASNs visible in the Routing Table: 1 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 1466 Number of addresses announced to Internet: 2660917980 Equivalent to 158 /8s, 154 /16s and 98 /24s Percentage of available address space announced: 71.9 Percentage of allocated address space announced: 71.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 95.3 Total number of prefixes smaller than registry allocations: 166277 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 112978 Total APNIC prefixes after maximum aggregation: 34171 APNIC Deaggregation factor: 3.31 Prefixes being announced from the APNIC address blocks: 115264 Unique aggregates announced from the APNIC address blocks: 48154 APNIC Region origin ASes present in the Internet Routing Table: 4877 APNIC Prefixes per ASN: 23.63 APNIC Region origin ASes announcing only one prefix: 1211 APNIC Region transit ASes present in the Internet Routing Table: 839 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 38 Number of APNIC region 32-bit ASNs visible in the Routing Table: 794 Number of APNIC addresses announced to Internet: 729350848 Equivalent to 43 /8s, 121 /16s and 2 /24s Percentage of available APNIC address space announced: 85.2 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-63999, 131072-133631 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 163428 Total ARIN prefixes after maximum aggregation: 81908 ARIN Deaggregation factor: 2.00 Prefixes being announced from the ARIN address blocks: 164196 Unique aggregates announced from the ARIN address blocks: 75953 ARIN Region origin ASes present in the Internet Routing Table: 15934 ARIN Prefixes per ASN: 10.30 ARIN Region origin ASes announcing only one prefix: 6002 ARIN Region transit ASes present in the Internet Routing Table: 1672 Average ARIN Region AS path length visible: 4.1 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 49 Number of ARIN addresses announced to Internet: 1075463552 Equivalent to 64 /8s, 26 /16s and 69 /24s Percentage of available ARIN address space announced: 56.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 119980 Total RIPE prefixes after maximum aggregation: 61371 RIPE Deaggregation factor: 1.95 Prefixes being announced from the RIPE address blocks: 123716 Unique aggregates announced from the RIPE address blocks: 79314 RIPE Region origin ASes present in the Internet Routing Table: 17576 RIPE Prefixes per ASN: 7.04 RIPE Region origin ASes announcing only one prefix: 8306 RIPE Region transit ASes present in the Internet Routing Table: 2831 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 53 Number of RIPE region 32-bit ASNs visible in the Routing Table: 2537 Number of RIPE addresses announced to Internet: 655696868 Equivalent to 39 /8s, 21 /16s and 35 /24s Percentage of available RIPE address space announced: 95.3 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-200191 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 53303 Total LACNIC prefixes after maximum aggregation: 10055 LACNIC Deaggregation factor: 5.30 Prefixes being announced from the LACNIC address blocks: 58687 Unique aggregates announced from the LACNIC address blocks: 27431 LACNIC Region origin ASes present in the Internet Routing Table: 2059 LACNIC Prefixes per ASN: 28.50 LACNIC Region origin ASes announcing only one prefix: 551 LACNIC Region transit ASes present in the Internet Routing Table: 398 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 35 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 933 Number of LACNIC addresses announced to Internet: 146973752 Equivalent to 8 /8s, 194 /16s and 164 /24s Percentage of available LACNIC address space announced: 87.6 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 262144-263679 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 11809 Total AfriNIC prefixes after maximum aggregation: 2611 AfriNIC Deaggregation factor: 4.52 Prefixes being announced from the AfriNIC address blocks: 12471 Unique aggregates announced from the AfriNIC address blocks: 4238 AfriNIC Region origin ASes present in the Internet Routing Table: 697 AfriNIC Prefixes per ASN: 17.89 AfriNIC Region origin ASes announcing only one prefix: 208 AfriNIC Region transit ASes present in the Internet Routing Table: 147 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 8 Number of AfriNIC addresses announced to Internet: 48643712 Equivalent to 2 /8s, 230 /16s and 62 /24s Percentage of available AfriNIC address space announced: 48.3 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2948 11558 952 Korea Telecom (KIX) 17974 2731 902 88 PT TELEKOMUNIKASI INDONESIA 7545 2121 319 112 TPG Internet Pty Ltd 4755 1804 392 191 TATA Communications formerly 9829 1558 1251 42 BSNL National Internet Backbo 9583 1300 100 537 Sify Limited 9498 1229 309 72 BHARTI Airtel Ltd. 4808 1145 2121 346 CNCGROUP IP network: China169 7552 1134 1080 13 Vietel Corporation 24560 1098 382 167 Bharti Airtel Ltd., Telemedia Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3028 3688 53 BellSouth.net Inc. 22773 2303 2939 139 Cox Communications, Inc. 1785 2146 686 131 PaeTec Communications, Inc. 18566 2050 379 178 MegaPath Corporation 20115 1681 1662 593 Charter Communications 4323 1630 1081 413 Time Warner Telecom 701 1508 11144 781 MCI Communications Services, 30036 1375 309 574 Mediacom Communications Corp 7018 1308 17746 853 AT&T WorldNet Services 6983 1295 756 580 ITC^Deltacom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1884 544 16 OJSC "Vimpelcom" 34984 1366 243 226 TELLCOM ILETISIM HIZMETLERI A 20940 1212 458 913 Akamai Technologies European 31148 1011 45 19 FreeNet ISP 13188 919 99 40 TOV "Bank-Inform" 6849 860 363 38 JSC UKRTELECOM, 8551 846 370 38 Bezeq International 6830 772 2327 425 UPC Distribution Services 12479 683 798 53 Uni2 Autonomous System 35228 551 246 16 Avatar Broadband Limited Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3430 1839 90 NET Servicos de Comunicao S.A 10620 2691 435 209 Telmex Colombia S.A. 18881 1778 908 20 Global Village Telecom 7303 1743 1163 230 Telecom Argentina Stet-France 8151 1371 2857 429 UniNet S.A. de C.V. 11830 868 364 15 Instituto Costarricense de El 27947 855 93 89 Telconet S.A 6503 791 434 60 AVANTEL, S.A. 6147 788 373 27 Telefonica Del Peru 7738 780 1498 36 Telecomunicacoes da Bahia S.A Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 36998 1819 112 5 Sudanese Mobile Telephone (ZA 24863 889 338 26 LINKdotNET AS number 6713 598 653 27 Itissalat Al-MAGHRIB 8452 420 956 9 TEDATA 24835 298 144 9 RAYA Telecom - Egypt 3741 247 921 209 The Internet Solution 36992 247 526 30 Etisalat MISR 29571 239 21 14 Ci Telecom Autonomous system 15706 219 32 6 Sudatel Internet Exchange Aut 29975 192 668 21 Vodacom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3430 1839 90 NET Servicos de Comunicao S.A 6389 3028 3688 53 BellSouth.net Inc. 4766 2948 11558 952 Korea Telecom (KIX) 17974 2731 902 88 PT TELEKOMUNIKASI INDONESIA 10620 2691 435 209 Telmex Colombia S.A. 22773 2303 2939 139 Cox Communications, Inc. 1785 2146 686 131 PaeTec Communications, Inc. 7545 2121 319 112 TPG Internet Pty Ltd 18566 2050 379 178 MegaPath Corporation 8402 1884 544 16 OJSC "Vimpelcom" Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6389 3028 2975 BellSouth.net Inc. 17974 2731 2643 PT TELEKOMUNIKASI INDONESIA 10620 2691 2482 Telmex Colombia S.A. 22773 2303 2164 Cox Communications, Inc. 1785 2146 2015 PaeTec Communications, Inc. 7545 2121 2009 TPG Internet Pty Ltd 4766 2948 1996 Korea Telecom (KIX) 18566 2050 1872 MegaPath Corporation 8402 1884 1868 OJSC "Vimpelcom" 36998 1819 1814 Sudanese Mobile Telephone (ZA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 62828 UNALLOCATED 8.21.130.0/24 4323 Time Warner Telecom 62850 UNALLOCATED 8.25.147.0/24 46887 Lightower Fiber Netw 62734 UNALLOCATED 8.31.128.0/24 6939 Hurricane Electric 62773 UNALLOCATED 8.35.180.0/22 3356 Level 3 Communicatio 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 62719 UNALLOCATED 12.27.130.0/24 4323 Time Warner Telecom 62861 UNALLOCATED 12.37.197.0/24 7018 AT&T WorldNet Servic 13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic 23502 UNALLOCATED 12.44.44.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.103.0/24 209 Qwest Communications Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.90.128.0/18 27418 OUTOFWALL INC. 23.91.0.0/19 40676 Psychz Networks 23.91.4.0/24 40676 Psychz Networks 23.91.14.0/24 40676 Psychz Networks 23.91.32.0/19 36315 Servpac Inc. 23.91.80.0/20 21560 Capital Technology Services G 23.91.96.0/20 37958 ChinaCache Networks ASN 23.91.112.0/21 32475 MidPhase Inc. 23.91.120.0/21 36351 SoftLayer Technologies Inc. 23.91.160.0/19 36493 3757277 Canada Inc. (oa 295.c Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:11 /10:31 /11:92 /12:253 /13:473 /14:937 /15:1636 /16:12859 /17:6759 /18:11374 /19:23196 /20:32966 /21:35768 /22:50414 /23:44040 /24:252543 /25:837 /26:986 /27:448 /28:48 /29:72 /30:26 /31:0 /32:15 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 2005 2050 MegaPath Corporation 36998 1786 1819 Sudanese Mobile Telephone (ZA 6389 1699 3028 BellSouth.net Inc. 8402 1584 1884 OJSC "Vimpelcom" 22773 1553 2303 Cox Communications, Inc. 30036 1216 1375 Mediacom Communications Corp 1785 1163 2146 PaeTec Communications, Inc. 11492 1148 1185 Cable One 6983 1037 1295 ITC^Deltacom 22561 977 1252 Digital Teleport, Inc Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:925 2:855 3:3 4:16 5:829 6:21 8:618 12:1883 13:3 14:901 15:9 16:3 17:19 20:34 23:616 24:1754 27:1702 31:1516 32:46 33:2 34:5 36:104 37:1955 38:919 39:3 40:182 41:3216 42:238 44:14 46:2106 47:10 49:703 50:859 52:12 54:44 55:5 56:4 57:26 58:1144 59:583 60:370 61:1498 62:1229 63:1978 64:4397 65:2334 66:4133 67:2115 68:1088 69:3295 70:909 71:511 72:2025 74:2587 75:323 76:305 77:1215 78:1029 79:676 80:1285 81:1084 82:643 83:754 84:630 85:1275 86:398 87:1015 88:524 89:1568 90:150 91:5734 92:626 93:1617 94:2104 95:1509 96:520 97:351 98:1082 99:41 100:32 101:693 103:3870 105:533 106:144 107:255 108:548 109:2019 110:966 111:1135 112:607 113:811 114:753 115:1044 116:1014 117:830 118:1237 119:1279 120:340 121:771 122:1885 123:1267 124:1388 125:1447 128:638 129:232 130:357 131:665 132:355 133:159 134:310 135:73 136:277 137:252 138:353 139:171 140:202 141:349 142:550 143:406 144:498 145:90 146:550 147:436 148:790 149:360 150:153 151:479 152:408 153:208 154:49 155:518 156:313 157:419 158:285 159:788 160:359 161:454 162:961 163:252 164:636 165:586 166:280 167:641 168:1044 169:123 170:1151 171:185 172:12 173:1714 174:675 175:547 176:1338 177:2573 178:1905 179:327 180:1604 181:915 182:1423 183:477 184:623 185:1145 186:2779 187:1449 188:1956 189:1269 190:7315 192:7078 193:5440 194:4033 195:3389 196:1347 197:1076 198:4806 199:5527 200:6058 201:2545 202:9016 203:8904 204:4535 205:2637 206:2906 207:2820 208:3955 209:3694 210:3080 211:1632 212:2184 213:1973 214:873 215:85 216:5430 217:1723 218:622 219:323 220:1273 221:591 222:332 223:563 End of report

1 0

ddos attacks
by sgraun＠airstreamcomm.net 20 Dec '13

20 Dec '13

I’m curious to know what other service providers are doing to alleviate/prevent ddos attacks from happening in your network. Are you completely reactive and block as many addresses as possible or null0 traffic to the effected host until it stops or do you block certain ports to prevent them. What’s the best way people are dealing with them? Scott

22 32

Re: ddos attacks
by Scott Weeks 19 Dec '13

19 Dec '13

--- cb.list6(a)gmail.com wrote: On Dec 19, 2013 4:25 PM, "Dobbins, Roland" <rdobbins(a)arbor.net> wrote: On Dec 19, 2013, at 6:12 AM, cb.list6 <cb.list6(a)gmail.com> wrote: > > I am strongly considering having my upstreams to simply > > rate limit ipv4 UDP. > > QoS is a very poor mechanism for remediating DDoS attacks. > It ensures that programmatically-generated attack traffic > will 'squeeze out' legitimate traffic. I agree. But ... i am pretty sure i am going to do it. Trade offs. ----------------------------------------------------------------- If you don't mind, after your first legit attack reply back to this thread with the details, so others can learn from it when they're looking through the archives. scott

1 0

Re: ddos attacks
by dennis＠justipit.com 19 Dec '13

19 Dec '13

I have to disagree with the scaling as I've personally deployed both Arbor and Radware in carrier and MSSP environments, including tier 1, CLEC and cable operators. Deployment models vary from infrastructure protection to scrubbing center and top of rack solutions. Happy to discuss with you further offlist. Cheers Dennis Sent from my Sprint phone. ----- Reply message ----- From: "Eugeniu Patrascu" <eugen(a)imacandi.net> To: "dennis(a)justipit.com" <dennis(a)justipit.com> Cc: <fergdawgster(a)mykolab.com>, "NANOG list" <nanog(a)nanog.org> Subject: ddos attacks Date: Thu, Dec 19, 2013 3:51 PM On Thu, Dec 19, 2013 at 10:30 PM, dennis(a)justipit.com <dennis(a)justipit.com> wrote: Just about every security, network and ADC vendor out there is claiming anti-dos capabilities. Be careful when going that route and do your own validation. I suggest looking at Radware and Arbor (both leaders in the market). To successfully mitigate an attack the ideal solutions will weed out the attack and allow legitimate traffic to continue. Many of the solutions in the commercial market are not much more than rate limiters and are not very forgiving. Just as important realize while spoofed udp floods are popular they are oftened only the first vector, if successfully mitigated attackers quickly adjust and follow with more complex vectors such as application attacks toward http, ssl, dns query floods, etc.. Remember their goal is to bring you down, , divert your attention while they steal your data or perhaps transfer funds. They will go to far lengths to achieve their end result. As you can imagine it's much harder to identify the attack characteristics or for that matter the attacker in these more complex cases. In summary, I'm a firm believer in a hybrid approach with combination of infrastructure acls, rtbh, qos, URPF, tcp stack hardening, local anti-ddos appliances for application attacks and network floods under link capacity to allow you to stay up while deciding to shift routes into cloud band ability to swing up stream to cloud scrubbing center (in house or third party). I know a bit about Radware, and what they do is to learn a traffic pattern from where traffic usually comes and when in case of exceeding a certain threshold, they start dropping traffic from new sources never seen before and then drop some seen before traffic. This works if you are a company with a very localized visitor base (like banking site for certain national or local bank, e-shop and so on) but it kind of doesn't scale that much when it comes to we have people all over the place and we get DDoS-ed with legitimate requests that only consume server resources. What providers do in some regions is to blackhole your subnet if you reach a certain number of packets per second. It sucks, but hey, they also have infrastructure to protect. Eugeniu

1 0

Re: ddos attacks
by Eugeniu Patrascu 19 Dec '13

19 Dec '13

On Thu, Dec 19, 2013 at 10:30 PM, dennis(a)justipit.com <dennis(a)justipit.com>wrote: > Just about every security, network and ADC vendor out there is claiming > anti-dos capabilities. Be careful when going that route and do your own > validation. I suggest looking at Radware and Arbor (both leaders in the > market). To successfully mitigate an attack the ideal solutions will weed > out the attack and allow legitimate traffic to continue. Many of the > solutions in the commercial market are not much more than rate limiters and > are not very forgiving. Just as important realize while spoofed udp floods > are popular they are oftened only the first vector, if successfully > mitigated attackers quickly adjust and follow with more complex vectors > such as application attacks toward http, ssl, dns query floods, etc.. > Remember their goal is to bring you down, , divert your attention while > they steal your data or perhaps transfer funds. They will go to far > lengths to achieve their end result. As you can imagine it's much harder > to identify the attack characteristics or for that matter the attacker in > these more complex cases. In summary, I'm a firm believer in a hybrid > approach with combination of infrastructure acls, rtbh, qos, URPF, tcp > stack hardening, local anti-ddos appliances for application attacks and > network floods under link capacity to allow you to stay up while deciding > to shift routes into cloud band ability to swing up stream to cloud > scrubbing center (in house or third party). > I know a bit about Radware, and what they do is to learn a traffic pattern from where traffic usually comes and when in case of exceeding a certain threshold, they start dropping traffic from new sources never seen before and then drop some seen before traffic. This works if you are a company with a very localized visitor base (like banking site for certain national or local bank, e-shop and so on) but it kind of doesn't scale that much when it comes to we have people all over the place and we get DDoS-ed with legitimate requests that only consume server resources. What providers do in some regions is to blackhole your subnet if you reach a certain number of packets per second. It sucks, but hey, they also have infrastructure to protect. Eugeniu

1 0

Re: ddos attacks
by dennis＠justipit.com 19 Dec '13

19 Dec '13

Just about every security, network and ADC vendor out there is claiming anti-dos capabilities. Be careful when going that route and do your own validation. I suggest looking at Radware and Arbor (both leaders in the market). To successfully mitigate an attack the ideal solutions will weed out the attack and allow legitimate traffic to continue. Many of the solutions in the commercial market are not much more than rate limiters and are not very forgiving. Just as important realize while spoofed udp floods are popular they are oftened only the first vector, if successfully mitigated attackers quickly adjust and follow with more complex vectors such as application attacks toward http, ssl, dns query floods, etc.. Remember their goal is to bring you down, , divert your attention while they steal your data or perhaps transfer funds. They will go to far lengths to achieve their end result. As you can imagine it's much harder to identify the attack characteristics or for that matter the attacker in these more complex cases. In summary, I'm a firm believer in a hybrid approach with combination of infrastructure acls, rtbh, qos, URPF, tcp stack hardening, local anti-ddos appliances for application attacks and network floods under link capacity to allow you to stay up while deciding to shift routes into cloud band ability to swing up stream to cloud scrubbing center (in house or third party). Sent from my Sprint phone. ----- Reply message ----- From: "Paul Ferguson" <fergdawgster(a)mykolab.com> To: <nanog(a)nanog.org> Subject: ddos attacks Date: Thu, Dec 19, 2013 2:35 PM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm really surprised no one has mentioned Akamai/Prolexic, especially since their recent marriage. If someone has already mentioned it: Apologies. - - ferg On 12/19/2013 4:08 AM, Adrian M wrote: > Hi, > > You can also test WANGUARD, http://www.andrisoft.com/ for DDoS detection > and BGP triggered blackholing. > > > On Thu, Dec 19, 2013 at 11:32 AM, Eugeniu Patrascu > <eugen(a)imacandi.net>wrote: > >> Hi, >> >> You can also take a look at http://www.packetdam.com/ for DDoS >> protection. >> >> Eugeniu >> >> >> On Thu, Dec 19, 2013 at 10:53 AM, Tore Anderson <tore(a)fud.no> wrote: >> >>> * James Braunegg >>> >>>> Of course for any form of Anti DDoS hardware to be functional you >>>> need to make sure your network can route and pass the traffic so you >>>> can absorb the bad traffic to give you a chance cleaning the >>>> traffic. >>> >>> So in order for an Anti-DDoS appliance to be functional the network >>> needs to be able to withstand the DDoS on its own. How terribly useful. >>> >>> Tore >>> >>> >> > > -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 2317) Charset: utf-8 wj8DBQFSs0qFq1pz9mNUZTMRAlHzAJ4snDXa9MSpzSAniMUKcea0L521jQCgxHLH gBUm4ScmJlf5FsC5kJJrmZs= =tLUd -----END PGP SIGNATURE----- -- Paul Ferguson PGP Public Key ID: 0x63546533

1 0

BGP from Juniper to Cisco ASR
by Philip Lavine 19 Dec '13

19 Dec '13

Dec 18 07:46:33: %BGP-3-NOTIFICATION: received from neighbor <REMOTE PEER> active 2/5 (authentication failure) 0 bytes Dec 18 15:46:33.615: BGP: ses global <REMOTE PEER> (0x7FB1CD209CF0:0) act Receive NOTIFICATION 2/5 (authentication failure) 0 bytes Although I have seem this on the message boards I am little confused in that the ISP is telling me that there is no authentication enabled on the Juniper and I do not have authentication enabled on the ASR. So what is going on here?

5 7

Anyone seeing issues with Abovenet/Zayo in Northeast US?
by Jeffrey Negro 19 Dec '13

19 Dec '13

We have two MPLS circuits malfunctioning, one from DE to NJ, and another from DE to CA. Both are showing high latency and packet loss. Curious to hear if anyone else is having issues. Thanks

1 0