May 2014 - Test - lists.nanog.org

Large DDoS, small extortion
by Beleaguered Admin 24 May '14

24 May '14

Apologies for the non-personal email address, but I don't want to give our attacker any additional information than I need to. I'd be happy to send personal contact/ASN information to any nanog admins or regular members of nanog if it's useful. Over the past year or so, we (a decent sized tier 2 with a nationwide US backbone) have had several large DDoS attacks from what appear to be the same person who is (we presume) going down something like the alexa list of top sites, attacking them, and asking for small amounts of money to stop. This has been going on for a long time -- almost every detail is exactly the same as what is described here: http://it.slashdot.org/story/12/11/03/1846252/ask-slashdot-how-to-deal-with… and more recently: http://techcrunch.com/2014/03/03/meetup-suffering-significant-ddos-attack-t… and: https://gist.github.com/dhh/9741477 And I believe attacks including vimeo, github, and others. The attacker is smarter than many random attackers, or at least has better tools. He watches when you mitigate the attack, and shifts his attack to something new. He (or his tools) also watch DNS for the thing he's attacking and the attack moves as DNS changes. We've seen UDP amplification (NTP and DNS mainly), syn flood, syn/ack flood, layer 7 cache busting (https://isc.sans.edu/forums/diary/Wordpress+Pingback+DDoS+Attacks/17801/) and others we haven't been able to fully mitigate/identify. The largest we've seen (which isn't the largest we've read about) attacks are over 50Gbit and 10s of millions of pps. He is in regular communication (via whois info and other collected contact data) asking for <$1000 USD sums to stop the attacks. While we are interested in technical means to mitigate the attacks (the syn and syn/acks are brutal, all cores pegged on multicore 10G nic servers just dealing with interrupts), what I'd really like to find out is how to help fix the problem. We've tried to engage upstream providers to help trace the attacks, but have gotten nowhere (they didn't seem to understand that the syn attacks were spoofed, and looking at source IPs didn't matter, we wanted to know the ingress points on their network.) What are the best practices for this? Are there secret code words (http://xkcd.com/806/) we can use to get to someone at our upstreams who might know what we're talking about? Is it worth the time? Is it worth talking to law enforcement? Some of these have been >500k costs to the customer, but we assume the person doing it isn't in any western country, so maybe it doesn't even matter? Thanks.

16 26

help with CF card on Catalyst 6500 with Sup720
by Martin Hotze 24 May '14

24 May '14

Hi, can anyone provide a dd-image from a CF card from a Catalyst 6500 with Sup720, please. We have a refurbished 6500 w/ Sup720-3BXL with an old rommon which is not able to format a CF card. (various other methods with formatting FAT16 on Linux etc. did not work; google search only pointed to format within a running system, but we do not have such a system nearby) IOS image is already present. any help appreciated. thanks, martin

2 1

Re: Large DDoS, small extortion
by Anne P. Mitchell, Esq. 24 May '14

24 May '14

> Law enforcement and victims have different objectives. Law enforcement > wants to find the criminal, gather sufficient evidence to prove their > guilt, then prosecute them. More attacks helps law enforcement. > > The victims, in general, want the attacks to stop. Actually, our experience in this particular case (it is the same person(s) hitting all of the targets, even using the same email addresses, etc.) is that the victims want to find the guy too. In fact, I can say with a fair degree of certainty that the coordinated efforts of a dedicated group of "victims", who have come together without regards to the fact that they are otherwise 'competitors' in business, and who have furnished the agencies with useable technical information about the attacks, have given the agencies a substantial leg up in the investigation. Anne Anne P. Mitchell, Attorney at Law CEO/President Institute for Social Internet Public Policy Member, Cal. Bar Cyberspace Law Committee Author: Section 6 of the Federal CAN-SPAM Act of 2003 Ret. Professor of Law, Lincoln Law School of San Jose

1 0

Re: Oddity
by Larry Sheldon 24 May '14

24 May '14

On 5/23/2014 9:00 PM, Larry Sheldon wrote: > Odd that "comics.com" is dead and "gocomics.com" is "down for Scheduled > Maintenance" at 2000 Central USA time. > > No the Intertubes are not down--lots of stuff is working, but those and > some others are not. (Cox customer out of Omaha). Yes, I considered that they might be the same place. No I have not checked it out. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Oddity
by Larry Sheldon 24 May '14

24 May '14

Odd that "comics.com" is dead and "gocomics.com" is "down for Scheduled Maintenance" at 2000 Central USA time. No the Intertubes are not down--lots of stuff is working, but those and some others are not. (Cox customer out of Omaha). -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: Large DDoS, small extortion
by Larry Sheldon 23 May '14

23 May '14

On 5/23/2014 1:09 PM, Barry Shein wrote: > > On May 24, 2014 at 00:38 rdobbins(a)arbor.net (Roland Dobbins) wrote: > > Never, under any circumstances, pay. Not even if you've persuaded > > the Men from U.N.C.L.E. to help you, and they suggest you pay > > because they think they can trace the money, do not pay. > > Ok, you're recommending $VICTIM ignores or resists the advice of law > enforcement authorities, right? Given the the current status of reputation, ordinary, run-of-the-mill common sense, and a calm, reflective consideration of the obvious, I would say yes, follow the advice that makes sense, but pay NO money, not even as bait. If they want to put up taxpayer money from their budget, I would still worry for the reasons given. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

BGP Update Report
by cidr-report＠potaroo.net 23 May '14

23 May '14

BGP Update Report Interval: 15-May-14 -to- 22-May-14 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS9829 116359 3.4% 70.5 -- BSNL-NIB National Internet Backbone,IN 2 - AS45514 90170 2.6% 332.7 -- TELEMEDIA-SMB-AS-AP Bharti Airtel Ltd., TELEMEDIA Services, for SMB customers,IN 3 - AS13238 75821 2.2% 257.0 -- YANDEX Yandex LLC,RU 4 - AS8402 46535 1.4% 26.9 -- CORBINA-AS OJSC "Vimpelcom",RU 5 - AS28573 44405 1.3% 11.5 -- NET Serviços de Comunicação S.A.,BR 6 - AS4775 35456 1.0% 285.9 -- GLOBE-TELECOM-AS Globe Telecoms,PH 7 - AS10620 25281 0.7% 8.8 -- Telmex Colombia S.A.,CO 8 - AS27738 24997 0.7% 43.3 -- Ecuadortelecom S.A.,EC 9 - AS23752 24978 0.7% 181.0 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 10 - AS41691 19795 0.6% 549.9 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 11 - AS3816 19145 0.6% 22.9 -- COLOMBIA TELECOMUNICACIONES S.A. ESP,CO 12 - AS16625 17281 0.5% 36.5 -- AKAMAI-AS - Akamai Technologies, Inc.,US 13 - AS14259 15757 0.5% 58.8 -- Gtd Internet S.A.,CL 14 - AS25184 14882 0.4% 118.1 -- AFRANET AFRANET Co. Tehran, Iran,IR 15 - AS9583 14774 0.4% 10.2 -- SIFY-AS-IN Sify Limited,IN 16 - AS35819 13516 0.4% 25.0 -- MOBILY-AS Etihad Etisalat Company (Mobily),SA 17 - AS17974 12798 0.4% 4.6 -- TELKOMNET-AS2-AP PT Telekomunikasi Indonesia,ID 18 - AS7552 12552 0.4% 10.1 -- VIETEL-AS-AP Viettel Corporation,VN 19 - AS31148 12438 0.4% 12.2 -- FREENET-AS Freenet Ltd.,UA 20 - AS4766 12243 0.3% 4.2 -- KIXS-AS-KR Korea Telecom,KR TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS60345 10049 0.3% 5024.5 -- NBITI-AS Nahjol Balagheh International Research Institution,IR 2 - AS4 3939 0.1% 824.0 -- ISI-AS - University of Southern California,US 3 - AS45590 2901 0.1% 2901.0 -- HGCINTNET-AS-AP Hutch Connect,HK 4 - AS16321 6691 0.2% 2230.3 -- AICONET-AS Aiconet Ltd.,RU 5 - AS60134 1848 0.1% 1848.0 -- FRESHNET-AS FreshNet Ltd.,UA 6 - AS3 1453 0.0% 1987.0 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 7 - AS54465 7022 0.2% 1404.4 -- QPM-AS-1 - QuickPlay Media Inc.,US 8 - AS52879 7016 0.2% 779.6 -- ABM INFORMATICA E TELECOM,BR 9 - AS37626 1365 0.0% 682.5 -- OceanBrave-AS,NG 10 - AS55393 1320 0.0% 660.0 -- MIDOKURA Midokura Co., Ltd,JP 11 - AS3 640 0.0% 1550.0 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 12 - AS41691 19795 0.6% 549.9 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 13 - AS60135 488 0.0% 488.0 -- WEBSTAR-NET WebStar Ltd.,RU 14 - AS2 5673 0.2% 1131.0 -- UDEL-DCN - University of Delaware,US 15 - AS40173 463 0.0% 463.0 -- IRBS-ASN - IRBS Engineering, Inc.,US 16 - AS22416 441 0.0% 441.0 -- -Reserved AS-,ZZ 17 - AS35093 1251 0.0% 417.0 -- RO-HTPASSPORT HighTech Passport Ltd SUA California San Jose SUCURSALA BUCURESTI ROMANIA,RO 18 - AS45688 1197 0.0% 399.0 -- UT-NSRG The University of Tokyo Interfaculty Initiative in Information Studies,JP 19 - AS11504 380 0.0% 380.0 -- WHITE-CASE-1155 - White & Case,US 20 - AS42561 749 0.0% 374.5 -- GRAD-AS OOO "NTS GRADIENT",RU TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 89.221.206.0/24 19588 0.5% AS41691 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 2 - 202.70.88.0/21 11319 0.3% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 3 - 202.70.64.0/21 11209 0.3% AS23752 -- NPTELECOM-NP-AS Nepal Telecommunications Corporation, Internet Services,NP 4 - 192.58.232.0/24 10690 0.3% AS6629 -- NOAA-AS - NOAA,US 5 - 78.109.192.0/20 10233 0.3% AS25184 -- AFRANET AFRANET Co. Tehran, Iran,IR 6 - 120.28.62.0/24 7829 0.2% AS4775 -- GLOBE-TELECOM-AS Globe Telecoms,PH 7 - 222.127.0.0/24 7639 0.2% AS4775 -- GLOBE-TELECOM-AS Globe Telecoms,PH 8 - 205.247.12.0/24 7614 0.2% AS6459 -- TRANSBEAM - I-2000, Inc.,US 9 - 115.170.128.0/17 7155 0.2% AS4847 -- CNIX-AP China Networks Inter-Exchange,CN 10 - 206.152.15.0/24 7006 0.2% AS54465 -- QPM-AS-1 - QuickPlay Media Inc.,US 11 - 42.83.48.0/20 5921 0.2% AS18135 -- JPNIC-ASBLOCK-AP JPNIC,JP 12 - 78.158.184.0/24 5026 0.1% AS60345 -- NBITI-AS Nahjol Balagheh International Research Institution,IR 13 - 5.160.10.0/24 5023 0.1% AS60345 -- NBITI-AS Nahjol Balagheh International Research Institution,IR 14 - 186.237.56.0/22 3939 0.1% AS4 -- ISI-AS - University of Southern California,US 15 - 112.137.16.0/20 2901 0.1% AS45590 -- HGCINTNET-AS-AP Hutch Connect,HK 16 - 84.205.66.0/24 2754 0.1% AS12654 -- RIPE-NCC-RIS-AS Reseaux IP Europeens Network Coordination Centre (RIPE NCC),EU 17 - 66.171.233.0/24 2542 0.1% AS4436 -- AS-GTT-4436 - nLayer Communications, Inc.,US 18 - 66.171.236.0/24 2542 0.1% AS4436 -- AS-GTT-4436 - nLayer Communications, Inc.,US 19 - 185.27.8.0/22 2531 0.1% AS42525 -- GlobalConnect a/s,DK 20 - 176.116.240.0/20 2233 0.1% AS16321 -- AICONET-AS Aiconet Ltd.,RU Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 23 May '14

23 May '14

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 24 May, 2014 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 495622 Prefixes after maximum aggregation: 194181 Deaggregation factor: 2.55 Unique aggregates announced to Internet: 244818 Total ASes present in the Internet Routing Table: 46929 Prefixes per ASN: 10.56 Origin-only ASes present in the Internet Routing Table: 35829 Origin ASes announcing only one prefix: 16362 Transit ASes present in the Internet Routing Table: 6102 Transit-only ASes present in the Internet Routing Table: 171 Average AS path length visible in the Internet Routing Table: 4.6 Max AS path length visible: 53 Max AS path prepend of ASN ( 50404) 51 Prefixes from unregistered ASNs in the Routing Table: 1728 Unregistered ASNs in the Routing Table: 457 Number of 32-bit ASNs allocated by the RIRs: 6690 Number of 32-bit ASNs visible in the Routing Table: 4998 Prefixes from 32-bit ASNs in the Routing Table: 16799 Number of bogon 32-bit ASNs visible in the Routing Table: 144 Special use prefixes present in the Routing Table: 15 Prefixes being announced from unallocated address space: 434 Number of addresses announced to Internet: 2688488320 Equivalent to 160 /8s, 63 /16s and 19 /24s Percentage of available address space announced: 72.6 Percentage of allocated address space announced: 72.6 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 96.4 Total number of prefixes smaller than registry allocations: 171648 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 117984 Total APNIC prefixes after maximum aggregation: 35204 APNIC Deaggregation factor: 3.35 Prefixes being announced from the APNIC address blocks: 121068 Unique aggregates announced from the APNIC address blocks: 50794 APNIC Region origin ASes present in the Internet Routing Table: 4939 APNIC Prefixes per ASN: 24.51 APNIC Region origin ASes announcing only one prefix: 1229 APNIC Region transit ASes present in the Internet Routing Table: 868 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 24 Number of APNIC region 32-bit ASNs visible in the Routing Table: 961 Number of APNIC addresses announced to Internet: 733553792 Equivalent to 43 /8s, 185 /16s and 36 /24s Percentage of available APNIC address space announced: 85.7 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-63999, 131072-133631 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 168311 Total ARIN prefixes after maximum aggregation: 83445 ARIN Deaggregation factor: 2.02 Prefixes being announced from the ARIN address blocks: 169868 Unique aggregates announced from the ARIN address blocks: 79415 ARIN Region origin ASes present in the Internet Routing Table: 16291 ARIN Prefixes per ASN: 10.43 ARIN Region origin ASes announcing only one prefix: 6133 ARIN Region transit ASes present in the Internet Routing Table: 1679 Average ARIN Region AS path length visible: 4.0 Max ARIN Region AS path length visible: 20 Number of ARIN region 32-bit ASNs visible in the Routing Table: 107 Number of ARIN addresses announced to Internet: 1075771136 Equivalent to 64 /8s, 30 /16s and 247 /24s Percentage of available ARIN address space announced: 56.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 123686 Total RIPE prefixes after maximum aggregation: 62765 RIPE Deaggregation factor: 1.97 Prefixes being announced from the RIPE address blocks: 128237 Unique aggregates announced from the RIPE address blocks: 80797 RIPE Region origin ASes present in the Internet Routing Table: 17689 RIPE Prefixes per ASN: 7.25 RIPE Region origin ASes announcing only one prefix: 8260 RIPE Region transit ASes present in the Internet Routing Table: 2879 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 53 Number of RIPE region 32-bit ASNs visible in the Routing Table: 2711 Number of RIPE addresses announced to Internet: 658457216 Equivalent to 39 /8s, 63 /16s and 66 /24s Percentage of available RIPE address space announced: 95.7 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-202239 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 56758 Total LACNIC prefixes after maximum aggregation: 10069 LACNIC Deaggregation factor: 5.64 Prefixes being announced from the LACNIC address blocks: 63361 Unique aggregates announced from the LACNIC address blocks: 29037 LACNIC Region origin ASes present in the Internet Routing Table: 2095 LACNIC Prefixes per ASN: 30.24 LACNIC Region origin ASes announcing only one prefix: 535 LACNIC Region transit ASes present in the Internet Routing Table: 439 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 25 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 1187 Number of LACNIC addresses announced to Internet: 162006144 Equivalent to 9 /8s, 168 /16s and 4 /24s Percentage of available LACNIC address space announced: 96.6 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 262144-263679 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 11965 Total AfriNIC prefixes after maximum aggregation: 2661 AfriNIC Deaggregation factor: 4.50 Prefixes being announced from the AfriNIC address blocks: 12654 Unique aggregates announced from the AfriNIC address blocks: 4385 AfriNIC Region origin ASes present in the Internet Routing Table: 721 AfriNIC Prefixes per ASN: 17.55 AfriNIC Region origin ASes announcing only one prefix: 205 AfriNIC Region transit ASes present in the Internet Routing Table: 154 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 25 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 32 Number of AfriNIC addresses announced to Internet: 55998976 Equivalent to 3 /8s, 86 /16s and 122 /24s Percentage of available AfriNIC address space announced: 55.6 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2941 11591 922 Korea Telecom 17974 2793 899 72 PT Telekomunikasi Indonesia 7545 2229 320 117 TPG Telecom Limited 4755 1854 396 199 TATA Communications formerly 9829 1642 1307 32 National Internet Backbone 9583 1302 101 534 Sify Limited 9498 1259 314 85 BHARTI Airtel Ltd. 7552 1226 1082 13 Viettel Corporation 4808 1204 2146 359 CNCGROUP IP network China169 24560 1131 393 184 Bharti Airtel Ltd., Telemedia Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 2959 3688 53 BellSouth.net Inc. 22773 2428 2937 133 Cox Communications Inc. 1785 2063 690 151 PaeTec Communications, Inc. 18566 2047 379 178 MegaPath Corporation 20115 1706 1690 566 Charter Communications 4323 1629 1073 413 tw telecom holdings, inc. 701 1471 11190 742 MCI Communications Services, 30036 1417 310 546 Mediacom Communications Corp 6983 1325 800 306 ITC^Deltacom 22561 1307 402 232 CenturyTel Internet Holdings, Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 34984 1704 264 275 TELLCOM ILETISIM HIZMETLERI A 8402 1481 544 16 OJSC "Vimpelcom" 20940 1354 523 1016 Akamai International B.V. 13188 1049 100 28 TOV "Bank-Inform" 8551 1034 370 40 Bezeq International-Ltd 31148 1018 45 19 Freenet Ltd. 6849 822 357 27 JSC "Ukrtelecom" 6830 763 2333 424 Liberty Global Operations B.V 12479 711 795 57 France Telecom Espana SA 9198 574 344 28 JSC Kazakhtelecom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3787 1996 100 NET Serviços de Comunicação S 10620 2864 463 200 Telmex Colombia S.A. 18881 2007 972 21 Global Village Telecom 7303 1755 1174 229 Telecom Argentina S.A. 8151 1407 2945 409 Uninet S.A. de C.V. 6503 1097 434 60 Axtel, S.A.B. de C.V. 7738 978 1882 40 Telemar Norte Leste S.A. 27947 876 114 50 Telconet S.A 26615 859 2324 34 Tim Celular S.A. 3816 824 339 136 COLOMBIA TELECOMUNICACIONES S Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 36998 1114 240 6 Sudanese Mobile Telephone (ZA 24863 961 280 26 Link Egypt (Link.NET) 6713 615 727 32 Office National des Postes et 8452 582 958 13 TE-AS 24835 304 144 9 Vodafone Data 36992 300 783 24 ETISALAT MISR 3741 248 921 209 Internet Solutions 37054 241 19 6 Data Telecom Service 29571 226 22 16 Cote d'Ivoire Telecom 29975 192 668 21 Vodacom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 28573 3787 1996 100 NET Serviços de Comunicação S 6389 2959 3688 53 BellSouth.net Inc. 4766 2941 11591 922 Korea Telecom 10620 2864 463 200 Telmex Colombia S.A. 17974 2793 899 72 PT Telekomunikasi Indonesia 22773 2428 2937 133 Cox Communications Inc. 7545 2229 320 117 TPG Telecom Limited 1785 2063 690 151 PaeTec Communications, Inc. 18566 2047 379 178 MegaPath Corporation 18881 2007 972 21 Global Village Telecom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6389 2959 2906 BellSouth.net Inc. 17974 2793 2721 PT Telekomunikasi Indonesia 10620 2864 2664 Telmex Colombia S.A. 22773 2428 2295 Cox Communications Inc. 7545 2229 2112 TPG Telecom Limited 4766 2941 2019 Korea Telecom 18881 2007 1986 Global Village Telecom 1785 2063 1912 PaeTec Communications, Inc. 18566 2047 1869 MegaPath Corporation 4755 1854 1655 TATA Communications formerly Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65456 PRIVATE 5.109.32.0/19 23456 32bit Transition AS 65456 PRIVATE 5.109.96.0/19 23456 32bit Transition AS 30662 UNALLOCATED 8.2.129.0/24 3356 Level 3 Communicatio 53506 UNALLOCATED 8.17.102.0/23 2828 XO Communications 20260 UNALLOCATED 8.25.160.0/24 3356 Level 3 Communicatio 20260 UNALLOCATED 8.25.161.0/24 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.122.0/24 12180 Internap Network Ser 46473 UNALLOCATED 8.27.124.0/24 12180 Internap Network Ser 22511 UNALLOCATED 8.28.225.0/24 2828 XO Communications 22511 UNALLOCATED 8.36.68.0/24 2828 XO Communications Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 100.64.111.0/24 25019 Autonomus System Number for S 100.88.0.0/16 6697 Republican Unitary Telecommun 100.89.0.0/16 6697 Republican Unitary Telecommun 100.90.0.0/16 6697 Republican Unitary Telecommun 100.91.0.0/16 6697 Republican Unitary Telecommun 100.92.0.0/16 6697 Republican Unitary Telecommun 100.93.0.0/16 6697 Republican Unitary Telecommun 100.94.0.0/16 6697 Republican Unitary Telecommun 100.95.0.0/16 6697 Republican Unitary Telecommun 100.96.0.0/14 6697 Republican Unitary Telecommun Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 >>UNKNOWN<< 41.73.1.0/24 37004 >>UNKNOWN<< 41.73.2.0/24 37004 >>UNKNOWN<< 41.73.10.0/24 37004 >>UNKNOWN<< 41.73.11.0/24 37004 >>UNKNOWN<< 41.73.12.0/24 37004 >>UNKNOWN<< 41.73.13.0/24 37004 >>UNKNOWN<< 41.73.14.0/24 37004 >>UNKNOWN<< 41.73.15.0/24 37004 >>UNKNOWN<< 41.73.16.0/24 37004 >>UNKNOWN<< Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:12 /10:30 /11:91 /12:258 /13:488 /14:970 /15:1703 /16:12973 /17:6894 /18:11718 /19:24475 /20:34440 /21:36984 /22:52781 /23:46370 /24:263330 /25:768 /26:918 /27:384 /28:12 /29:5 /30:0 /31:0 /32:2 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 2002 2047 MegaPath Corporation 6389 1692 2959 BellSouth.net Inc. 22773 1679 2428 Cox Communications Inc. 30036 1254 1417 Mediacom Communications Corp 11492 1175 1215 CABLE ONE, INC. 8402 1174 1481 OJSC "Vimpelcom" 1785 1129 2063 PaeTec Communications, Inc. 36998 1080 1114 Sudanese Mobile Telephone (ZA 6983 1042 1325 ITC^Deltacom 34984 1034 1704 TELLCOM ILETISIM HIZMETLERI A Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1129 2:669 3:3 4:15 5:1013 6:19 8:744 12:1849 13:3 14:998 15:13 16:2 17:32 18:21 20:36 23:892 24:1735 25:1 27:1753 31:1474 32:43 33:2 34:5 36:136 37:1890 38:960 39:7 40:202 41:3192 42:251 44:11 46:2085 47:19 49:704 50:937 52:12 54:47 55:4 57:29 58:1230 59:603 60:407 61:1545 62:1216 63:1960 64:4373 65:2289 66:4213 67:2071 68:1038 69:3339 70:856 71:442 72:2013 74:2652 75:324 76:421 77:1583 78:870 79:712 80:1291 81:1157 82:746 83:758 84:744 85:1299 86:463 87:1168 88:485 89:1826 90:140 91:5696 92:699 93:1751 94:2021 95:1512 96:535 97:364 98:1080 99:48 100:56 101:809 103:4936 105:538 106:170 107:602 108:574 109:2029 110:970 111:1298 112:654 113:844 114:862 115:1127 116:1090 117:943 118:1402 119:1350 120:387 121:818 122:2033 123:1317 124:1424 125:1399 128:578 129:340 130:346 131:662 132:400 133:162 134:317 135:74 136:254 137:296 138:357 139:166 140:213 141:373 142:571 143:439 144:505 145:104 146:609 147:475 148:904 149:357 150:167 151:796 152:424 153:218 154:295 155:484 156:340 157:335 158:242 159:900 160:328 161:553 162:1464 163:234 164:690 165:605 166:281 167:619 168:1050 169:124 170:1422 171:187 172:26 173:1691 174:709 175:603 176:1409 177:3010 178:1999 179:657 180:1730 181:1141 182:1565 183:522 184:705 185:1675 186:2795 187:1573 188:1929 189:1447 190:7439 191:318 192:7289 193:5495 194:4036 195:3496 196:1410 197:641 198:5058 199:5541 200:6241 201:2573 202:9014 203:8892 204:4598 205:2671 206:2932 207:2971 208:3978 209:3722 210:3100 211:1680 212:2296 213:2081 214:879 215:86 216:5522 217:1685 218:581 219:320 220:1289 221:599 222:353 223:589 End of report

1 0

60 Hudson Equinix
by Gabriel Blanchard 23 May '14

23 May '14

Apologies for asking on this list but we're looking for a very minimal amount of space in Equinix @ 60 Hudson. 2U worth of space tops with only 1A worth of power. Is there anyone here willing to sub-lease space that would be interested? Email me off-list. -Gabe

1 0

Re: Large DDoS, small extortion
by Anne P. Mitchell, Esq. 23 May '14

23 May '14

The FBI is all over this, I was coordinating between the agency and several of those first attacked, for a while, and am still in touch with the agency. There is also a private group of the C-level folks of those orgs that have been attacked, who are talking and sharing amongst themselves. For anybody here who has been targeted, contact me offlist (amitchell(a)isipp.com) if you would a) like to be put in touch with the agency contact who is dealing with this (which I highly recommend) and b) if you'd like an invitation to the private group. I'm on digest, so won't see replies to the list very quickly. Anne Anne P. Mitchell, Attorney at Law CEO/President Institute for Social Internet Public Policy Member, Cal. Bar Cyberspace Law Committee Author: Section 6 of the Federal CAN-SPAM Act of 2003 Ret. Professor of Law, Lincoln Law School of San Jose

1 0