November 2016 - Test - lists.nanog.org

Weekly Routing Table Report
by cscora＠apnic.net 11 Nov '16

11 Nov '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 12 Nov, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 621131 Prefixes after maximum aggregation (per Origin AS): 220098 Deaggregation factor: 2.82 Unique aggregates announced (without unneeded subnets): 300375 Total ASes present in the Internet Routing Table: 55165 Prefixes per ASN: 11.26 Origin-only ASes present in the Internet Routing Table: 36323 Origin ASes announcing only one prefix: 15347 Transit ASes present in the Internet Routing Table: 6538 Transit-only ASes present in the Internet Routing Table: 166 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 36 Max AS path prepend of ASN ( 55644) 31 Prefixes from unregistered ASNs in the Routing Table: 64 Unregistered ASNs in the Routing Table: 19 Number of 32-bit ASNs allocated by the RIRs: 16110 Number of 32-bit ASNs visible in the Routing Table: 12304 Prefixes from 32-bit ASNs in the Routing Table: 49851 Number of bogon 32-bit ASNs visible in the Routing Table: 343 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 430 Number of addresses announced to Internet: 2831675172 Equivalent to 168 /8s, 199 /16s and 239 /24s Percentage of available address space announced: 76.5 Percentage of allocated address space announced: 76.5 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.3 Total number of prefixes smaller than registry allocations: 204046 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 157302 Total APNIC prefixes after maximum aggregation: 42681 APNIC Deaggregation factor: 3.69 Prefixes being announced from the APNIC address blocks: 171205 Unique aggregates announced from the APNIC address blocks: 70250 APNIC Region origin ASes present in the Internet Routing Table: 5174 APNIC Prefixes per ASN: 33.09 APNIC Region origin ASes announcing only one prefix: 1146 APNIC Region transit ASes present in the Internet Routing Table: 947 Average APNIC Region AS path length visible: 4.3 Max APNIC Region AS path length visible: 35 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2463 Number of APNIC addresses announced to Internet: 759799108 Equivalent to 45 /8s, 73 /16s and 157 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 187791 Total ARIN prefixes after maximum aggregation: 88833 ARIN Deaggregation factor: 2.11 Prefixes being announced from the ARIN address blocks: 194070 Unique aggregates announced from the ARIN address blocks: 87887 ARIN Region origin ASes present in the Internet Routing Table: 16152 ARIN Prefixes per ASN: 12.02 ARIN Region origin ASes announcing only one prefix: 5666 ARIN Region transit ASes present in the Internet Routing Table: 1708 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1572 Number of ARIN addresses announced to Internet: 1105788576 Equivalent to 65 /8s, 232 /16s and 254 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 147975 Total RIPE prefixes after maximum aggregation: 72517 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 158852 Unique aggregates announced from the RIPE address blocks: 97640 RIPE Region origin ASes present in the Internet Routing Table: 18146 RIPE Prefixes per ASN: 8.75 RIPE Region origin ASes announcing only one prefix: 7810 RIPE Region transit ASes present in the Internet Routing Table: 3036 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 27 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5087 Number of RIPE addresses announced to Internet: 708991744 Equivalent to 42 /8s, 66 /16s and 91 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 62929 Total LACNIC prefixes after maximum aggregation: 12695 LACNIC Deaggregation factor: 4.96 Prefixes being announced from the LACNIC address blocks: 79161 Unique aggregates announced from the LACNIC address blocks: 37605 LACNIC Region origin ASes present in the Internet Routing Table: 2482 LACNIC Prefixes per ASN: 31.89 LACNIC Region origin ASes announcing only one prefix: 557 LACNIC Region transit ASes present in the Internet Routing Table: 596 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 30 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2909 Number of LACNIC addresses announced to Internet: 170859328 Equivalent to 10 /8s, 47 /16s and 27 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 15218 Total AfriNIC prefixes after maximum aggregation: 3364 AfriNIC Deaggregation factor: 4.52 Prefixes being announced from the AfriNIC address blocks: 17413 Unique aggregates announced from the AfriNIC address blocks: 6602 AfriNIC Region origin ASes present in the Internet Routing Table: 735 AfriNIC Prefixes per ASN: 23.69 AfriNIC Region origin ASes announcing only one prefix: 168 AfriNIC Region transit ASes present in the Internet Routing Table: 181 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 273 Number of AfriNIC addresses announced to Internet: 85819392 Equivalent to 5 /8s, 29 /16s and 128 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5545 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3599 382 245 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2962 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9829 2708 1500 539 BSNL-NIB National Internet Backbone, IN 4766 2701 11132 741 KIXS-AS-KR Korea Telecom, KR 9808 2225 8698 32 CMNET-GD Guangdong Mobile Communication 4755 2047 428 215 TATACOMM-AS TATA Communications formerl 4808 1750 2290 513 CHINA169-BJ China Unicom Beijing Provin 45899 1634 1240 96 VNPT-AS-VN VNPT Corp, VN 24560 1564 542 229 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3554 2967 152 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3145 1333 82 SHAW - Shaw Communications Inc., CA 18566 2197 405 110 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 1948 2003 406 CHARTER-NET-HKY-NC - Charter Communicat 30036 1789 340 323 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1730 5067 653 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1678 848 227 ITCDELTA - Earthlink, Inc., US 701 1605 10642 663 UUNET - MCI Communications Services, In 7018 1484 20476 1050 ATT-INTERNET4 - AT&T Services, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3330 170 16 ALJAWWALSTC-AS , SA 20940 2922 1103 2073 AKAMAI-ASN1 , US 34984 1986 326 371 TELLCOM-AS , TR 13188 1626 99 58 TRIOLAN , UA 12479 1367 1033 54 UNI2-AS , ES 8551 1201 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 6849 1142 355 21 UKRTELNET , UA 8402 1140 544 15 CORBINA-AS OJSC "Vimpelcom", RU 9198 1090 352 25 KAZTELECOM-AS , KZ 12389 952 1134 424 ROSTELECOM-AS , RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3529 544 167 Telmex Colombia S.A., CO 8151 2287 3367 554 Uninet S.A. de C.V., MX 7303 1527 963 245 Telecom Argentina S.A., AR 6503 1485 437 54 Axtel, S.A.B. de C.V., MX 11830 1353 368 66 Instituto Costarricense de Electricidad 6147 1288 377 27 Telefonica del Peru S.A.A., PE 7738 1024 1882 41 Telemar Norte Leste S.A., BR 28573 1013 2264 169 CLARO S.A., BR 3816 987 474 192 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 907 126 77 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1190 402 50 LINKdotNET-AS, EG 36903 682 343 139 MT-MPLS, MA 37611 676 67 6 Afrihost, ZA 36992 567 1373 25 ETISALAT-MISR, EG 8452 494 1472 15 TE-AS TE-AS, EG 24835 418 658 16 RAYA-AS, EG 37492 396 288 72 ORANGE-TN, TN 29571 364 37 12 CITelecom-AS, CI 15399 308 35 6 WANANCHI-KE, KE 36974 275 140 11 AFNET-AS, CI Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5545 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3599 382 245 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3554 2967 152 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3529 544 167 Telmex Colombia S.A., CO 39891 3330 170 16 ALJAWWALSTC-AS , SA 6327 3145 1333 82 SHAW - Shaw Communications Inc., CA 17974 2962 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2922 1103 2073 AKAMAI-ASN1 , US 9829 2708 1500 539 BSNL-NIB National Internet Backbone, IN 4766 2701 11132 741 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3554 3402 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3529 3362 Telmex Colombia S.A., CO 7545 3599 3354 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3330 3314 ALJAWWALSTC-AS , SA 6327 3145 3063 SHAW - Shaw Communications Inc., CA 17974 2962 2891 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2225 2193 CMNET-GD Guangdong Mobile Communication 9829 2708 2169 BSNL-NIB National Internet Backbone, IN 18566 2197 2087 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 2056 BELLSOUTH-NET-BLK - BellSouth.net Inc., Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 64855 PRIVATE 41.220.200.0/21 36945 mcelISP, MZ 65001 PRIVATE 46.237.32.0/20 13118 ASN-YARTELECOM PJSC Rostelecom Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.128.12.0/22 55763 UNKNOWN 14.128.12.0/24 55763 UNKNOWN 14.128.13.0/24 55763 UNKNOWN 14.128.15.0/24 55763 UNKNOWN 27.100.7.0/24 56096 UNKNOWN 27.110.192.0/22 45664 UNKNOWN 27.110.196.0/22 45664 UNKNOWN 27.110.200.0/22 45664 UNKNOWN 27.110.204.0/22 45664 UNKNOWN 27.110.224.0/22 45664 UNKNOWN Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:102 /12:274 /13:522 /14:1050 /15:1789 /16:13153 /17:7864 /18:13076 /19:25497 /20:38454 /21:40665 /22:72015 /23:60478 /24:344876 /25:457 /26:357 /27:299 /28:59 /29:34 /30:12 /31:1 /32:32 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 2942 3145 SHAW - Shaw Communications Inc., CA 39891 2896 3330 ALJAWWALSTC-AS , SA 22773 2765 3554 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2089 2197 MEGAPATH5-US - MegaPath Corporation, US 30036 1603 1789 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 10620 1443 3529 Telmex Colombia S.A., CO 6389 1393 2095 BELLSOUTH-NET-BLK - BellSouth.net Inc., 13188 1364 1626 TRIOLAN , UA 6983 1324 1678 ITCDELTA - Earthlink, Inc., US 34984 1275 1986 TELLCOM-AS , TR Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1552 2:817 4:23 5:2238 6:32 8:999 12:1803 13:53 14:1754 15:46 16:2 17:102 18:126 20:48 23:1918 24:1819 27:2356 31:1792 32:83 33:4 35:3 36:349 37:2414 38:1310 39:39 40:102 41:2937 42:451 43:1891 44:47 45:2251 46:2551 47:104 49:1175 50:938 51:15 52:563 53:2 54:350 55:6 56:4 57:40 58:1591 59:997 60:378 61:1840 62:1464 63:1928 64:4585 65:2176 66:4340 67:2258 68:1142 69:3288 70:1288 71:562 72:2064 74:2589 75:405 76:414 77:1436 78:1326 79:914 80:1322 81:1391 82:980 83:712 84:867 85:1584 86:481 87:1124 88:566 89:2040 90:196 91:6124 92:957 93:2370 94:2411 95:2554 96:575 97:344 98:943 99:91 100:147 101:1180 103:12771 104:2582 105:147 106:465 107:1434 108:786 109:2485 110:1278 111:1606 112:1135 113:1150 114:1102 115:1694 116:1682 117:1562 118:2096 119:1574 120:952 121:1088 122:2282 123:2041 124:1587 125:1839 128:690 129:470 130:417 131:1362 132:619 133:175 134:510 135:202 136:394 137:389 138:1796 139:439 140:623 141:462 142:692 143:913 144:711 145:170 146:952 147:665 148:1382 149:554 150:665 151:906 152:684 153:306 154:687 155:943 156:537 157:555 158:434 159:1314 160:562 161:711 162:2426 163:544 164:777 165:1128 166:351 167:1197 168:2342 169:674 170:2276 171:257 172:814 173:1827 174:769 175:710 176:1727 177:4096 178:2378 179:1164 180:2160 181:1896 182:2107 183:1018 184:840 185:7948 186:3177 187:2160 188:2260 189:1798 190:7904 191:1300 192:9129 193:5748 194:4530 195:3850 196:1841 197:1249 198:5619 199:5826 200:7130 201:3720 202:10126 203:9834 204:4503 205:2748 206:3017 207:3114 208:3976 209:3875 210:3895 211:2048 212:2744 213:2422 214:840 215:67 216:5742 217:1982 218:813 219:597 220:1651 221:876 222:712 223:1345 End of report

1 0

AS37135, AS6560, AS32714, AS14029 - Squatted or not? You be the judge.
by Ronald F. Guilmette 11 Nov '16

11 Nov '16

At least one person has now asserted to me in private email that my suggestion that AS30186 was being squatted on was in fact accurate. Thus, I now feel confident enough to provide here the rest of the story which goes along with that. In a nutshell, AS30186 and also two other ASNs, together appear to all be parts of a single large multi-ASN squat. In addition to what appears to be a squat on AS30186 (the former Ross Technology Inc. of Austin, Texas, which even Wikipedia says has been dead for lo these past 18 years) it appears to me, based on the evidence, that the exact same large scale spamming company is, at present, also usurping and squatting on two additional AFRINIC ASNs, namely AS37135 and AS6560. I provide here listings of the current forward resolutions of a sizable number of snowshoe spammer nonsense domain names (more than 1,400 in total) which are currently associated with various portion of several apparently illicitly appropriated AFRINIC /16 blocks: AS37135: http://pastebin.com/raw/PkBagrpJ AS6560 http://pastebin.com/raw/zg9W2agN The affected, and apparently long-orphaned AFRINIC IPv4 blocks involved are as follows. Note that these have each have their own AFRINIC block registration records which indicate that they belong to, among others, a chemicals & power company (155.237.0.0/16), a manufacturer of stainless steel products (160.115.0.0/16), an international mining company (163.197.0.0/16), a manufacturer of fertilizers and nitrogen compounds (163.198.0.0/16), an agricultural chemicals company (164.155.0.0/16), the Directorate of Information Services for the South African government (165.25.0.0), a Seychelles Islands ISP (168.80.16.0/15), and a South African outsourcing and business services company (196.9.0.0/16). Despite these "official" IPv4 block registrations, based on the evidence as shown in the above Pastebin reports, I am forced to conclude that somehow, magically, all of these long-dormant African entities recently began hosting parts of a large scale snowshoe spamming operation, including even the Directorate of Information Services for the South African government, as well as the South African Post Office (196.10.0.0./16), both of which appear to be kindly lending a hand to these spammers also. Here is the list of affected AFRINIC-allocatded IPv4 blocks: 152.108.0.0/16 155.159.0.0/16 155.235.0.0/16 155.237.0.0/16 160.115.0.0/16 160.116.0.0/16 160.122.0.0/16 163.197.0.0/16 163.198.0.0/16 164.155.0.0/16 165.25.0.0/16 168.76.0.0/16 168.80.16.0/15 196.9.0.0/16 196.10.0.0./16 196.16.0.0/14 196.15.64.0/18 Note that AS37135 and AS6560, which I contend are themselves being squatted on, are currently announcing numerous discrete and discreet /20, /21, and /19 blocks out of the above large blocks, perhaps with a view to the future and to switching their announcements to other and different sub-blocks within these same containing blocks, e.g. when they have so throughly sullied the reputations of the blocks they are currently using so as to have caused those blocks to be universally blacklisted everywhere. In any case, here are the current announcements being made by AS37135 and AS6560, respectively. Note that the set of announcements from these ASNs has changed, and significantly, even just within the past 24 hours. What you are seeing here is just the routes being announced by these two suspicious ASNs as I write this. AS37135: 152.108.0.0/19 155.235.80.0/20 155.235.128.0/19 155.235.224.0/19 155.237.128.0/21 155.237.128.0/19 160.115.32.0/20 160.115.48.0/20 160.115.64.0/20 160.115.80.0/20 160.115.96.0/20 160.115.112.0/20 160.116.112.0/20 160.116.160.0/20 160.116.192.0/20 160.122.0.0/19 160.122.128.0/21 160.122.240.0/21 163.198.0.0/20 163.198.64.0/20 168.76.128.0/20 -- Free State Education Department (not routed earlier today) 196.9.32.0/20 196.9.128.0/20 AS6560: 155.159.128.0/20 155.237.64.0/20 155.237.208.0/20 155.237.224.0/20 155.237.240.0/20 163.197.112.0/20 163.197.144.0/20 163.197.176.0/20 163.197.208.0/20 163.197.240.0/20 163.198.16.0/20 163.198.80.0/20 163.198.96.0/20 163.198.144.0/20 163.198.192.0/20 163.198.224.0/20 164.155.0.0/20 164.155.64.0/20 164.155.128.0/20 164.155.192.0/20 165.25.0.0/20 165.25.32.0/20 165.25.64.0/20 165.25.96.0/20 165.25.128.0/20 165.25.160.0/20 165.25.192.0/20 165.25.224.0/20 168.80.16.0/20 168.80.48.0/20 168.80.80.0/20 168.81.16.0/20 168.81.64.0/20 168.81.176.0/20 168.81.224.0/20 196.9.0.0/20 196.9.16.0/20 196.15.64.0/20 196.15.96.0/20 As I was preparing this post, two furter and additional dodgy looking ASNs also came to my attention, and preliminary analysis suggests that these two additional AFRINIC ASNs, AS32714, and AS14029, together with all of the IP space they are announcing, may perhaps also be squatted on at the present time. Given below are the current announcements from these two additional ASNs. Note that AS32714 is currently announcing routes to some South African IP address blocks, as well as to certain German blocks registered to Daimler AG, and also a number of Chinese /18 blocks registered to the Chinese retailing giant Alibaba, Inc... two companies which I suspect do not really require outside help from South Africa in order to obtain routing to their own IP blocks. Interestingly also, the former Zimbabwean ASN AS14029 does not appear to be actually registered to anyone at all at the present time. This minor annoyance does not, apparently prevent it from announcing a number of rather entirely dubious routes via its lone BGP peer AS260. AS32714: 47.93.0.0/18 47.93.64.0/18 47.93.128.0/18 47.93.192.0/18 53.122.1.0/24 53.122.2.0/24 165.10.0.0/16 196.10.64.0/19 AS14029: 41.77.240.0/22 155.159.254.0/24 155.159.255.0/24 160.122.70.0/24 160.122.71.0/24 168.81.254.0/24 168.81.255.0/24 196.10.61.0/24 196.10.62.0/24 196.10.63.0/24 203.212.160.0/20 I will be looking in more depth into AS32714 and AS14029 shortly, but for now I just wanted to make people aware of these additional two rather curious ASNs and the routes they are currently announcing. On a final note, it has not escaped my notice that all three of the ASNs AS37135, AS6560, and AS14029 appear to have only a single common BGP peer, that being AS260, Xconnect24 Inc. I suspect that this is not entirely a matter of coincidence. I have attempted to make contact via email with Xconnect24, but they have not replied to my polite inquiry. For its part, AS32714 also has but a single BGP peer, that being AS6939, Hurricane Electric, Inc. Regards, rfg

1 0

Seeking Google reverse DNS delegation contact
by Ronald F. Guilmette 11 Nov '16

11 Nov '16

Does anyone here happen to know who at Google I should be talking to if I want to ask a question about their reverse DNS services? I'd just like to ask someone there why anyone at Google thought that it would be a Good Idea for Google to provide reverse DNS services for the 204.8.136.0/21 IP address block, a block that appears to be chock-full to the brim of snowshoe spamming domains. http://pastebin.com/raw/VNwmgMHh http://pastebin.com/raw/Hk3SKGvp P.S. I gave up on the "evil" part some time ago. Now, I'm willing to settle for them just not being spammish.

1 0

AS30186 - Squatted or not? You be the judge.
by Ronald F. Guilmette 11 Nov '16

11 Nov '16

I kinda messed up the last time I posted something here about possible IP address block squatting, so I'm not going to make any definitive assertions regarding conclusion this time. I'm just going to lay out the facts and let all of you good folks decide for yourselves. AS30186 is registered to Ross Technology Inc. of Austin, Texas. Also registered to this same entity are the following IPv4 address blocks: 143.187.0.0/16 204.8.136.0/21 Wikipedia kindly provides us with information about this (former) company: https://en.wikipedia.org/wiki/Ross_Technology "Ross Technology, Inc. was a semiconductor design and manufacturing company, specializing in SPARC microprocessors. It was founded in Austin, Texas in August 1988 by Dr. Roger D. Ross,... ... Ross Technology closed down in 1998 and all its assets and patents became the property of Fujitsu Ltd." So, it would appear that we hve a zombie company, with its very own ASN and valuable /16 and /21 IPv4 address blocks to boot. According to the above history, these are all the rightful property of Fujitsu Ltd. Fujitsu Ltd. is not a small or insignificant company, and to the best of my knowledge it is not currently in any sort of financial straits or difficulties. It would thus seem somewhat implausible that Fujitsu, a big "household name" Japanese company would elect to either sell off or sub-lease out their ASN or either of their valuable Ross-related IPv4 address blocks to scumbag snowshoe spammers. Despite this fact however, abundant evidence I've collected recently indicates rather convincingly that both AS30186 and also, at least, the 204.8.136.0/21 address block are, at the present time, inhabited completely and only by a large scale snowshoe spamming operation. Current forward resilutions of numerous interrelated snowshoe spamming domains provide clear evidence of this: http://pastebin.com/raw/hEY1nxct AS30186 is announcing the following routes at the present moment: 143.187.0.0/24 143.187.1.0/24 143.187.2.0/24 143.187.3.0/24 143.187.4.0/22 143.187.8.0/21 143.187.16.0/20 143.187.32.0/19 143.187.64.0/18 143.187.128.0/24 143.187.129.0/24 143.187.130.0/24 143.187.131.0/24 143.187.132.0/22 143.187.136.0/21 143.187.144.0/20 143.187.160.0/19 143.187.192.0/20 143.187.208.0/20 143.187.224.0/20 143.187.240.0/21 143.187.248.0/21 204.8.136.0/21 I have today personally made a number of diligent efforts to contact any warm body at Fujutsu who both (a) speaks English and who also (b) knows hat an ASN is so that I could discuss this matter with some appropriate network administrator, but I was thwarted at every turn by Fujutsu's bureaucracy, despite having spoken by phone to individuals who I was told could help with this sort of thing, first in San Jose, then in Sunnyvale, and finally in the Phillipines. In the event that, as the evidence suggests, some party not associated with Fujutsu is currently making use of Fujutsu's /16 and /21 blocks, one would think that -someone- at the company might be eager to take back possession of these valuable assets, but apparently no one is. Data obtained by me from bgp.he.net suggests that AS30186 is currently connectedf to the Internet only by the following other ASNs: AS19257 - SUBRIGO CORPORATION AS3491 - PCCW Global I have already attempted to make contact via email with both of these companies regarding AS30186, but am still awating any reply from either. So far it is not looking good. In the meantime, I do encourage everyone to look over the content of the pastebin report whose URL is given above, and I encourage everyone to make up his or her own mind regarding the advisability of accepting traffic at the present time from any IPv4 space routed by AS30186. Regards, rfg P.S. The domains associated with the former Ross Technology, Inc. ASN and IPv4 address blocks appear to be part of a larger pattern upon which I will elaborate further in the near future.

1 0

OSPFv3 with IPSec between Cisco and Juniper gears
by Philippe Bonvin 10 Nov '16

10 Nov '16

Hello folks, Quick question about incompatibility between Cisco and Juniper gears. Without IPSec, OSPFv3 is working as expected. I'm trying to configure IPSec authentification of OSPFv3 between a Juniper SRX and a Cisco router but it seems that they didn't agree to a common key length. Can you confirm that this is a well-known problem or give me the right configuration that I should use ? The error message on the juniper: [edit security ipsec security-association ospfv3 manual direction bidirectional authentication key ascii-text] 'ascii-text "..."' Authentication key size must be 20 bytes On the cisco side: cisco(config-if)#ipv6 ospf authentication ipsec spi 256 sha1 0 ? Hex-string SHA-1 key (40 chars)? Here is an output of the config I'm using on the SRX side: ipsec { security-association ospfv3 { mode transport; manual { direction bidirectional { protocol ah; spi 256; authentication { algorithm hmac-sha1-96; key ascii-text "..."; ## SECRET-DATA } } } } } interface ge-0/0/0.0 { ipsec-sa ospfv3; } Thanks for your help, Philippe [EDSI-Tech Sarl]<http://www.edsi-tech.com> Philippe Bonvin, Directeur EDSI-Tech Sàrl<http://www.edsi-tech.com> EPFL Innovation Park, Batiment C, 1015 Lausanne, Suisse | Téléphone: +41 (0) 21 566 14 15, ext. 99 Savoie Technolac, 17 Avenue du Lac Léman, 73375 Le Bourget-du-Lac, France | Téléphone: +33 (0)4 86 15 44 78, ext. 99 Disclaimer: This email is confidential and intended solely for the use of the individual to whom it is addressed. If you are not the intended recipient of this information, be advised that you have received this email in error and that any usage, disclosure, distribution, copying of the information or any part of it in any form whatsoever is strictly prohibited. If you have received this email in error please notify the EDSI-Tech helpdesk by phone on +41 21 566 14 15 and then delete this e-mail.

2 2

Re: OSPF vs ISIS - Which do you prefer & why?
by Joel M Snyder 10 Nov '16

10 Nov '16

>> Vendor support for IS-IS is quite limited - many options for OSPF. >Depends on the vendor. I think you misunderstood his point: it's not the knobs, but the vendors. Generally, when you're trying to integrate random crap into an otherwise well-structured network, you'll find OSPF available, but very rarely IS-IS. I run into this a lot in the security appliance space, where you want your security appliances to either learn or advertise routes internally (VPN tunnel reachability is a big reason for this), but also in devices such as load balancers and other middlebox cruft that occasionally needs to participate in routing advertisement/subscription. Some vendors grab random open source routing protocol code that includes everything and dump it into their boxes, usually accessible via an entirely separate configuration interface; this can include IS-IS, but these implementations rarely actually work as they are usually "check list" implemented for a specific RFP or customer and never get widely tested. The ones who actually care about making it work almost always include RIP and OSPF, with a few shout-outs to BGP. IS-IS (and OSPF v3) rarely makes the cut. In a world where you are doing well-controlled Cisco/Juniper/etc networks with fairly homogeneous code bases, the engineers get to have this discussion. When you have to link in devices for which routing is not their primary reason to exist, your options narrow very quickly. It's not ideal; that's just the way it is. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

6 5

JP Morgan contact
by Tom Storey 10 Nov '16

10 Nov '16

Would anyone from JP Morgan just so happen to be lurking on the list? If so, would you mind contacting me off-list regarding a reachability issue that some of my customers are experiencing with your website(s), specifically jpmpb.com. Thanks Tom

1 0

Re: OSPF vs ISIS - Which do you prefer & why?
by John Kristoff 10 Nov '16

10 Nov '16

On Wed, 9 Nov 2016 17:12:24 +0000 Michael Bullut <main(a)kipsang.com> wrote: > Although there isn't distinct 1:1 argument, it's good we discuss it > here and figure out why one prefer one over the other *(consider a > huge flat network)**.* What say you ladies and gentlemen? I'm not sure it is worthy of an argument. I think I've only ever heard of anyone migrating from one to the other. That was AOL presenting their conversion from OSPF to IS-IS at NANOG a number of years ago: <https://www.nanog.org/meetings/abstract?id=686> The article you refer to more or less covers some of the major differences, largely academic these days. They are close enough alike now that it is probably just best to use what you know or already have running. When I migrated a RIPv2 network to OSPF I don't remember if I consciously choose it over IS-IS for any particular reason or, more likely, just went with it because it seemed like the IETF-preferred way to go. That would have been a dumb reason and later I kind of wish I had used IS-IS, because of the security isolation at layer 2 and relatively modest changes to support IPv6. But I wouldn't go through the trouble of changing it now. There is no compelling reason. I've considered leaving IPv4 on OSPF and putting IPv6 on IS-IS, but I'm not sure it really matters. It might be nice to get the experience on the resume, but that might not be a good justification to the network staff and management for a production network. John

2 1

Re: OT: "Read Receipts"
by Larry Sheldon 09 Nov '16

09 Nov '16

I avoided the other off charter bait, but this is a red dot to me. On 11/6/2016 19:59, Patrick wrote: > Over at Language Hat, they are trying to establish the common > pronunciation of "read receipts" [1] > > To me, they've always just been "DSNs" or "MDNs", however, according to > rfc2298, their history goes back further. > > Of those who lived that history, and actually heard or said "read > receipts", did you pronounce "read" as "reed" or as "red"? I always pronounce them "More danged spam leaking thru the filters" but when I test-read (red) the question, R E A D came out "read (reed)". The burning questions we have to deal with these days, -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

1 0

OT: OpenSRS contact?
by Jessica Litwin 09 Nov '16

09 Nov '16

Apologies if this kind of thing isn't allowed but I'm at the end of my tether. If anyone who works at OpenSRS lurks here, can you contact me off-list? I have an issue support is unwilling or unable to fix and they don't seem too keen on escalating it. // jkl

1 0