December 2015 - Test - lists.nanog.org

Looking for a Network Solution contact
by Eric Sieg 11 Dec '15

11 Dec '15

If you could contact me off list, i'd appreciate it.

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 11 Dec '15

11 Dec '15

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, PaNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 12 Dec, 2015 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 573795 Prefixes after maximum aggregation (per Origin AS): 212506 Deaggregation factor: 2.70 Unique aggregates announced (without unneeded subnets): 279069 Total ASes present in the Internet Routing Table: 52276 Prefixes per ASN: 10.98 Origin-only ASes present in the Internet Routing Table: 36640 Origin ASes announcing only one prefix: 15915 Transit ASes present in the Internet Routing Table: 6406 Transit-only ASes present in the Internet Routing Table: 169 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 37 Max AS path prepend of ASN ( 40285) 34 Prefixes from unregistered ASNs in the Routing Table: 1023 Unregistered ASNs in the Routing Table: 367 Number of 32-bit ASNs allocated by the RIRs: 12048 Number of 32-bit ASNs visible in the Routing Table: 9230 Prefixes from 32-bit ASNs in the Routing Table: 35204 Number of bogon 32-bit ASNs visible in the Routing Table: 15 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 423 Number of addresses announced to Internet: 2813287104 Equivalent to 167 /8s, 175 /16s and 90 /24s Percentage of available address space announced: 76.0 Percentage of allocated address space announced: 76.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 97.8 Total number of prefixes smaller than registry allocations: 188866 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 145489 Total APNIC prefixes after maximum aggregation: 39792 APNIC Deaggregation factor: 3.66 Prefixes being announced from the APNIC address blocks: 153904 Unique aggregates announced from the APNIC address blocks: 61088 APNIC Region origin ASes present in the Internet Routing Table: 5117 APNIC Prefixes per ASN: 30.08 APNIC Region origin ASes announcing only one prefix: 1193 APNIC Region transit ASes present in the Internet Routing Table: 896 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 34 Number of APNIC region 32-bit ASNs visible in the Routing Table: 1743 Number of APNIC addresses announced to Internet: 755731328 Equivalent to 45 /8s, 11 /16s and 139 /24s Percentage of available APNIC address space announced: 88.3 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 131072-135580 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 181116 Total ARIN prefixes after maximum aggregation: 89082 ARIN Deaggregation factor: 2.03 Prefixes being announced from the ARIN address blocks: 184502 Unique aggregates announced from the ARIN address blocks: 86820 ARIN Region origin ASes present in the Internet Routing Table: 16505 ARIN Prefixes per ASN: 11.18 ARIN Region origin ASes announcing only one prefix: 5956 ARIN Region transit ASes present in the Internet Routing Table: 1725 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 37 Number of ARIN region 32-bit ASNs visible in the Routing Table: 875 Number of ARIN addresses announced to Internet: 1113232064 Equivalent to 66 /8s, 90 /16s and 146 /24s Percentage of available ARIN address space announced: 58.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-395164 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 138024 Total RIPE prefixes after maximum aggregation: 68622 RIPE Deaggregation factor: 2.01 Prefixes being announced from the RIPE address blocks: 145940 Unique aggregates announced from the RIPE address blocks: 90428 RIPE Region origin ASes present in the Internet Routing Table: 18037 RIPE Prefixes per ASN: 8.09 RIPE Region origin ASes announcing only one prefix: 7983 RIPE Region transit ASes present in the Internet Routing Table: 2991 Average RIPE Region AS path length visible: 4.7 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 4298 Number of RIPE addresses announced to Internet: 702206592 Equivalent to 41 /8s, 218 /16s and 210 /24s Percentage of available RIPE address space announced: 102.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-204287 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 60416 Total LACNIC prefixes after maximum aggregation: 11871 LACNIC Deaggregation factor: 5.09 Prefixes being announced from the LACNIC address blocks: 73218 Unique aggregates announced from the LACNIC address blocks: 34132 LACNIC Region origin ASes present in the Internet Routing Table: 2461 LACNIC Prefixes per ASN: 29.75 LACNIC Region origin ASes announcing only one prefix: 594 LACNIC Region transit ASes present in the Internet Routing Table: 543 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 23 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2138 Number of LACNIC addresses announced to Internet: 170425600 Equivalent to 10 /8s, 40 /16s and 125 /24s Percentage of available LACNIC address space announced: 101.6 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-265628 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 13465 Total AfriNIC prefixes after maximum aggregation: 3098 AfriNIC Deaggregation factor: 4.35 Prefixes being announced from the AfriNIC address blocks: 15808 Unique aggregates announced from the AfriNIC address blocks: 6241 AfriNIC Region origin ASes present in the Internet Routing Table: 730 AfriNIC Prefixes per ASN: 21.65 AfriNIC Region origin ASes announcing only one prefix: 189 AfriNIC Region transit ASes present in the Internet Routing Table: 170 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 19 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 176 Number of AfriNIC addresses announced to Internet: 71309824 Equivalent to 4 /8s, 64 /16s and 26 /24s Percentage of available AfriNIC address space announced: 70.8 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5584 4192 76 China Education and Research 7545 3059 346 156 TPG Telecom Limited 4766 3016 11136 998 Korea Telecom 17974 2732 914 96 PT Telekomunikasi Indonesia 9829 2190 1414 315 National Internet Backbone 4755 2066 431 234 TATA Communications formerly 9808 1686 8639 18 Guangdong Mobile Communicatio 4808 1568 2273 500 CNCGROUP IP network China169 9583 1519 163 85 Sify Limited 9498 1402 335 112 BHARTI Airtel Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3267 2964 143 Cox Communications Inc. 3356 2591 10692 531 Level 3 Communications, Inc. 6389 2508 3687 42 BellSouth.net Inc. 18566 2212 394 277 MegaPath Corporation 20115 1894 1902 403 Charter Communications 6983 1698 849 239 EarthLink, Inc. 30036 1664 332 341 Mediacom Communications Corp 4323 1577 1021 394 tw telecom holdings, inc. 209 1460 4337 1225 Qwest Communications Company, 701 1395 11447 665 MCI Communications Services, Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 2473 129 7 SaudiNet, Saudi Telecom Compa 20940 2255 895 1619 Akamai International B.V. 34984 1926 321 401 TELLCOM ILETISIM HIZMETLERI A 8551 1438 376 44 Bezeq International-Ltd 8402 1173 544 15 OJSC "Vimpelcom" 13188 1075 97 79 TOV "Bank-Inform" 12479 1054 967 77 France Telecom Espana SA 31148 1042 47 41 Freenet Ltd. 9198 950 349 25 JSC Kazakhtelecom 6830 899 2713 469 Liberty Global Operations B.V Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3418 543 117 Telmex Colombia S.A. 8151 2118 3350 503 Uninet S.A. de C.V. 7303 1580 941 241 Telecom Argentina S.A. 6503 1353 453 58 Axtel, S.A.B. de C.V. 28573 1243 2158 164 NET Serviços de Comunicação S 11830 1094 366 25 Instituto Costarricense de El 6147 1037 376 34 Telefonica del Peru S.A.A. 7738 994 1882 41 Telemar Norte Leste S.A. 3816 974 459 185 COLOMBIA TELECOMUNICACIONES S 26615 960 2325 34 Tim Celular S.A. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1228 1470 14 TE-AS 24863 1133 409 38 Link Egypt (Link.NET) 37611 581 39 38 Afrihost-Brevis Computer Serv 36903 540 272 108 Office National des Postes et 36992 431 1229 32 ETISALAT MISR 37492 325 192 74 Orange Tunisie 29571 244 21 11 Cote d'Ivoire Telecom 24835 234 146 12 Vodafone Data 3741 221 837 183 Internet Solutions 15706 171 32 6 Sudatel (Sudan Telecom Co. Lt Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5584 4192 76 China Education and Research 10620 3418 543 117 Telmex Colombia S.A. 22773 3267 2964 143 Cox Communications Inc. 7545 3059 346 156 TPG Telecom Limited 4766 3016 11136 998 Korea Telecom 17974 2732 914 96 PT Telekomunikasi Indonesia 3356 2591 10692 531 Level 3 Communications, Inc. 6389 2508 3687 42 BellSouth.net Inc. 39891 2473 129 7 SaudiNet, Saudi Telecom Compa 20940 2255 895 1619 Akamai International B.V. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 10620 3418 3301 Telmex Colombia S.A. 22773 3267 3124 Cox Communications Inc. 7545 3059 2903 TPG Telecom Limited 17974 2732 2636 PT Telekomunikasi Indonesia 6389 2508 2466 BellSouth.net Inc. 39891 2473 2466 SaudiNet, Saudi Telecom Compa 3356 2591 2060 Level 3 Communications, Inc. 4766 3016 2018 Korea Telecom 18566 2212 1935 MegaPath Corporation 9829 2190 1875 National Internet Backbone Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 30662 UNALLOCATED 8.2.129.0/24 3356 Level 3 Communicatio 47092 UNALLOCATED 8.8.204.0/24 16410 The Reynolds and Rey 53506 UNALLOCATED 8.17.102.0/23 3356 Level 3 Communicatio 46467 UNALLOCATED 8.19.192.0/24 46887 Lightower Fiber Netw 18985 UNALLOCATED 8.21.68.0/22 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.122.0/24 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.124.0/24 3356 Level 3 Communicatio 27205 UNALLOCATED 8.38.16.0/21 3356 Level 3 Communicatio 15347 UNALLOCATED 8.224.147.0/24 12064 Cox Communications I 33628 UNALLOCATED 12.0.239.0/24 1239 Sprint Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.226.112.0/20 62788 >>UNKNOWN<< 23.249.144.0/20 40430 colo4jax, LLC 23.249.144.0/21 40430 colo4jax, LLC 23.249.152.0/21 40430 colo4jax, LLC 27.100.7.0/24 56096 >>UNKNOWN<< 31.170.96.0/23 23456 32bit Transition AS 31.217.248.0/21 44902 COVAGE NETWORKS SASU 37.46.8.0/23 13768 Peer 1 Network (USA) Inc. 37.46.10.0/23 36351 SoftLayer Technologies Inc. 37.46.14.0/24 36351 SoftLayer Technologies Inc. Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:11 /10:36 /11:100 /12:265 /13:508 /14:1014 /15:1772 /16:12964 /17:7387 /18:12607 /19:25540 /20:37739 /21:39941 /22:63279 /23:54855 /24:314197 /25:544 /26:578 /27:380 /28:16 /29:16 /30:9 /31:0 /32:21 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 22773 2457 3267 Cox Communications Inc. 39891 2432 2473 SaudiNet, Saudi Telecom Compa 18566 2114 2212 MegaPath Corporation 6389 1553 2508 BellSouth.net Inc. 30036 1481 1664 Mediacom Communications Corp 6983 1345 1698 EarthLink, Inc. 10620 1288 3418 Telmex Colombia S.A. 34984 1211 1926 TELLCOM ILETISIM HIZMETLERI A 11492 1140 1230 CABLE ONE, INC. 31148 961 1042 Freenet Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1645 2:705 4:100 5:2050 6:26 8:1410 12:1808 13:29 14:1593 15:23 16:2 17:56 18:19 20:46 22:1 23:1321 24:1740 27:2153 31:1644 32:54 33:2 34:4 35:5 36:185 37:2200 38:1130 39:22 40:76 41:3006 42:369 43:1624 44:36 45:1550 46:2343 47:64 49:1042 50:821 52:35 54:96 55:8 56:8 57:44 58:1416 59:834 60:513 61:1760 62:1463 63:1914 64:4419 65:2189 66:4056 67:2144 68:1090 69:3277 70:1044 71:464 72:1987 74:2554 75:357 76:417 77:1376 78:1261 79:815 80:1326 81:1361 82:854 83:669 84:772 85:1520 86:454 87:1050 88:549 89:1905 90:167 91:5973 92:860 93:2298 94:2208 95:2231 96:472 97:354 98:910 99:45 100:79 101:863 103:9072 104:2189 105:73 106:360 107:1138 108:637 109:2352 110:1226 111:1537 112:871 113:1195 114:901 115:1517 116:1502 117:1326 118:1999 119:1496 120:511 121:1159 122:2255 123:1873 124:1546 125:1740 128:702 129:353 130:389 131:1274 132:575 133:169 134:451 135:119 136:344 137:310 138:1545 139:188 140:247 141:465 142:636 143:722 144:572 145:149 146:806 147:606 148:1269 149:457 150:623 151:813 152:574 153:268 154:467 155:896 156:436 157:446 158:341 159:1061 160:421 161:689 162:2216 163:499 164:709 165:1091 166:313 167:906 168:1341 169:554 170:1479 171:265 172:362 173:1569 174:717 175:763 176:1516 177:3971 178:2279 179:1070 180:2032 181:1618 182:1898 183:656 184:765 185:5123 186:3021 187:1891 188:2096 189:1710 190:7487 191:1221 192:8720 193:5732 194:4316 195:3705 196:2251 197:1141 198:5514 199:5522 200:6677 201:3494 202:9872 203:9293 204:4568 205:2744 206:2989 207:3012 208:4013 209:3971 210:3744 211:2011 212:2624 213:2163 214:836 215:73 216:5740 217:1877 218:742 219:544 220:1635 221:802 222:646 223:865 End of report

1 0

Binge On! - And So This is Net Neutrality?
by Jay Ashworth 11 Dec '15

11 Dec '15

According to: http://www.engadget.com/2015/11/20/fcc-chairman-gives-t-mobiles-binge-on-th… Chairman Wheeler thinks that T-mob's new "customers can get uncapped media stream data, but only from the people we like" service called Binge On is pro-competition. My take on this is that the service is *precisely* what Net Neutrality was supposed to prevent -- carriers offering paid fast-lanes to content providers -- and that this is anti-competitive to the sort of "upstart YouTube" entities that NN was supposed to protect... and that *that* is the competition that NN was supposed to protect. And I just said the same thing two different ways. Cause does anyone here think that T-mob is giving those *carriers* pride of place *for free*? Corporations don't - in my experience - give away lots of money out of the goodness of their hearts. Cheers, -- jr 'whacky weekend' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

31 55

Re: Binge On! - And So This is Net Neutrality?
by Rich Brown 11 Dec '15

11 Dec '15

> On Dec 11, 2015, at 7:00 AM, Chris Adams <cma(a)cmadams.net>wrote: > > Once upon a time, Christopher Morrow <morrowc.lists(a)gmail.com> said: >> On Thu, Dec 10, 2015 at 1:07 PM, William Kenny >> <william.r.kenny(a)gmail.com> wrote: >>> is that still net neutrality? >> >> who cares? mobile was excepted from the NN rulings. > > Any why the desire for extra regulation for Internet services? > > Shippers (you know, actual Common Carriers) do things like this all the > time, especially when they are busy (congested). I had a package ship > Tuesday; it sat at the receiving location for 24 hours before the first > move, then it reached my city early this morning, but since I didn't pay > extra for timed delivery (and the shipper doesn't have special > arrangements), it didn't go on a truck today. I should get it tomorrow. > > I could have paid more to get it faster, and some large-scale shippers > have special arrangements that seem to get their packages priority. How > is this different from Internet traffic? I think this conflates arrangements that retailers/shippers make with each other and the agreements that consumers have with their own network supplier. a) As a customer of a retailer that ships physical packages, my contract is with the retailer. They promise to deliver on a certain date, or they yell at the shipper. b) As an *network subscriber*, my contract/agreement is with my (cable/DSL/satellite/mobile) ISP. I pay them to deliver my bits - without any discussion of where they come from. Most of these agreements don't provide much of a service level. But I still have the understanding that *all* data coming to/from me will have substantially the rate, latency, and packet loss that is advertised. Specifically, I have the expectation that data from two streams (say, one from a Binge On participant, one from an unsubsidized source like an Ubuntu ISO download) should arrive with substantially the same rate, latency and packet loss. I can then remain ignorant/uninvolved with whether any source wants to use CDNs, or to subsidize a subscriber's data plan, or make any other arrangement between the data source and the intervening providers. As long as data is arriving at the contracted rate, I am getting what I paid for. Isn't that a useful and testable basis for understanding Net Neutrality? Doesn't this address (at least part of) the argument about guaranteeing equal access to all content whether subsidized or not?

1 0

Re: Ransom DDoS attack - need help!
by Joe Morgan 10 Dec '15

10 Dec '15

These are the three e-mail addresses they have contacted me on so far. armada.collective(a)bk.ru melvin.webster2(a)gmail.com luciennemcglynn30(a)gmail.com -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615

2 1

Traffic Eng - VM's routing
by WA 10 Dec '15

10 Dec '15

All, I'm working on trying to move VM's from site A to site B, simple enough motion to complete. The issue is the VM's on site A have to stay the same so once the VM's are moved across they still have site A address but are location now on site B, so what happens is return path for the VM traffic will go to site A (typical routing) My questions is for any fellow engineers is have you tried to do this before , I know we can could do some policy routing to control the traffic but has anyone tried this using MPLS TE or by using separate VRF;s Any hints or tips would be awesome! Thanks!

1 0

Re: Ransom DDoS attack - need help!
by Joe Morgan 10 Dec '15

10 Dec '15

We received a similar ransom e-mail yesterday followed by a UDP flood attack. Here is a sample of the attack traffic we received as well as a copy of the ransom e-mail. Thought this might be useful to others who have been targeted as well. I will have to talk with our upstream providers to get a definitive on the size of the attacks. At the point in time we blackholed our ip we were seeing 20+Gbps. *Dec/07/2015 5:40:22PM *Here is a summary of the flows to our web server IP during the ddos event: ================================================ Top 10 flows by packets per pecond for dst IP: 96.43.134.147 Duration Proto Src IP Addr Src Pt Dst Pt Packets pps bps 0.001 UDP 175.43.224.99 1900 22456 2048 2.0 M 5.8 G 0.002 UDP 120.199.113.49 1900 54177 2048 1.0 M 2.8 G 0.002 UDP 27.208.164.227 1900 54177 2048 1.0 M 2.7 G 0.002 UDP 60.209.31.218 1900 16632 2048 1.0 M 3.0 G 0.002 UDP 27.220.71.238 1900 22456 2048 1.0 M 3.0 G 0.002 UDP 120.236.121.9 1900 62005 2048 1.0 M 2.5 G 0.002 UDP 104.137.222.90 1900 14944 2048 1.0 M 3.7 G 0.002 UDP 121.27.133.72 1900 44417 2048 1.0 M 3.0 G 0.002 UDP 92.241.8.75 53 5575 2048 1.0 M 12.4 G 0.002 UDP 120.197.56.134 1900 30672 2048 1.0 M 2.7 G Top 10 flows by flows per second for dst IP: 96.43.134.147 Duration Proto Src IP Addr Src Pt Dst Pt Packets pps bps 248.847 UDP 41.214.2.249 123 47207 8.6 M 34594 133.4 M 248.886 UDP 91.208.136.126 123 63775 6.7 M 26813 103.4 M 150.893 UDP 85.118.98.253 123 47207 5.1 M 33843 130.5 M 151.053 UDP 80.179.166.7 123 63775 5.0 M 33292 128.4 M 151.230 UDP 69.31.105.142 123 47207 4.9 M 32657 125.9 M 150.436 UDP 182.190.0.17 123 45291 4.8 M 32128 123.9 M 248.832 UDP 95.128.184.10 123 63775 4.7 M 19020 73.3 M 150.573 UDP 188.162.13.4 123 42571 4.6 M 30514 117.7 M 150.261 UDP 205.128.68.5 123 45291 4.2 M 27777 107.1 M 149.962 UDP 205.128.68.5 123 42571 4.1 M 27443 105.8 M Top 10 flows by bits per second for dst IP: 96.43.134.147 Duration Proto Src IP Addr Src Pt Dst Pt Packets pps bps 0.002 UDP 92.241.8.75 53 5575 2048 1.0 M 12.4 G 0.003 UDP 190.184.144.74 53 18340 2048 682666 8.3 G 0.003 UDP 190.109.218.69 53 63492 2048 682666 8.3 G 0.004 UDP 103.251.48.245 53 43701 2048 512000 6.2 G 0.004 UDP 46.149.191.239 53 58439 2048 512000 6.2 G 0.001 UDP 175.43.224.99 1900 22456 2048 2.0 M 5.8 G 0.006 UDP 37.72.70.85 53 63909 2048 341333 4.1 G 0.006 UDP 138.204.178.169 53 2162 2048 341333 4.1 G 0.006 UDP 200.31.97.107 53 33765 2048 341333 4.1 G 0.006 UDP 110.164.58.82 53 61397 2048 341333 4.1 G ================================================ Copy of the e-mail headers: Delivered-To: joe(a)joesdatacenter.com Received: by 10.79.27.84 with SMTP id b81csp1190623ivb; Mon, 7 Dec 2015 15:32:22 -0800 (PST) X-Received: by 10.25.88.208 with SMTP id m199mr28948lfb.157.1449531142088; Mon, 07 Dec 2015 15:32:22 -0800 (PST) Return-Path: <armada.collective(a)bk.ru> Received: from f369.i.mail.ru (f369.i.mail.ru. [217.69.141.11]) by mx.google.com with ESMTPS id 7si214394lfk.103.2015.12.07.15.32.21 for <joe(a)joesdatacenter.com> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 07 Dec 2015 15:32:22 -0800 (PST) Received-SPF: pass (google.com: domain of armada.collective(a)bk.ru designates 217.69.141.11 as permitted sender) client-ip=217.69.141.11; Authentication-Results: mx.google.com; spf=pass (google.com: domain of armada.collective(a)bk.ru designates 217.69.141.11 as permitted sender) smtp.mailfrom=armada.collective(a)bk.ru; dkim=pass header.i=(a)bk.ru; dmarc=pass (p=NONE dis=NONE) header.from=bk.ru DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=bk.ru; s=mail; h=Content-Type:Message-ID:Reply-To:Date:MIME-Version:Subject:To:From; bh=1BpwCe2lM8814gJCW/09LwlVtrY6pZtMIFMB0Eprzmw=; b=DKaMWqtH3zre6+R+qmC6+5DTa/o3zx58ubNGalhnEP8cJUtZ/Ln8DnxkQojAdL46g06xlY8rl2QhH07Rm/BHMG9ahsqKSW59F04vcrSv6m6vLnu+4GVwW0ZnRrbkYIaKJohosgdUzUMew9naxuDpF+fD1UqPKCqSs2jgu5071Dw=; Received: from [95.191.131.93] (ident=mail) by f369.i.mail.ru with local (envelope-from <armada.collective(a)bk.ru>) id 1a65GX-0008H5-DO for joe(a)joesdatacenter.com; Tue, 08 Dec 2015 02:32:21 +0300 Received: from [95.191.131.93] by e.mail.ru with HTTP; Tue, 08 Dec 2015 02:32:21 +0300 From: =?UTF-8?B?QXJtYWRhIENvbGxlY3RpdmU=?= <armada.collective(a)bk.ru> To: joe(a)joesdatacenter.com Subject: =?UTF-8?B?UmFuc29tIHJlcXVlc3Q6IEREb1MgQXR0YWNr?= MIME-Version: 1.0 X-Mailer: Mail.Ru Mailer 1.0 X-Originating-IP: [95.191.131.93] Date: Tue, 08 Dec 2015 02:32:21 +0300 Reply-To: =?UTF-8?B?QXJtYWRhIENvbGxlY3RpdmU=?= <armada.collective(a)bk.ru> X-Priority: 3 (Normal) Message-ID: <1449531141.2696669(a)f369.i.mail.ru> Content-Type: multipart/alternative; boundary="--ALT--7N12aTwEB8hvVlFgA0NbUaD4Daicjipu1449531141" X-Mras: Ok X-Spam: undefined Copy of the e-mail: From: Armada Collective <armada.collective(a)bk.ru> Subject: Ransom request: DDoS Attack Message Body: FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY AND CAN MAKE DECISION! We are Armada Collective. If you haven heard for us, use Google. Recently, we have launched some of the largest DDoS attacks in history. Check this out, for example: https://twitter.com/optucker/status/665470164411023360 (and it was measured while we were DDoS-ing 3 other sites at the same time) And this: https://twitter.com/optucker/status/666501788607098880 We will start DDoS-ing your network if you don't pay 20 Bitcoins @ 19zErvraWpnLj4Ga7nsLXh8C52g1zogYJe by Wednesday. Right now we will start small 30 minutes UDP attack on your site IP: 96.43.134.147 It will not be hard, just to prove that we are for real Armada Collective. If you don't pay by Wednesday, massive attack will start, price to stop will increase to 40 BTC and will go up 2 BTC for every hour of attack and attack will last for as long as you don't pay. In addition, we will be contacting affected customers to explain why they are down and recommend them to move to OVH. We will do the same on social networks. Our attacks are extremely powerful - peaks over 1 Tbps per second. Prevent it all with just 20 BTC @ 19zErvraWpnLj4Ga7nsLXh8C52g1zogYJe Do not reply, we will not read. Pay and we will know its you. AND YOU WILL NEVER AGAIN HEAR FROM US! And nobody will ever know you cooperated. -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615

6 6

IEEE OUI regauth (search ?) site
by Brandon Applegate 10 Dec '15

10 Dec '15

They’ve made some changes recently - I had a perl script that would do the lookup and scrape live - it was great. It broke a week or so ago. This seems to be the page to search for OUI: https://regauth.standards.ieee.org/standards-ra-web/pub/view.html <https://regauth.standards.ieee.org/standards-ra-web/pub/view.html> I’ve tried 4 Browsers across 2 OS’s - and that page pops up a “Loading” sub window - flashes and reloads (loop). Anyone have any insight on how one can look up an OUI (yes I know about oui.txt, but I’m asking about a live query site). Thanks in advance. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 830B 4802 1DD4 F4F9 63FE B966 C0A7 189E 9EC0 3A74 "SH1-0151. This is the serial number, of our orbital gun."

5 4

Fw: new important message
by Park Seong Jun 10 Dec '15

10 Dec '15

Hello! New message, please read <http://estoncamlievler76.com/any.php?gw7kn> Park Seong Jun

1 0

Re: Ransom DDoS attack - need help!
by Joe Morgan 10 Dec '15

10 Dec '15

Just an update for those following. We have custom in house software that watches the traffic flows from our edge routers and automatically blackholes any ip getting targeted. The blackhole gets sent upstream which is what we did to maintain the network for our customers during the first attack. We did not suffer any network outage because of the attacks other than our public facing website which honestly is not critical. Since we submitted this thread originally we have gotten two responses from "Armada Collective". One basically a reminder telling us we had 24 hours left to pay. The next came tonight as they were supposed to be hitting us. The second response said they were supposed to be hitting us but decided to give us two more days to get the cash into bitcoin. As of right now we have not replied to them and have no plans to do so. We never had plans to respond or pay them, although telling them whats on my mind sounds appealing. We have contacted the FBI and are working with them providing info. As for protecting our network from future attacks we put all public facing web sites behind Cloudflare and changed the ips from what they were. We left the old ips nulled at our edge and with our providers. We plan to null any ip they decide to hit and and wait it out. As of right now all they have done is take our website offline briefly so not much of a problems as it has not caused our customers issues. Thanks for all the help and info that has been provided and we plan to update this thread as things unfold. I know there are others that have had similar demands (several have reached out off list.) so hopefully the info is useful. -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615

3 2