October 2016 - Test - lists.nanog.org

Honorary Unsubscribe: Leo Beranek
by Jay R. Ashworth 22 Oct '16

22 Oct '16

How many people remember that Bolt Beranek and Newman was originally an acoustical consultancy, specializing in concert halls? http://www.honoraryunsubscribe.com/leo_beranek.html?awt_l=ACI.7&awt_m=JXfIg… Happy Landings, Leo! Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

2 1

Re: Death of the Internet, Film at 11
by Scott Weeks 22 Oct '16

22 Oct '16

> On Oct 22, 2016 5:11 PM, "Mark Andrews" <marka(a)isc.org> wrote: > One way to deal with this would be for ISP's to purchase DoS attacks > against their own servers (not necessarially hosted on your own > network) then look at which connections from their network attacking > these machines then quarantine these connections after a delay > period so that attacks can't be corollated with quarantine actions > easily. > > This doesn't require a ISP to attempt to break into a customers > machine to identify them. It may take several runs to identify > most of the connections associated with a DoS provider. Josh Reynolds writes: > > And then what? --- marka(a)isc.org wrote: From: Mark Andrews <marka(a)isc.org> They get in someone to clean up their network. When they say it is clean you reconnect them. If this happens more often than once a year you charge them a months fees per additional incident. Have the year timer start when reconnect is requested. You give them what data you have to backup the claim. -------------------------------------------------- I invoke randy's "i encourage my competitor's to do this". scott

1 0

Re: MPLS in the campus Network?
by Marian Ďurkovič 22 Oct '16

22 Oct '16

> Compared to MPLS, a L2 solution with 100 Gb/s interfaces between > core switches and a 10G connection for each buildings looks so much > cheaper. But we worry about future trouble using Trill, SPB, or other > technologies, not only the "open" ones, but specifically the proprietary > ones based on central controller and lots of magic (some colleagues feel > the debug nightmare are garanteed). > > If you had to make such a choice recently, did you choose an MPLS design > even at lower speed ? A year ago we built NREN backbone using TRILL instead of MPLS. 40 POPs, no central controller, RFC standardized TRILL protocol i.e. L2 routing using IS-IS, no STP. See my recent presentation at http://md.bts.sk/sanet-100g-2.pdf for more details. Much easier to setup, operate & maintain than MPLS and obviously much lower cost. Based on 6-months production experience, my recommendation would be to stay away from MPLS in the campus. With kind regards, M.

7 9

Re: Dyn DDoS this AM?
by Alexander Maassen 22 Oct '16

22 Oct '16

Remember ping packets containing +++ATH0 ? Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Alain Hebert <ahebert(a)pubnix.net> Datum: 21-10-16 23:37 (GMT+01:00) Aan: nanog(a)nanog.org Onderwerp: Re: Dyn DDoS this AM? Just a FYI, That "horrific trend" has been happening since some techie got dissed on an IRC channel over 20 years ago. He used a bunch of hosted putters to ICMP flood the IRC server. Whatever the community is behind, until the carriers decide to wise up this will keep happening, that is without talking about the industries being developed around DDoSes events. Enjoy your weekend. ( I ain't on call anymore anyway =D ) ----- Alain Hebert ahebert(a)pubnix.net PubNIX Inc. 50 boul. St-Charles P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443 On 10/21/16 11:52, Brian Davies via NANOG wrote: > +1! > > Well said, Patrick. > > B > > On Friday, October 21, 2016, Patrick W. Gilmore <patrick(a)ianai.net> wrote: > >> I cannot give additional info other than what’s been on “public media”. >> >> However, I would very much like to say that this is a horrific trend on >> the Internet. The idea that someone can mention a DDoS then get DDoS’ed Can >> Not Stand. See Krebs’ on the Democratization of Censorship. See lots of >> other things. >> >> To Dyn and everyone else being attacked: >> The community is behind you. There are problems, but if we stick together, >> we can beat these miscreants. >> >> To the miscreants: >> You will not succeed. Search "churchill on the beaches”. It’s a bit >> melodramatic, but it’s how I feel at this moment. >> >> To the rest of the community: >> If you can help, please do. I know a lot of you are thinking “what can I >> do?" There is a lot you can do. BCP38 & BCP84 instantly come to mind. Sure, >> that doesn’t help Mirai, but it still helps. There are many other things >> you can do as well. >> >> But a lot of it is just willingness to help. When someone asks you to help >> trace an attack, do not let the request sit for a while. Damage is being >> done. Help your neighbor. When someone’s house is burning, your current >> project, your lunch break, whatever else you are doing is almost certainly >> less important. If we stick together and help each other, we can - we WILL >> - win this war. If we are apathetic, we have already lost. >> >> >> OK, enough motivational speaking for today. But take this to heart. Our >> biggest problem is people thinking they cannot or do not want to help. >> >> -- >> TTFN, >> patrick >> >>> On Oct 21, 2016, at 10:55 AM, Chris Grundemann <cgrundemann(a)gmail.com >> <javascript:;>> wrote: >>> Does anyone have any additional details? Seems to be over now, but I'm >> very >>> curious about the specifics of such a highly impactful attack (and it's >>> timing following NANOG 68)... >>> >>> https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts- >> twitter-spotify-reddit/ >>> -- >>> @ChrisGrundemann >>> http://chrisgrundemann.com >>

3 2

Re: Death of the Internet, Film at 11
by Brandon Butterworth 22 Oct '16

22 Oct '16

> "their" Whose addresses are known The "CCVT thingies" you refer to. Unlike spoof attacks these are easy to trace > and who are they known to? Those who were attacked by them or worked on mitigation of the attack. If not this time then they should next time as there will be a next time. > Some work can produce Dyn allocations, I suppose. Indeed, that is what I was saying brandon

2 1

Re: Death of the Internet, Film at 11
by Brandon Butterworth 22 Oct '16

22 Oct '16

> From: Mike Hammett <nanog(a)ics-il.net> > "taken all necessary steps to insure that none of the numerous specific types of CCVT thingies that Krebs and others identified" > > Serious question... how? Well their addresses are now known so one way would be for each ISP to drop traffic from them. If people don't fix them why should these devices stay on the net? If say Comcast has a million of them it might be tricky to scale but not impossible It'd take a bit of effort and care to aggregate and disseminate the data to each responsible AS, there'd be risk of bad guys getting the data and false positives/people spoofing to attack others. They'd also be building a tool that some might try to hijack for other purposes. None of that is an excuse to do nothing as is usually the result with any suggested measure that involves doing work to fix a problem I know ISPs generaly don't want the support calls but they'll end up with them and a legislative burden with commerial liability if they don't sort it out themselves. brandon

3 2

Re: Dyn DDoS this AM?
by Måns Nilsson 21 Oct '16

21 Oct '16

Subject: Re: Dyn DDoS this AM? Date: Sat, Oct 22, 2016 at 01:37:09AM +0200 Quoting Niels Bakker (niels(a)bakker.net) > * mansaxel(a)besserwisser.org (Måns Nilsson) [Sat 22 Oct 2016, 01:27 CEST]: > >Also, do not fall in the "short TTL for service agility" trap. > > Several CDNs, Akamai among them, do use short TTLs for this exact reason. > Server load is constantly monitored and taken into account when crafting DNS > replies. But the problem is that this trashes caching, and DNS does not work without caches. At least not if you want it to survive when the going gets tough. If we're going to solve this we need to innovate beyond the pathetic CNAME chains that todays managed DNS services make us use, and get truly distributed load-balancing decision-making (which only will work if you give it sensible data; a single CNAME is not sensible data) all the way out in the client application. -- Måns Nilsson primary/secondary/besserwisser/machina MN-1334-RIPE +46 705 989668 Well, I'm INVISIBLE AGAIN ... I might as well pay a visit to the LADIES ROOM ...

3 2

Weekly Routing Table Report
by cscora＠apnic.net 21 Oct '16

21 Oct '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 22 Oct, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 615166 Prefixes after maximum aggregation (per Origin AS): 220426 Deaggregation factor: 2.79 Unique aggregates announced (without unneeded subnets): 299813 Total ASes present in the Internet Routing Table: 55044 Prefixes per ASN: 11.18 Origin-only ASes present in the Internet Routing Table: 36336 Origin ASes announcing only one prefix: 15328 Transit ASes present in the Internet Routing Table: 6525 Transit-only ASes present in the Internet Routing Table: 166 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 39 Max AS path prepend of ASN ( 55644) 31 Prefixes from unregistered ASNs in the Routing Table: 56 Unregistered ASNs in the Routing Table: 15 Number of 32-bit ASNs allocated by the RIRs: 15849 Number of 32-bit ASNs visible in the Routing Table: 12183 Prefixes from 32-bit ASNs in the Routing Table: 49137 Number of bogon 32-bit ASNs visible in the Routing Table: 247 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 353 Number of addresses announced to Internet: 2829985572 Equivalent to 168 /8s, 174 /16s and 39 /24s Percentage of available address space announced: 76.4 Percentage of allocated address space announced: 76.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.3 Total number of prefixes smaller than registry allocations: 200615 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 156347 Total APNIC prefixes after maximum aggregation: 42794 APNIC Deaggregation factor: 3.65 Prefixes being announced from the APNIC address blocks: 170253 Unique aggregates announced from the APNIC address blocks: 69829 APNIC Region origin ASes present in the Internet Routing Table: 5173 APNIC Prefixes per ASN: 32.91 APNIC Region origin ASes announcing only one prefix: 1143 APNIC Region transit ASes present in the Internet Routing Table: 946 Average APNIC Region AS path length visible: 4.3 Max APNIC Region AS path length visible: 37 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2439 Number of APNIC addresses announced to Internet: 759730500 Equivalent to 45 /8s, 72 /16s and 145 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 185253 Total ARIN prefixes after maximum aggregation: 89516 ARIN Deaggregation factor: 2.07 Prefixes being announced from the ARIN address blocks: 191091 Unique aggregates announced from the ARIN address blocks: 88732 ARIN Region origin ASes present in the Internet Routing Table: 16165 ARIN Prefixes per ASN: 11.82 ARIN Region origin ASes announcing only one prefix: 5671 ARIN Region transit ASes present in the Internet Routing Table: 1719 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1527 Number of ARIN addresses announced to Internet: 1105174176 Equivalent to 65 /8s, 223 /16s and 158 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 146917 Total RIPE prefixes after maximum aggregation: 72154 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 157661 Unique aggregates announced from the RIPE address blocks: 97134 RIPE Region origin ASes present in the Internet Routing Table: 18137 RIPE Prefixes per ASN: 8.69 RIPE Region origin ASes announcing only one prefix: 7798 RIPE Region transit ASes present in the Internet Routing Table: 3032 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 29 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5079 Number of RIPE addresses announced to Internet: 708755712 Equivalent to 42 /8s, 62 /16s and 193 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 62556 Total LACNIC prefixes after maximum aggregation: 12624 LACNIC Deaggregation factor: 4.96 Prefixes being announced from the LACNIC address blocks: 78731 Unique aggregates announced from the LACNIC address blocks: 37419 LACNIC Region origin ASes present in the Internet Routing Table: 2480 LACNIC Prefixes per ASN: 31.75 LACNIC Region origin ASes announcing only one prefix: 547 LACNIC Region transit ASes present in the Internet Routing Table: 583 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 22 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2870 Number of LACNIC addresses announced to Internet: 170666048 Equivalent to 10 /8s, 44 /16s and 40 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 14899 Total AfriNIC prefixes after maximum aggregation: 3330 AfriNIC Deaggregation factor: 4.47 Prefixes being announced from the AfriNIC address blocks: 17077 Unique aggregates announced from the AfriNIC address blocks: 6379 AfriNIC Region origin ASes present in the Internet Routing Table: 734 AfriNIC Prefixes per ASN: 23.27 AfriNIC Region origin ASes announcing only one prefix: 169 AfriNIC Region transit ASes present in the Internet Routing Table: 180 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 268 Number of AfriNIC addresses announced to Internet: 85176832 Equivalent to 5 /8s, 19 /16s and 178 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5528 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3587 382 248 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2954 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9829 2697 1497 530 BSNL-NIB National Internet Backbone, IN 4766 2658 11127 737 KIXS-AS-KR Korea Telecom, KR 9808 2214 8781 42 CMNET-GD Guangdong Mobile Communication 4755 2053 429 216 TATACOMM-AS TATA Communications formerl 4808 1768 2290 519 CHINA169-BJ China Unicom Beijing Provin 45899 1584 1239 90 VNPT-AS-VN VNPT Corp, VN 24560 1552 517 222 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3542 2965 146 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2196 405 110 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 1943 1992 407 CHARTER-NET-HKY-NC - Charter Communicat 30036 1744 335 322 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1722 5067 656 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1678 848 227 ITCDELTA - Earthlink, Inc., US 701 1610 10674 671 UUNET - MCI Communications Services, In 7018 1485 20492 1048 ATT-INTERNET4 - AT&T Services, Inc., US 16509 1430 2778 479 AMAZON-02 - Amazon.com, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3329 169 15 ALJAWWALSTC-AS , SA 20940 2817 1048 2011 AKAMAI-ASN1 , US 34984 1988 326 359 TELLCOM-AS , TR 13188 1571 99 58 TRIOLAN , UA 12479 1370 1018 46 UNI2-AS , ES 8551 1203 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 6849 1142 355 21 UKRTELNET , UA 8402 1109 544 15 CORBINA-AS Russia, RU 12389 949 1134 422 ROSTELECOM-AS , RU 6830 863 2756 464 LGI-UPC formerly known as UPC Broadband Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3511 542 161 Telmex Colombia S.A., CO 8151 2285 3356 555 Uninet S.A. de C.V., MX 7303 1542 963 248 Telecom Argentina S.A., AR 6503 1420 437 54 Axtel, S.A.B. de C.V., MX 11830 1322 367 57 Instituto Costarricense de Electricidad 6147 1207 377 28 Telefonica del Peru S.A.A., PE 28573 1008 2263 166 CLARO S.A., BR 7738 994 1882 40 Telemar Norte Leste S.A., BR 3816 976 472 200 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 905 125 75 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1184 402 50 LINKdotNET-AS, EG 36903 680 342 128 MT-MPLS, MA 37611 664 67 6 Afrihost, ZA 36992 566 1373 25 ETISALAT-MISR, EG 8452 514 1471 15 TE-AS TE-AS, EG 37492 386 250 69 ORANGE-TN, TN 24835 365 614 17 RAYA-AS, EG 29571 335 37 12 CITelecom-AS, CI 15399 307 35 6 WANANCHI-KE, KE 2018 269 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5528 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3587 382 248 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3542 2965 146 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3511 542 161 Telmex Colombia S.A., CO 39891 3329 169 15 ALJAWWALSTC-AS , SA 17974 2954 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2817 1048 2011 AKAMAI-ASN1 , US 9829 2697 1497 530 BSNL-NIB National Internet Backbone, IN 4766 2658 11127 737 KIXS-AS-KR Korea Telecom, KR 8151 2285 3356 555 Uninet S.A. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3542 3396 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3511 3350 Telmex Colombia S.A., CO 7545 3587 3339 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3329 3314 ALJAWWALSTC-AS , SA 17974 2954 2883 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2214 2172 CMNET-GD Guangdong Mobile Communication 9829 2697 2167 BSNL-NIB National Internet Backbone, IN 18566 2196 2086 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 2056 BELLSOUTH-NET-BLK - BellSouth.net Inc., 4766 2658 1921 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65512 PRIVATE 45.252.244.0/24 45899 VNPT-AS-VN VNPT Corp, VN 65512 PRIVATE 45.252.245.0/24 45899 VNPT-AS-VN VNPT Corp, VN Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 41.73.1.0/24 37004 -Reserved AS-, ZZ 41.73.2.0/24 37004 -Reserved AS-, ZZ 41.73.3.0/24 37004 -Reserved AS-, ZZ 41.73.4.0/24 37004 -Reserved AS-, ZZ 41.73.5.0/24 37004 -Reserved AS-, ZZ 41.73.6.0/24 37004 -Reserved AS-, ZZ 41.73.7.0/24 37004 -Reserved AS-, ZZ 41.73.8.0/24 37004 -Reserved AS-, ZZ 41.73.9.0/24 37004 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:102 /12:274 /13:521 /14:1049 /15:1775 /16:13148 /17:7836 /18:13041 /19:25443 /20:38819 /21:40354 /22:69194 /23:59899 /24:342445 /25:447 /26:343 /27:275 /28:57 /29:33 /30:13 /31:1 /32:32 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 39891 2896 3329 ALJAWWALSTC-AS , SA 22773 2764 3542 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2088 2196 MEGAPATH5-US - MegaPath Corporation, US 30036 1558 1744 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 10620 1430 3511 Telmex Colombia S.A., CO 6389 1393 2095 BELLSOUTH-NET-BLK - BellSouth.net Inc., 6983 1326 1678 ITCDELTA - Earthlink, Inc., US 13188 1300 1571 TRIOLAN , UA 34984 1272 1988 TELLCOM-AS , TR 11492 1232 1326 CABLEONE - CABLE ONE, INC., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1539 2:808 4:23 5:2172 6:32 8:993 12:1804 13:49 14:1739 15:46 16:2 17:100 18:126 20:48 23:1872 24:1811 27:2358 31:1802 32:83 33:4 35:3 36:336 37:2363 38:1279 39:33 40:100 41:2952 42:463 43:1874 44:47 45:2135 46:2581 47:101 49:1213 50:904 51:13 52:560 53:2 54:351 55:6 56:4 57:40 58:1572 59:993 60:378 61:1838 62:1531 63:1934 64:4571 65:2171 66:4298 67:2253 68:1138 69:3297 70:1290 71:562 72:2077 74:2580 75:403 76:416 77:1432 78:1236 79:918 80:1304 81:1402 82:986 83:705 84:887 85:1589 86:478 87:1133 88:555 89:2045 90:222 91:6114 92:930 93:2357 94:2415 95:2483 96:549 97:345 98:945 99:90 100:147 101:1167 103:12636 104:2523 105:125 106:440 107:1434 108:780 109:2436 110:1278 111:1638 112:1085 113:1141 114:1095 115:1686 116:1672 117:1566 118:2070 119:1575 120:938 121:1074 122:2274 123:2000 124:1572 125:1819 128:689 129:449 130:419 131:1335 132:610 133:175 134:512 135:200 136:399 137:407 138:1779 139:432 140:602 141:452 142:672 143:918 144:733 145:165 146:956 147:658 148:1382 149:542 150:661 151:888 152:684 153:300 154:703 155:934 156:531 157:530 158:410 159:1261 160:526 161:732 162:2407 163:578 164:780 165:1109 166:345 167:1187 168:2297 169:666 170:2018 171:254 172:773 173:1772 174:764 175:675 176:1737 177:4117 178:2333 179:1187 180:2151 181:1916 182:2094 183:1010 184:828 185:7753 186:3223 187:2153 188:2220 189:1760 190:7800 191:1316 192:9058 193:5745 194:4479 195:3842 196:1793 197:1241 198:5598 199:5810 200:7145 201:3710 202:10141 203:9818 204:4511 205:2741 206:2994 207:3088 208:3980 209:3891 210:3871 211:2035 212:2742 213:2373 214:876 215:68 216:5726 217:1982 218:812 219:598 220:1641 221:878 222:696 223:1329 End of report

1 0

Re: Dyn DDoS this AM?
by Alexander Maassen 21 Oct '16

21 Oct '16

Feel free to feed me with attack sources. Once those companies notice their precious mail does not arrive at clients. They will attempt to fix things. Sad but true. Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: "Patrick W. Gilmore" <patrick(a)ianai.net> Datum: 21-10-16 17:48 (GMT+01:00) Aan: NANOG list <nanog(a)nanog.org> Onderwerp: Re: Dyn DDoS this AM? I cannot give additional info other than what’s been on “public media”. However, I would very much like to say that this is a horrific trend on the Internet. The idea that someone can mention a DDoS then get DDoS’ed Can Not Stand. See Krebs’ on the Democratization of Censorship. See lots of other things. To Dyn and everyone else being attacked: The community is behind you. There are problems, but if we stick together, we can beat these miscreants. To the miscreants: You will not succeed. Search "churchill on the beaches”. It’s a bit melodramatic, but it’s how I feel at this moment. To the rest of the community: If you can help, please do. I know a lot of you are thinking “what can I do?" There is a lot you can do. BCP38 & BCP84 instantly come to mind. Sure, that doesn’t help Mirai, but it still helps. There are many other things you can do as well. But a lot of it is just willingness to help. When someone asks you to help trace an attack, do not let the request sit for a while. Damage is being done. Help your neighbor. When someone’s house is burning, your current project, your lunch break, whatever else you are doing is almost certainly less important. If we stick together and help each other, we can - we WILL - win this war. If we are apathetic, we have already lost. OK, enough motivational speaking for today. But take this to heart. Our biggest problem is people thinking they cannot or do not want to help. -- TTFN, patrick > On Oct 21, 2016, at 10:55 AM, Chris Grundemann <cgrundemann(a)gmail.com> wrote: > > Does anyone have any additional details? Seems to be over now, but I'm very > curious about the specifics of such a highly impactful attack (and it's > timing following NANOG 68)... > > https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-red… > > -- > @ChrisGrundemann > http://chrisgrundemann.com

1 0

Incapsula | 19551
by stuart clark 20 Oct '16

20 Oct '16

Can someone ping me off list from Incapsula AS 19551 please? Thanks!

1 0