January 2014 - Test - lists.nanog.org

Oklahoma State Univ.
by J. Oquendo 17 Jan '14

17 Jan '14

Yes I know there is UNISOG, not on it anymore. Can someone on that list either forward, or put me in touch with one in the know there (AS5078) concerning things malware related appreciated. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

2 2

Weekly Routing Table Report
by Routing Analysis Role Account 17 Jan '14

17 Jan '14

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 18 Jan, 2014 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 477794 Prefixes after maximum aggregation: 190510 Deaggregation factor: 2.51 Unique aggregates announced to Internet: 236762 Total ASes present in the Internet Routing Table: 45894 Prefixes per ASN: 10.41 Origin-only ASes present in the Internet Routing Table: 35494 Origin ASes announcing only one prefix: 16273 Transit ASes present in the Internet Routing Table: 5985 Transit-only ASes present in the Internet Routing Table: 171 Average AS path length visible in the Internet Routing Table: 4.6 Max AS path length visible: 53 Max AS path prepend of ASN ( 50404) 51 Prefixes from unregistered ASNs in the Routing Table: 2683 Unregistered ASNs in the Routing Table: 638 Number of 32-bit ASNs allocated by the RIRs: 5697 Number of 32-bit ASNs visible in the Routing Table: 4415 Prefixes from 32-bit ASNs in the Routing Table: 13942 Number of bogon 32-bit ASNs visible in the Routing Table: 1 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 1907 Number of addresses announced to Internet: 2658908708 Equivalent to 158 /8s, 123 /16s and 186 /24s Percentage of available address space announced: 71.8 Percentage of allocated address space announced: 71.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 95.4 Total number of prefixes smaller than registry allocations: 166098 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 113736 Total APNIC prefixes after maximum aggregation: 34266 APNIC Deaggregation factor: 3.32 Prefixes being announced from the APNIC address blocks: 116142 Unique aggregates announced from the APNIC address blocks: 48679 APNIC Region origin ASes present in the Internet Routing Table: 4871 APNIC Prefixes per ASN: 23.84 APNIC Region origin ASes announcing only one prefix: 1215 APNIC Region transit ASes present in the Internet Routing Table: 835 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 28 Number of APNIC region 32-bit ASNs visible in the Routing Table: 805 Number of APNIC addresses announced to Internet: 729226752 Equivalent to 43 /8s, 119 /16s and 30 /24s Percentage of available APNIC address space announced: 85.2 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-63999, 131072-133631 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 163574 Total ARIN prefixes after maximum aggregation: 81969 ARIN Deaggregation factor: 2.00 Prefixes being announced from the ARIN address blocks: 164087 Unique aggregates announced from the ARIN address blocks: 75843 ARIN Region origin ASes present in the Internet Routing Table: 15929 ARIN Prefixes per ASN: 10.30 ARIN Region origin ASes announcing only one prefix: 5981 ARIN Region transit ASes present in the Internet Routing Table: 1672 Average ARIN Region AS path length visible: 4.1 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 57 Number of ARIN addresses announced to Internet: 1070986112 Equivalent to 63 /8s, 213 /16s and 243 /24s Percentage of available ARIN address space announced: 56.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 120201 Total RIPE prefixes after maximum aggregation: 61464 RIPE Deaggregation factor: 1.96 Prefixes being announced from the RIPE address blocks: 123838 Unique aggregates announced from the RIPE address blocks: 79301 RIPE Region origin ASes present in the Internet Routing Table: 17579 RIPE Prefixes per ASN: 7.04 RIPE Region origin ASes announcing only one prefix: 8322 RIPE Region transit ASes present in the Internet Routing Table: 2841 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 53 Number of RIPE region 32-bit ASNs visible in the Routing Table: 2572 Number of RIPE addresses announced to Internet: 655129732 Equivalent to 39 /8s, 12 /16s and 124 /24s Percentage of available RIPE address space announced: 95.2 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-200191 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 53681 Total LACNIC prefixes after maximum aggregation: 9906 LACNIC Deaggregation factor: 5.42 Prefixes being announced from the LACNIC address blocks: 59214 Unique aggregates announced from the LACNIC address blocks: 27413 LACNIC Region origin ASes present in the Internet Routing Table: 2058 LACNIC Prefixes per ASN: 28.77 LACNIC Region origin ASes announcing only one prefix: 553 LACNIC Region transit ASes present in the Internet Routing Table: 402 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 35 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 972 Number of LACNIC addresses announced to Internet: 148257824 Equivalent to 8 /8s, 214 /16s and 60 /24s Percentage of available LACNIC address space announced: 88.4 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 262144-263679 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 11827 Total AfriNIC prefixes after maximum aggregation: 2607 AfriNIC Deaggregation factor: 4.54 Prefixes being announced from the AfriNIC address blocks: 12606 Unique aggregates announced from the AfriNIC address blocks: 4071 AfriNIC Region origin ASes present in the Internet Routing Table: 699 AfriNIC Prefixes per ASN: 18.03 AfriNIC Region origin ASes announcing only one prefix: 202 AfriNIC Region transit ASes present in the Internet Routing Table: 147 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 24 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 9 Number of AfriNIC addresses announced to Internet: 49673728 Equivalent to 2 /8s, 245 /16s and 246 /24s Percentage of available AfriNIC address space announced: 49.3 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2941 11558 953 Korea Telecom 17974 2738 902 88 PT Telekomunikasi Indonesia 7545 2139 320 115 TPG Telecom Limited 4755 1812 392 193 TATA Communications formerly 9829 1574 1266 43 National Internet Backbone 9583 1297 101 533 Sify Limited 7552 1233 1080 13 Viettel Corporation 9498 1213 309 68 BHARTI Airtel Ltd. 4808 1158 2121 348 CNCGROUP IP network China169 24560 1093 382 167 Bharti Airtel Ltd., Telemedia Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3028 3688 53 BellSouth.net Inc. 22773 2321 2940 139 Cox Communications Inc. 1785 2151 688 133 PaeTec Communications, Inc. 18566 2048 379 178 MegaPath Corporation 20115 1681 1665 587 Charter Communications 4323 1629 1082 412 tw telecom holdings, inc. 701 1503 11158 772 MCI Communications Services, 30036 1377 297 571 Mediacom Communications Corp 7018 1302 17747 846 AT&T Services, Inc. 6983 1295 756 581 ITC^Deltacom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1856 544 16 OJSC "Vimpelcom" 34984 1367 244 224 TELLCOM ILETISIM HIZMETLERI A 20940 1220 459 919 Akamai International B.V. 13188 1039 100 26 TOV "Bank-Inform" 31148 1013 45 21 Freenet Ltd. 6849 883 363 38 JSC "Ukrtelecom" 8551 849 370 38 Bezeq International-Ltd 6830 769 2327 424 Liberty Global Operations B.V 12479 692 797 55 France Telecom Espana SA 35228 552 246 16 Telefonica UK Limited Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3443 1861 77 NET Serviços de Comunicação S 10620 2701 436 205 Telmex Colombia S.A. 18881 1810 909 21 Global Village Telecom 7303 1741 1164 220 Telecom Argentina S.A. 8151 1387 2880 429 Uninet S.A. de C.V. 11830 869 364 15 Instituto Costarricense de El 7738 846 1626 38 Telemar Norte Leste S.A. 27947 837 93 94 Telconet S.A 6503 836 434 61 Axtel, S.A.B. de C.V. 6147 777 373 27 Telefonica del Peru S.A.A. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 36998 1805 112 5 Sudanese Mobile Telephone (ZA 24863 904 380 28 Link Egypt (Link.NET) 6713 600 653 27 Office National des Postes et 8452 468 956 9 TE-AS 24835 298 144 9 Vodafone Data 3741 247 921 209 Internet Solutions 29571 239 21 14 Cote d'Ivoire Telecom 36992 237 783 24 ETISALAT MISR 15706 219 32 6 Sudatel (Sudan Telecom Co. Lt 29975 192 668 21 Vodacom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3443 1861 77 NET Serviços de Comunicação S 6389 3028 3688 53 BellSouth.net Inc. 4766 2941 11558 953 Korea Telecom 17974 2738 902 88 PT Telekomunikasi Indonesia 10620 2701 436 205 Telmex Colombia S.A. 22773 2321 2940 139 Cox Communications Inc. 1785 2151 688 133 PaeTec Communications, Inc. 7545 2139 320 115 TPG Telecom Limited 18566 2048 379 178 MegaPath Corporation 8402 1856 544 16 OJSC "Vimpelcom" Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6389 3028 2975 BellSouth.net Inc. 17974 2738 2650 PT Telekomunikasi Indonesia 10620 2701 2496 Telmex Colombia S.A. 22773 2321 2182 Cox Communications Inc. 7545 2139 2024 TPG Telecom Limited 1785 2151 2018 PaeTec Communications, Inc. 4766 2941 1988 Korea Telecom 18566 2048 1870 MegaPath Corporation 8402 1856 1840 OJSC "Vimpelcom" 36998 1805 1800 Sudanese Mobile Telephone (ZA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 30662 UNALLOCATED 8.2.129.0/24 3356 Level 3 Communicatio 14728 UNALLOCATED 8.8.192.0/23 3356 Level 3 Communicatio 14728 UNALLOCATED 8.8.196.0/22 3356 Level 3 Communicatio 14728 UNALLOCATED 8.8.200.0/23 3356 Level 3 Communicatio 14728 UNALLOCATED 8.8.202.0/23 3356 Level 3 Communicatio 53506 UNALLOCATED 8.17.102.0/23 2828 XO Communications 62828 UNALLOCATED 8.21.130.0/24 4323 tw telecom holdings, 62850 UNALLOCATED 8.25.147.0/24 46887 Lightower Fiber Netw 20260 UNALLOCATED 8.25.160.0/24 3356 Level 3 Communicatio 20260 UNALLOCATED 8.25.161.0/24 3356 Level 3 Communicatio Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.90.128.0/18 27418 OUTOFWALL INC. 23.91.0.0/19 40676 Psychz Networks 23.91.14.0/24 40676 Psychz Networks 23.91.32.0/19 36315 Servpac Inc. 23.91.80.0/20 21560 Netstream Communications, LLC 23.91.96.0/20 40676 Psychz Networks 23.91.112.0/21 32475 SingleHop 23.91.120.0/21 36351 SoftLayer Technologies Inc. 23.91.128.0/19 5645 TekSavvy Solutions, Inc. 23.91.160.0/19 36493 FIBERNETICS CORPORATION Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:11 /10:30 /11:92 /12:253 /13:475 /14:947 /15:1644 /16:12849 /17:6802 /18:11458 /19:23434 /20:33165 /21:35851 /22:50929 /23:44223 /24:253415 /25:787 /26:945 /27:426 /28:12 /29:14 /30:7 /31:0 /32:9 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 2003 2048 MegaPath Corporation 36998 1771 1805 Sudanese Mobile Telephone (ZA 6389 1698 3028 BellSouth.net Inc. 22773 1565 2321 Cox Communications Inc. 8402 1543 1856 OJSC "Vimpelcom" 30036 1217 1377 Mediacom Communications Corp 1785 1163 2151 PaeTec Communications, Inc. 11492 1157 1194 CABLE ONE, INC. 6983 1036 1295 ITC^Deltacom 31148 957 1013 Freenet Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:935 2:839 3:3 4:15 5:860 6:21 8:634 12:1872 13:3 14:910 15:9 16:3 17:23 18:19 20:36 23:659 24:1751 27:1729 31:1522 32:44 33:2 34:5 36:112 37:1907 38:917 39:3 40:184 41:3301 42:243 44:14 46:2124 47:12 49:670 50:842 52:12 54:44 55:5 56:4 57:26 58:1136 59:594 60:370 61:1500 62:1211 63:1947 64:4372 65:2315 66:4132 67:2057 68:1080 69:3286 70:913 71:501 72:2037 74:2596 75:314 76:308 77:1151 78:1014 79:688 80:1308 81:1078 82:681 83:740 84:649 85:1219 86:429 87:1020 88:510 89:1593 90:145 91:5699 92:646 93:1582 94:2102 95:1478 96:533 97:350 98:1068 99:41 100:29 101:711 103:3968 105:534 106:142 107:380 108:548 109:2039 110:978 111:1207 112:609 113:820 114:774 115:1076 116:1015 117:835 118:1239 119:1296 120:326 121:787 122:1916 123:1268 124:1393 125:1450 128:665 129:236 130:345 131:663 132:353 133:159 134:312 135:74 136:281 137:314 138:351 139:143 140:199 141:354 142:552 143:406 144:500 145:93 146:566 147:432 148:793 149:360 150:149 151:476 152:414 153:206 154:52 155:528 156:317 157:420 158:293 159:831 160:361 161:471 162:1032 163:232 164:668 165:590 166:271 167:639 168:1042 169:123 170:1169 171:187 172:12 173:1640 174:680 175:559 176:1360 177:2633 178:1946 179:392 180:1617 181:939 182:1418 183:499 184:636 185:1187 186:2795 187:1440 188:1965 189:1277 190:7326 191:9 192:7038 193:5417 194:4017 195:3384 196:1353 197:1084 198:4823 199:5539 200:6058 201:2536 202:9070 203:8904 204:4509 205:2639 206:2893 207:2846 208:3947 209:3716 210:3078 211:1624 212:2154 213:1972 214:883 215:83 216:5425 217:1726 218:610 219:324 220:1268 221:593 222:334 223:569 End of report

1 0

Internet Routing Registries - RADb, etc
by Blake Hudson 17 Jan '14

17 Jan '14

Can someone provide a little guidance on RADb (and other IRRs)? Our organization is not a customer of any IRRs, but our ARIN IP allocation is registered in RADb and Level3's IRR. The majority of these entries are incorrect and list other AS#'s (AS's that have never been authorized to announce this IP space) as the originating AS for our ARIN IP allocation. I have emailed Level3 about the incorrect entries in their IRR with no response. I have also emailed Cogent about their incorrect entry in RADb, also with no response. Should I be concerned about these entries? Do these entries give someone the ability to announce our IP space? How is the information in these databases checked for accuracy and why did RADb and Level3 put these entries in their database when the posting party was not authorized to announce this space? And finally, what can be done to correct or remove these entries (as a non-customer of either RADb or Level3)? Thanks in advance, --Blake

8 10

Windows Update subnets
by shawn wilson 17 Jan '14

17 Jan '14

Does anyone have a list of all of the ranges Microsoft uses for Windows Update? I've found domains but not a full list of subnets.

2 1

Re: OpenNTPProject.org
by Scott Weeks 16 Jan '14

16 Jan '14

--- marka(a)isc.org wrote: In message <52D7E98B.4040801(a)userid.org>, Pierre Lamy writes: > BCP38 will only ever get implemented if governments and ruling 'net > bodies force deployment. There's otherwise very little benefit seen by > the access network providers, since the targets are other orgs and the > attacks are happening in a different backyard. Except the targets are *everybody* including the access networks. This really is "if you are not part of the solution, you are part of the problem" and applies 100% to access networks. And it doesn't require governments, it just requires CEO's with the gumption to say we are not going to accept routes from you, via transit or direct, until you publically state that you are implementing BCP38 within your network and then follow through. -------------------------------------------------------- Many/most CEOs would not have an understanding of what a BCP is and their first response likely would be to ask, "What's the business case?" Government regulation is also not the answer. They can't all agree on basic crap, much less on some esoteric (in their opinion) netgeekery thingie... scott

3 2

Re: OpenNTPProject.org
by Scott Weeks 16 Jan '14

16 Jan '14

--- dougb(a)dougbarton.us wrote: From: Doug Barton <dougb(a)dougbarton.us> On 01/16/2014 03:45 PM, Scott Weeks wrote: > Many/most CEOs would not have an understanding of what a BCP is and > their first response likely would be to ask, "What's the business > case?" What I've tried to explain to people is that not being used as a botnet will reduce their outbound traffic. It's not much, but it's something. ---------------------------------------------- Maybe it's just Hawaii, but many managers I've had would not be able to understand the importance of that. CEOs? ferget it! Plus I've done only eyeball networks since the early 2000s, so outbound is orders of magnitude lower than inbound and that also means I'm probably biased. I do those things trying to be a good netizen, but I don't tell the managers. It's not even on their radars. Further, I have met a lot of enterprise-level network folks along the way that don't know and/or just don't care. > Government regulation is also not the answer. They can't all agree > on basic crap, much less on some esoteric (in their opinion) netgeekery > thingie... Just have the NSA paint it as a national security issue. :) -------------------------------------------------------------- Since they're p0wning the entire internet globally that's one way to get it implemented, I suppose... :) scott

1 0

Experiences with Spamhaus BGP DROP, EDROP and BGPCC BGP feeds
by ISP Services 16 Jan '14

16 Jan '14

Hi, I am wondering if anyone here has experiences with the Spamhaus DROP, EDROP and BGPCC BGP feeds, for null routing hijacked prefixes, and prefixes which contain (only) mallicious users. http://www.spamhaus.org/bgpf/ We currently already use a Team Cymru feed for null routing bogons. Would you reckon that the Spamhaus lists offer many valid additions to the Team Cymru feeds? Did you have any disputes about prefixes that are announced as malicious use by Spamhaus with customers or other ISP's? Any responses, on or off list are appreciated. Thanks, Dennis Hagens Network Engineer AS 24875

9 11

Re: Internet Routing Registries - RADb, etc
by courtneysmith＠comcast.net 16 Jan '14

16 Jan '14

On 16/01/2014 14:32, Blake Hudson wrote: > Thanks for the responses, these objects are all older. However, none of > them are stale or from previous owners, allocations, etc. Each of these > objects were posted to their respective IRR's after the IP space was > allocated to us. This leads me to believe that the individual IRR's really > do very little checking for accuracy and their usefulness is then > questionable. Oh yeah. I got hit by that sort of thing a week or two back. It wasn't origin: AS14179 / mnt-by: MAINT-AS28071, by any chance? AS14179 have been hijacking chunks of space from the various registries. Nick ------------------------------ Another possible scenario. a.b.c.d/24->small_isp->regional_isp->Level3 Imagine a regional ISP is a customer of Level3. Level3 filters the regional ISP based on Regional ISP's IRR objects. Small ISP buys access from Regional. Small ISP doesn't maintain their own objects. Regional ISP wants Small's business so doesn't force the issue. Regional manually maintains the filters. Regional adds objects under Regional's maintainer whenever Small request a filter change. If they don’t, Level3 wont accept the announcement from them. Customer with a.b.c.d/24 has no idea about any of this. Now we are years later. Customer has either moved to another small ISP or Small ISP found a different regional ISP. a.b.c.d/24->small_isp->new_regional_isp->Level3 or a.b.c.d/24->new_small_isp->new_regional_isp->Level3 The original Regional ISP didnt remember to delete all the objects related to Small ISP's customers. The objects just sit there until one day customer has interest in registring their own object. Customer sees entries for their /24 under Regional ISP's objects. Customer knows they have never done business with Regional. Also the objects are newer than the customer's allocation from their RIR. Customer comes to the conclusion that Regional ISP must have been hi-jacking their space or doing some other naughtiness. Proxy registering objects isn't a good idea. However, the number of networks with allocations from ARIN registering objects in any IRR appears to be extremely low. ARIN doesn’t charge you more to use rr.arin.net. Folks seem to not be aware of IRR or perceive it provides no benefit to them. Will RPKI adoption suffer the same fate?

2 1

[NANOG-announce] NANOG Reminders
by Betty Burke <betty＠nanog.org> 16 Jan '14

16 Jan '14

Colleagues: A few reminders regarding the Education Series, Routing Fundamentals<https://www.nanog.org/meetings/education/routing_fundamentals_class/home>, class Sunday, February 9, 2014 and NANOG 60<https://www.nanog.org/meetings/nanog60/home>, February 10-12, 2014 in Atlanta, GA. In addition to the exciting NANOG 60 activities, NANOG is offering an Educational Series class "Routing Fundamentals" on Sunday, February 9, 2014. This is a great opportunity for folks who would like to advance their Network Operations Career. Registration remains open, and does include a One (1) day NANOG 60 meeting registration. The Program Committee delivered another great NANOG meeting agenda<https://www.nanog.org/meetings/nanog60/agenda>. The NANOG 60 program includes a Keynote address Monday morning, presentations on Security, BGP, Performance Measurement, IPv6, and the ever popular Data Center and Peering tracks. Don't delay, register soon as early Registration<https://www.nanog.org/meetings/nanog60/registration>ends on January 24, 2014, (non-member $450, member $425, student $100), If you, or someone you know, might benefit from a bit of help with travel to attend NANOG 60, please be sure to check out the NANOG Fellowship program<https://www.nanog.org/resources/fellowships>. Don't delay, NANOG 60 selections will be awarded soon. The Education class and NANOG 60 will take place at the Westin Peachtree Plaza. Make your room reservations<https://www.nanog.org/meetings/nanog60/hotelinformation> soon, the room rate of $169. expires, Friday, January 24, 2014. There are a few NANOG 60 Sponsorship Opportunities<https://www.nanog.org/sponsors/opportunities> remaining. Be sure to contact the NANOG Development Committee via marketing(a)nanog.orgto reserve your opportunity. Should you have any questions regarding NANOG activities, feel free to send your message to NANOG-Support(a)nanog.org. We look forward to seeing you in Atlanta! Sincerely, Betty -- Betty Burke NANOG Executive Director 48377 Fremont Boulevard, Suite 117 Fremont, CA 94538 Tel: +1 510 492 4030 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

gmail.com - 550 error for ipv6/PTR ?
by Brandon Applegate 16 Jan '14

16 Jan '14

Just saw this in a message tonight. No idea if this is a transient error or not. --- host gmail-smtp-in.l.google.com [gmail-smtp-in.l.google.com][2607:f8b0:4002:c01::1a] said: 550-5.7.1 [2607:ff70:11::11] Our system has detected that this message does not 550-5.7.1 meet IPv6 sending guidelines regarding PTR records and authentication 550-5.7.1 . Please review 550-5.7.1 https://support.google.com/mail/?p=ipv6_authentication_error [support.google.com] for more 550 5.7.1 information. t26si2290895yhl.255 - gsmtp (in reply to end of DATA command) --- That URL's relevant section says: Additional guidelines for IPv6 The sending IP must have a PTR record (i.e., a reverse DNS of the sending IP) and it should match the IP obtained via the forward DNS resolution of the hostname specified in the PTR record. Otherwise, mail will be marked as spam or possibly rejected. The sending domain should pass either SPF check or DKIM check. Otherwise, mail might be marked as spam. --- I have both of these (PTR's RR has matching AAAA, and I have SPF (but not DKIM)). I'm guessing that something on google's side is misinterpreting some data or other busted logic. I meet all the requirements laid out, and have been sending mail to gmail addresses (via ipv6) since $forever. Off-list replies are fine to minimize noise, and if there is an answer or any meaningful correlation I will reply on-list. Thanks in advance for any info/feedback. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 830B 4802 1DD4 F4F9 63FE B966 C0A7 189E 9EC0 3A74 "SH1-0151. This is the serial number, of our orbital gun."

10 14