September 2013 - Test - lists.nanog.org

[NANOG-announce] NANOG Fellowship Reminder
by Betty Burke <betty＠nanog.org> 06 Sep '13

06 Sep '13

If you are considering attending a NANOG meeting, and need a bit of assistance, consider submitting a NANOG Fellowship application. Fellowship Applicants are eligible if they meet all the criteria of either Fellowship, currently reside in the North American Region served by NANOG, and have not attended a NANOG meeting in the last five years. The NANOG 59 Fellowship <http://nanog.org/resources/fellowships>application process will remain open from August 26, 2013 until 5:00 PM PST on September 9, 2013. As always, if you have additional questions, please feel free to also contact me directly. Sincerely, Betty -- Betty Burke NANOG Executive Director 48377 Fremont Boulevard, Suite 117 Fremont, CA 94538 Tel: +1 510 492 4030 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 06 Sep '13

06 Sep '13

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 07 Sep, 2013 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 466753 Prefixes after maximum aggregation: 188207 Deaggregation factor: 2.48 Unique aggregates announced to Internet: 231835 Total ASes present in the Internet Routing Table: 44906 Prefixes per ASN: 10.39 Origin-only ASes present in the Internet Routing Table: 35097 Origin ASes announcing only one prefix: 16257 Transit ASes present in the Internet Routing Table: 5913 Transit-only ASes present in the Internet Routing Table: 165 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 30 Max AS path prepend of ASN ( 36992) 22 Prefixes from unregistered ASNs in the Routing Table: 5649 Unregistered ASNs in the Routing Table: 1916 Number of 32-bit ASNs allocated by the RIRs: 5006 Number of 32-bit ASNs visible in the Routing Table: 3896 Prefixes from 32-bit ASNs in the Routing Table: 11954 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 362 Number of addresses announced to Internet: 2641573844 Equivalent to 157 /8s, 115 /16s and 55 /24s Percentage of available address space announced: 71.4 Percentage of allocated address space announced: 71.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 95.0 Total number of prefixes smaller than registry allocations: 163579 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 110477 Total APNIC prefixes after maximum aggregation: 33521 APNIC Deaggregation factor: 3.30 Prefixes being announced from the APNIC address blocks: 112415 Unique aggregates announced from the APNIC address blocks: 46754 APNIC Region origin ASes present in the Internet Routing Table: 4866 APNIC Prefixes per ASN: 23.10 APNIC Region origin ASes announcing only one prefix: 1223 APNIC Region transit ASes present in the Internet Routing Table: 829 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 23 Number of APNIC region 32-bit ASNs visible in the Routing Table: 661 Number of APNIC addresses announced to Internet: 728202176 Equivalent to 43 /8s, 103 /16s and 123 /24s Percentage of available APNIC address space announced: 85.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 131072-133119 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 161488 Total ARIN prefixes after maximum aggregation: 81121 ARIN Deaggregation factor: 1.99 Prefixes being announced from the ARIN address blocks: 162089 Unique aggregates announced from the ARIN address blocks: 75491 ARIN Region origin ASes present in the Internet Routing Table: 15867 ARIN Prefixes per ASN: 10.22 ARIN Region origin ASes announcing only one prefix: 6025 ARIN Region transit ASes present in the Internet Routing Table: 1661 Average ARIN Region AS path length visible: 4.1 Max ARIN Region AS path length visible: 27 Number of ARIN region 32-bit ASNs visible in the Routing Table: 20 Number of ARIN addresses announced to Internet: 1071412992 Equivalent to 63 /8s, 220 /16s and 119 /24s Percentage of available ARIN address space announced: 56.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 119588 Total RIPE prefixes after maximum aggregation: 61203 RIPE Deaggregation factor: 1.95 Prefixes being announced from the RIPE address blocks: 123427 Unique aggregates announced from the RIPE address blocks: 79478 RIPE Region origin ASes present in the Internet Routing Table: 17412 RIPE Prefixes per ASN: 7.09 RIPE Region origin ASes announcing only one prefix: 8246 RIPE Region transit ASes present in the Internet Routing Table: 2819 Average RIPE Region AS path length visible: 5.2 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 2390 Number of RIPE addresses announced to Internet: 657143780 Equivalent to 39 /8s, 43 /16s and 55 /24s Percentage of available RIPE address space announced: 95.5 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 196608-199679 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 51499 Total LACNIC prefixes after maximum aggregation: 9762 LACNIC Deaggregation factor: 5.28 Prefixes being announced from the LACNIC address blocks: 56191 Unique aggregates announced from the LACNIC address blocks: 25825 LACNIC Region origin ASes present in the Internet Routing Table: 2011 LACNIC Prefixes per ASN: 27.94 LACNIC Region origin ASes announcing only one prefix: 566 LACNIC Region transit ASes present in the Internet Routing Table: 379 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 29 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 819 Number of LACNIC addresses announced to Internet: 137498160 Equivalent to 8 /8s, 50 /16s and 14 /24s Percentage of available LACNIC address space announced: 82.0 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 262144-263679 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 11655 Total AfriNIC prefixes after maximum aggregation: 2549 AfriNIC Deaggregation factor: 4.57 Prefixes being announced from the AfriNIC address blocks: 12269 Unique aggregates announced from the AfriNIC address blocks: 3952 AfriNIC Region origin ASes present in the Internet Routing Table: 652 AfriNIC Prefixes per ASN: 18.82 AfriNIC Region origin ASes announcing only one prefix: 197 AfriNIC Region transit ASes present in the Internet Routing Table: 138 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 6 Number of AfriNIC addresses announced to Internet: 46563072 Equivalent to 2 /8s, 198 /16s and 127 /24s Percentage of available AfriNIC address space announced: 46.3 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2919 11561 924 Korea Telecom (KIX) 17974 2667 903 91 PT TELEKOMUNIKASI INDONESIA 7545 2068 321 112 TPG Internet Pty Ltd 4755 1769 390 190 TATA Communications formerly 9829 1547 1237 46 BSNL National Internet Backbo 9583 1229 92 508 Sify Limited 9498 1184 309 70 BHARTI Airtel Ltd. 4808 1160 2129 342 CNCGROUP IP network: China169 7552 1139 1080 13 Vietel Corporation 24560 1090 394 160 Bharti Airtel Ltd., Telemedia Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3068 3689 62 bellsouth.net, inc. 18566 2065 382 184 Covad Communications 22773 2041 2933 125 Cox Communications, Inc. 1785 2013 679 125 PaeTec Communications, Inc. 20115 1675 1645 630 Charter Communications 4323 1618 1119 410 Time Warner Telecom 701 1520 11119 796 UUNET Technologies, Inc. 30036 1344 301 643 Mediacom Communications Corp 7018 1313 11277 827 AT&T WorldNet Services 11492 1220 218 366 Cable One Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1724 544 16 Corbina telecom 34984 1314 244 221 BILISIM TELEKOM 2118 1179 97 13 EUnet/RELCOM Autonomous Syste 20940 987 355 766 Akamai Technologies European 31148 982 43 18 FreeNet ISP 6830 895 2367 427 UPC Distribution Services 13188 847 99 72 Educational Network 8551 752 370 41 Bezeq International 12479 687 797 53 Uni2 Autonomous System 58113 541 55 339 LIR DATACENTER TELECOM SRL Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3232 1719 96 NET Servicos de Comunicao S.A 10620 2547 416 259 TVCABLE BOGOTA 7303 1693 1118 223 Telecom Argentina Stet-France 18881 1430 844 20 Global Village Telecom 8151 1282 2775 386 UniNet S.A. de C.V. 14522 987 150 9 SatNet S.A. 11830 926 364 15 Instituto Costarricense de El 27947 838 94 91 Telconet S.A 6503 812 434 64 AVANTEL, S.A. 7738 764 1498 36 Telecomunicacoes da Bahia S.A Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 36998 1861 112 5 MOBITEL 24863 869 274 30 LINKdotNET AS number 6713 543 633 26 Itissalat Al-MAGHRIB 8452 435 956 9 TEDATA 24835 291 80 8 RAYA Telecom - Egypt 3741 257 921 216 The Internet Solution 36992 222 501 28 Etisalat MISR 15706 221 32 6 Sudatel Internet Exchange Aut 29571 220 17 12 Ci Telecom Autonomous system 12258 193 28 71 Vodacom Internet Company Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3232 1719 96 NET Servicos de Comunicao S.A 6389 3068 3689 62 bellsouth.net, inc. 4766 2919 11561 924 Korea Telecom (KIX) 17974 2667 903 91 PT TELEKOMUNIKASI INDONESIA 10620 2547 416 259 TVCABLE BOGOTA 7545 2068 321 112 TPG Internet Pty Ltd 18566 2065 382 184 Covad Communications 22773 2041 2933 125 Cox Communications, Inc. 1785 2013 679 125 PaeTec Communications, Inc. 36998 1861 112 5 MOBITEL Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6389 3068 3006 bellsouth.net, inc. 17974 2667 2576 PT TELEKOMUNIKASI INDONESIA 10620 2547 2288 TVCABLE BOGOTA 4766 2919 1995 Korea Telecom (KIX) 7545 2068 1956 TPG Internet Pty Ltd 22773 2041 1916 Cox Communications, Inc. 1785 2013 1888 PaeTec Communications, Inc. 18566 2065 1881 Covad Communications 36998 1861 1856 MOBITEL 8402 1724 1708 Corbina telecom Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 30031 UNALLOCATED 12.27.122.0/24 7018 AT&T WorldNet Servic 62719 UNALLOCATED 12.27.130.0/24 4323 Time Warner Telecom 13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic 23502 UNALLOCATED 12.44.44.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.103.0/24 209 Qwest 17300 UNALLOCATED 12.45.110.0/24 701 UUNET Technologies, 16476 UNALLOCATED 12.46.27.0/24 7018 AT&T WorldNet Servic 14764 UNALLOCATED 12.108.237.0/24 7018 AT&T WorldNet Servic 33649 UNALLOCATED 12.111.112.0/24 19029 New Edge Networks Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 100.100.0.0/24 4847 China Networks Inter-Exchange Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.90.128.0/18 27418 OUTOFWALL INC. 23.90.192.0/18 36086 Broad Communications Technolo 23.91.0.0/19 40676 Psychz Networks 23.91.32.0/19 36315 Servpac Inc. 23.92.16.0/21 8001 Net Access Corporation 23.92.24.0/22 6939 Hurricane Electric 23.92.48.0/20 29761 OC3 Networks & Web Solutions, 23.92.64.0/24 54540 Incero LLC 23.92.65.0/24 54540 Incero LLC 23.92.66.0/24 54540 Incero LLC Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:11 /10:30 /11:93 /12:250 /13:479 /14:911 /15:1612 /16:12783 /17:6696 /18:11128 /19:22799 /20:32381 /21:35037 /22:49361 /23:43119 /24:247605 /25:827 /26:990 /27:467 /28:48 /29:77 /30:19 /31:0 /32:14 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 2016 2065 Covad Communications 36998 1826 1861 MOBITEL 6389 1713 3068 bellsouth.net, inc. 8402 1447 1724 Corbina telecom 22773 1327 2041 Cox Communications, Inc. 30036 1207 1344 Mediacom Communications Corp 11492 1181 1220 Cable One 1785 1085 2013 PaeTec Communications, Inc. 6983 1025 1152 ITC^Deltacom 7011 933 1176 Citizens Utilities Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:809 2:844 3:3 4:19 5:940 6:19 8:614 12:1894 13:2 14:867 15:11 16:3 17:11 18:19 20:18 23:377 24:1744 27:1565 31:1436 32:45 33:2 34:5 36:71 37:1863 38:898 39:4 40:179 41:3294 42:255 44:9 46:1972 47:4 49:665 50:840 52:12 54:37 55:7 57:26 58:1168 59:621 60:336 61:1415 62:1225 63:1990 64:4558 65:2311 66:4166 67:2064 68:1090 69:3302 70:863 71:496 72:2007 74:2549 75:329 76:304 77:1163 78:1056 79:625 80:1318 81:1024 82:646 83:582 84:581 85:1264 86:483 87:1049 88:556 89:1833 90:158 91:5623 92:604 93:1675 94:2027 95:1569 96:509 97:339 98:1041 99:44 100:29 101:598 103:3292 105:519 106:142 107:207 108:501 109:1878 110:963 111:1129 112:568 113:792 114:732 115:987 116:977 117:818 118:1124 119:1287 120:366 121:740 122:1872 123:1249 124:1387 125:1422 128:614 129:221 130:318 131:671 132:351 133:161 134:287 135:67 136:272 137:267 138:348 139:180 140:196 141:325 142:554 143:387 144:493 145:100 146:529 147:490 148:691 149:356 150:152 151:581 152:416 153:195 154:30 155:480 156:274 157:409 158:284 159:754 160:350 161:458 162:629 163:226 164:626 165:561 166:256 167:606 168:1033 169:125 170:1083 171:194 172:25 173:1600 174:520 175:499 176:1190 177:2148 178:1907 179:113 180:1528 181:706 182:1264 183:436 184:633 185:809 186:2475 187:1448 188:1896 189:1308 190:7263 192:6915 193:5705 194:4650 195:3573 196:1340 197:1011 198:4664 199:5445 200:6059 201:2608 202:8941 203:8920 204:4521 205:2619 206:2835 207:2901 208:4003 209:3623 210:2945 211:1560 212:2265 213:2056 214:919 215:100 216:5287 217:1653 218:623 219:312 220:1277 221:557 222:326 223:499 End of report

1 0

Re: The US government has betrayed the Internet. We need to take it back
by Larry Sheldon 06 Sep '13

06 Sep '13

On 9/6/2013 5:23 AM, Bryan Tong wrote: > That and ignoring it will only continue to affect the code/silicon arena. > Social problems are always affected by who throws the biggest fit. > > > On Fri, Sep 6, 2013 at 4:18 AM, Randy Bush <randy(a)psg.com> wrote: > >>>> We engineers built the Internet – and now we have to fix it >>> There are no purely technical solutions to social ills. >> >> no. there are many issues in many arenas. but we are responsible for >> cleaning up our side of the street. We need to think bigger than "whatever it takes to get along to the end of the quarter....: -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Mail best practices?
by Deepak Jain 06 Sep '13

06 Sep '13

Without going to a dedicated list for something like this, I'm looking for a common sense approach. Sep 3 17:55:20 XXX sendmail[155]: r83Lse37000155: rejecting commands from outmail016.ash2.facebook.com [66.220.155.150] due to pre-greeting traffic Sep 3 17:55:22 XXX sendmail[156]: r83Lsg6N000156: rejecting commands from outmail015.ash2.facebook.com [66.220.155.149] due to pre-greeting traffic Isn't this sort of thing supposed to be frowned upon still? I am not trying to name & shame here, but I figured this is a pretty big/respectable email sender. Thoughts for balancing sensible network spam management with sensible best practices that affect lots of users? Thanks in advance, Deepak

4 4

FW: Yahoo Maintenance Notification for CoreSite - Any2 Denver
by Eric Louie 05 Sep '13

05 Sep '13

For any Yahoo peers at Coresite, FYI - I'm expecting to lose my BGP peer for a portion of their maintenance. > -----Original Message----- > From: CoreSite OSC [mailto:osc@coresite.com] > Sent: Thursday, September 05, 2013 3:50 PM > Cc: CoreSite OSC; netops > Subject: FW: Yahoo Maintenance Notification for CoreSite - Any2 Denver > > Message forwarded from Yahoo. > > Operations Support Center > > CORESITE > (NYSE: COR) > +1.866.777.CORE (Prompt 2) > > OSC(a)CoreSite.com | www.CoreSite.com > > > -----Original Message----- > From: Nevin Gonsalves [mailto:nevin@yahoo-inc.com] > Sent: Thursday, September 05, 2013 9:43 AM > To: CoreSite OSC; Any2 > Subject: Yahoo Maintenance Notification for CoreSite - Any2 Denver > > Can you please help forward this notify to peers and if possible cc > peering(a)yahoo-inc.com - thx. > > > > Hi Peers, > > > Yahoo will be performing a maintenance on our router at CoreSite - Any2 > Denver. This will affect all peering sessions on our routers. > > > Exchange peering IPv4: 206.51.46.25 and Ipv6: 2605:6c00:303:303::25 > ASN: 10310 > Start:2013/09/05 18:00 PDT > End: 2013/09/05 21:00 PDT > Peering details: as10310.peeringdb.com > > > Thanks, > Nevin Gonsalves > Nevin(a)yahoo-inc.com / peering(a)yahoo-inc.com >

2 1

Data Mining/Crawling through a Mailing List
by Kasper Adel 05 Sep '13

05 Sep '13

Hello, A bit off topic but i was looking for a way/tool that could crawl through nanog(or other) archives and try to filter most common discussions and things like that, if anyone is aware of such a tool, pls let me know. Thanks, Kim

4 3

Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Eugen Leitl 05 Sep '13

05 Sep '13

----- Forwarded message from liberationtech(a)lewman.us ----- Date: Wed, 4 Sep 2013 22:27:46 -0400 From: liberationtech(a)lewman.us To: liberationtech(a)lists.stanford.edu Subject: Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches Organization: The Tor Project, Inc. X-Mailer: Claws Mail 3.9.2 (GTK+ 2.24.20; x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> On Wed, 4 Sep 2013 20:33:09 -0400 Robert Guerra <rguerra(a)privaterra.org> wrote: > > Curious on people's comments on types of routers, firewalls and > other appliances that might be affected as well as mitigation > strategies. Would installing a pfsense and/or other open source > firewall be helpful in anyway at a home net location? When I read this article, I read core routers and switches at ISPs, like Cisco, Juniper, F5, etc. I don't read this as linksys, dlink, netgear, etc. I'm sure NSA could crack into anything consumer level with ease, it's likely any 4-bit criminal could do it too. However, it makes more sense for NSA to watch the core connectivity points on the Internet, rather than watching individuals, solely from an economic effort versus benefit point of view. When I ran global networks, one can record everything and sort out the individual streams later to find employees doing various layers of fraud or not. There was no point in watching the end points because it was too resource intensive. I'm sure the NSA has analyzed this and come to the same conclusion. There's no point in going after tens of millions of endpoints, when you can own them all with a handful of switches. A counterpoint is that most core Internet routers and switches are running at capacity and any monitoring affects quality of service and gets customers complaining. -- Andrew http://tpo.is/contact pgp 0x6B4D6475 -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

2 1

Re: Yahoo is now recycling handles
by Peter Kristolaitis 05 Sep '13

05 Sep '13

On 9/5/2013 1:20 AM, Larry Sheldon wrote: > On 9/4/2013 11:56 PM, Peter Kristolaitis wrote: >> On 9/5/2013 12:17 AM, Valdis.Kletnieks(a)vt.edu wrote: >>> On Wed, 04 Sep 2013 20:47:40 -0500, Leo Bicknell said: >>>> There's still the much more minor point that when I tried to "self >>>> serve" I ended up at a blank page on the Yahoo! web site, hopefully >>>> they >>>> will figure that out as well. >>> I'm continually amazed at the number of web designers that don't test >>> their pages with NoScript enabled. Just sayin'. >> >> NoScript? That's some kind of antimalvirus thingy for Internet >> Explorer, right? I think I read something about that in the Website >> Design For Dimwits in 24 Hours book... ;) > > I would not use IE on a bet, but I do use NoScript as well as several > other defensive weapons. > > I probably do not give a big rats patotie what your site offers--I > know it won't be good. > I assume that you intended this for the list and not me directly, and that you haven't yet got around to reading "Things To Experience On The Internet, Volume 1: Sarcasm". :) In case it wasn't abundantly clear, my post was a shot at what often passes for "web developer" these days. I had hoped that "antimalvirus" would have been an indication that it was a joke, but I guess my sarcasm is rusty... I would hope that no one on this list is ignorant of both the failings of IE and of the existence of NoScript.

1 0

Re: NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Scott Weeks 04 Sep '13

04 Sep '13

--- eugen(a)leitl.org wrote: From: Eugen Leitl <eugen(a)leitl.org> “No one updates their routers,” he says. “If you think people are bad about patching Windows and Linux (which they are) then they are … horrible about updating their networking gear because it is too critical, and usually they don’t have redundancy to be able to do it properly.” ------------------------------------------------------ So, they're saying upgrade to every new OS that comes out? Plus, isn't spelling a requirement for journalists these days??? "...patching Windows and Linux (which they are) then they are..." ------------------------------------------------------ Hijacking routers and switches could allow the NSA to do more than just eavesdrop on all the communications crossing that equipment. It would also let them bring down networks or prevent certain communication, such as military orders, from getting through, though the Post story doesn’t report any such activities. With control of routers, the NSA could re-route traffic to a different location, or intelligence agencies could alter it for disinformation campaigns, such as planting information that would have a detrimental political effect or altering orders to re-route troops or supplies in a military operation. ------------------------------------------ This is just confused, like much of the rest of the article. Mostly FUD with a small kernel of fact inside the FUD wrapper. scott

2 1

NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Eugen Leitl 04 Sep '13

04 Sep '13

http://www.wired.com/threatlevel/2013/09/nsa-router-hacking/ NSA Laughs at PCs, Prefers Hacking Routers and Switches BY KIM ZETTER09.04.136:30 AM Photo: Santiago Cabezas/Flickr The NSA runs a massive, full-time hacking operation targeting foreign systems, the latest leaks from Edward Snowden show. But unlike conventional cybercriminals, the agency is less interested in hacking PCs and Macs. Instead, America’s spooks have their eyes on the internet routers and switches that form the basic infrastructure of the net, and are largely overlooked as security vulnerabilities. Under a $652-million program codenamed “Genie,” U.S. intel agencies have hacked into foreign computers and networks to monitor communications crossing them and to establish control over them, according to a secret black budget document leaked to the Washington Post. U.S. intelligence agencies conducted 231 offensive cyber operations in 2011 to penetrate the computer networks of targets abroad. This included not only installing covert “implants” in foreign desktop computers but also on routers and firewalls — tens of thousands of machines every year in all. According to the Post, the government planned to expand the program to cover millions of additional foreign machines in the future and preferred hacking routers to individual PCs because it gave agencies access to data from entire networks of computers instead of just individual machines. Most of the hacks targeted the systems and communications of top adversaries like China, Russia, Iran and North Korea and included activities around nuclear proliferation. The NSA’s focus on routers highlights an often-overlooked attack vector with huge advantages for the intruder, says Marc Maiffret, chief technology officer at security firm Beyond Trust. Hacking routers is an ideal way for an intelligence or military agency to maintain a persistent hold on network traffic because the systems aren’t updated with new software very often or patched in the way that Windows and Linux systems are. “No one updates their routers,” he says. “If you think people are bad about patching Windows and Linux (which they are) then they are … horrible about updating their networking gear because it is too critical, and usually they don’t have redundancy to be able to do it properly.” He also notes that routers don’t have security software that can help detect a breach. “The challenge [with desktop systems] is that while antivirus don’t work well on your desktop, they at least do something [to detect attacks],” he says. “But you don’t even have an integrity check for the most part on routers and other such devices like IP cameras.” Hijacking routers and switches could allow the NSA to do more than just eavesdrop on all the communications crossing that equipment. It would also let them bring down networks or prevent certain communication, such as military orders, from getting through, though the Post story doesn’t report any such activities. With control of routers, the NSA could re-route traffic to a different location, or intelligence agencies could alter it for disinformation campaigns, such as planting information that would have a detrimental political effect or altering orders to re-route troops or supplies in a military operation. According to the budget document, the CIA’s Tailored Access Programs and NSA’s software engineers possess “templates” for breaking into common brands and models of routers, switches and firewalls. The article doesn’t say it, but this would likely involve pre-written scripts or backdoor tools and root kits for attacking known but unpatched vulnerabilities in these systems, as well as for attacking zero-day vulnerabilities that are yet unknown to the vendor and customers. “[Router software is] just an operating system and can be hacked just as Windows or Linux would be hacked,” Maiffret says. “They’ve tried to harden them a little bit more [than these other systems], but for folks at a place like the NSA or any other major government intelligence agency, it’s pretty standard fare of having a ready-to-go backdoor for your [off-the-shelf] Cisco or Juniper models.” Not all of the activity mentioned in the budget document involved remote hacking. In some cases, according to the document, the operations involved clandestine activity by the CIA or military intelligence units to “physically place hardware implants or software modifications” to aid the spying. “Much more often, an implant is coded entirely in software by an NSA group called Tailored Access Operations (TAO),” the Post writes in its story about the document. “As its name suggests, TAO builds attack tools that are custom-fitted to their targets.” A handful of security researchers have uncovered vulnerabilities in routers in recent years that could be used to do the kind of hacking described in the budget document. In 2005, security researcher Mike Lynn found a serious vulnerability in Cisco IOS, the operating system running on millions of Cisco routers around the world. Lynn discovered the vulnerability after his employer, Internet Security Systems, asked him to reverse-engineer the Cisco operating system to see if he could find security problems with it. Cisco makes the majority of the routers that operate the backbone of the internet as well as many company networks and critical infrastructure systems. The Cisco IOS is as ubiquitous in the backbone as the Windows operating system is on desktops. The vulnerability Lynn found, in a new version of the operation system that Cisco planned to release at the time, would have allowed someone to create a router worm that would shut down every Cisco router through which it passed, bringing down a nation’s critical infrastructure. It also would have allowed an attacker to gain complete control of the router to sniff all traffic passing through a network in order to read, record or alter it, or simply prevent traffic from reaching its recipient. Once Lynn found the vulnerability, it took him six months to develop a working exploit to attack it. Lynn had planned to discuss the vulnerability at the Black Hat security conference in Las Vegas, until Cisco intervened and forced him to pull the talk under threat of a lawsuit. But if Lynn knew about the vulnerability, there were likely others who did as well — including intelligence agencies and criminal hackers. Source code for Cisco’s IOS has been stolen at least twice, either by entities who were interested in studying the software to gain a competitive advantage or to uncover vulnerabilities that would allow someone to hack or control them. Other researchers have uncovered different vulnerabilities in other Cisco routers that are commonly used in small businesses and home offices. Every year at computer security conferences — including the Black Hat conference where NSA Director Keith Alexander presented a keynote this year — U.S. intelligence agencies and contractors from around the world attend to discover information about new vulnerabilities that might be exploited and to hire talented researchers and hackers capable of finding more vulnerabilities in systems. In 2008, a researcher at Core Security Technologies developed a root kit for the Cisco IOS that was designed to give an attacker a persistent foothold on a Cisco router while remaining undetected. According to the Post story, the NSA designs most of the offensive tools it uses in its Genie operation, but it spent $25.1 million in one year for “additional covert purchases of software vulnerabilities” from private malware vendors who operate on the grey market — closed markets that peddle vulnerabilities and exploits to law enforcement and intelligence agencies, as opposed to the black market that sells them to cyber criminals. The price of vulnerabilities and exploits varies, depending on a number of factors. Vulnerabilities and exploits can sell for anywhere from $50,000 to more than a million, depending on the exclusivity of the purchase — some vulnerabilities are sold to multiple parties with the understanding that others are using it as well — and their ubiquity. A vulnerability that exists in multiple versions of an operating system is more valuable than a vulnerability that exists in just one version. A class of vulnerability that crosses multiple browser brands is also more valuable than a single vulnerability that just affects the Safari browser or Chrome. The Stuxnet cyber weapon that was reportedly created by the U.S. and Israel to sabotage centrifuges used in Iran’s uranium enrichment program, used five zero-day exploits to spread itself among systems in Iran, including a rare exploit that attacked the .LNK function in multiple versions of the Windows operating system in order to spread the worm silently via infected USB sticks. Ubiquitous router vulnerabilities are difficult to find since there are so many different configurations for routers, and an attack that works against one router configuration might not work for another. But a vulnerability that affects the core operating system is much more valuable since it is less likely to be dependent on the configuration. Maiffret says there hasn’t been a lot of public research on router vulnerabilities, but whenever someone has taken a look at them, they have found security holes in them. “They’re always successful in finding something,” he says. Once a vulnerability becomes known to the software maker and is patched, it loses a lot of its value. But because many users and administrators do not patch their systems, some vulnerabilities can be used effectively for years, even after a patch is available. The Conficker worm, for example, continued to infect millions of computers long after Microsoft released a patch that should have stopped the worm from spreading. Routers in particular often remain unpatched because system administrators don’t think they will be targeted and because administrators are concerned about network outages that could occur while the patch is applied or if the patch is faulty. Kim Zetter is a senior reporter at Wired covering cybercrime, privacy, security and civil liberties. Read more by Kim Zetter Follow @KimZetter and @ThreatLevel on Twitter.

1 0