December 2016 - Test - lists.nanog.org

Quick name and shame -- Apologies but...
by bzs＠theworld.com 31 Dec '16

31 Dec '16

For years, YEARS, Microsoft's OUTLOOK.COM has flooded us with this sort of dictionary spamming on a daily basis. Is there anyone at MS who cares? Surely it's not that difficult to notice someone is blasting stuff like this from your servers every single day for years? Or are your servers just an out of control free-for-all? Do you even know who is using them? If you need another few zillion records like this for motivation just ask. 2016-12-30T16:34:29.342803-05:00 pcls5 sendmail[5627]: NOUSER: jmarkus1 relay=mail-bn3nam01on0058.outbound.protection.outlook.com [104.47.33.58] 2016-12-30T16:34:29.593566-05:00 pcls5 sendmail[5627]: NOUSER: jmarkus2 relay=mail-bn3nam01on0058.outbound.protection.outlook.com [104.47.33.58] 2016-12-30T16:34:29.844258-05:00 pcls5 sendmail[5627]: NOUSER: jmarkus3 relay=mail-bn3nam01on0058.outbound.protection.outlook.com [104.47.33.58] 2016-12-30T16:34:30.094905-05:00 pcls5 sendmail[5627]: NOUSER: jmarkus4 relay=mail-bn3nam01on0058.outbound.protection.outlook.com [104.47.33.58] 2016-12-30T16:35:23.984284-05:00 pcls5 sendmail[7053]: NOUSER: ehansen1 relay=mail-sn1nam02hn0244.outbound.protection.outlook.com [104.47.36.244] 2016-12-30T16:35:24.235025-05:00 pcls5 sendmail[7053]: NOUSER: ehansen10 relay=mail-sn1nam02hn0244.outbound.protection.outlook.com [104.47.36.244] 2016-12-30T16:35:24.485697-05:00 pcls5 sendmail[7053]: NOUSER: ehansen5 relay=mail-sn1nam02hn0244.outbound.protection.outlook.com [104.47.36.244] 2016-12-30T16:35:24.736408-05:00 pcls5 sendmail[7053]: NOUSER: ehansen2 relay=mail-sn1nam02hn0244.outbound.protection.outlook.com [104.47.36.244] 2016-12-30T16:35:24.987137-05:00 pcls5 sendmail[7053]: NOUSER: ehansen3 relay=mail-sn1nam02hn0244.outbound.protection.outlook.com [104.47.36.244] 2016-12-30T16:36:01.134355-05:00 pcls5 sendmail[7889]: NOUSER: efd5 relay=mail-bl2nam02hn0233.outbound.protection.outlook.com [104.47.38.233] 2016-12-30T16:36:01.385161-05:00 pcls5 sendmail[7889]: NOUSER: efd6 relay=mail-bl2nam02hn0233.outbound.protection.outlook.com [104.47.38.233] 2016-12-30T16:36:01.635940-05:00 pcls5 sendmail[7889]: NOUSER: efd7 relay=mail-bl2nam02hn0233.outbound.protection.outlook.com [104.47.38.233] 2016-12-30T16:36:01.886771-05:00 pcls5 sendmail[7889]: NOUSER: efd8 relay=mail-bl2nam02hn0233.outbound.protection.outlook.com [104.47.38.233] 2016-12-30T16:36:02.137626-05:00 pcls5 sendmail[7889]: NOUSER: efd9 relay=mail-bl2nam02hn0233.outbound.protection.outlook.com [104.47.38.233] 2016-12-30T16:41:25.012620-05:00 pcls5 sendmail[15054]: NOUSER: josephl6 relay=mail-dm3nam03hn0218.outbound.protection.outlook.com [104.47.41.218] 2016-12-30T16:41:25.263296-05:00 pcls5 sendmail[15054]: NOUSER: josephl4 relay=mail-dm3nam03hn0218.outbound.protection.outlook.com [104.47.41.218] 2016-12-30T16:41:25.514058-05:00 pcls5 sendmail[15054]: NOUSER: josephl7 relay=mail-dm3nam03hn0218.outbound.protection.outlook.com [104.47.41.218] 2016-12-30T16:41:25.764786-05:00 pcls5 sendmail[15054]: NOUSER: josephl8 relay=mail-dm3nam03hn0218.outbound.protection.outlook.com [104.47.41.218] 2016-12-30T16:41:26.015469-05:00 pcls5 sendmail[15054]: NOUSER: josephl5 relay=mail-dm3nam03hn0218.outbound.protection.outlook.com [104.47.41.218] -- -Barry Shein Software Tool & Die | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*

2 1

Re: Recent NTP pool traffic increase
by Gary E. Miller 30 Dec '16

30 Dec '16

Yo All! Someone on nanog was reporrting on the new NTP mystery. He suggested doing a dump similar to this: # tcpdump -nvvi eth0 port 123 |grep "Originator - Transmit Timestamp:" And I do indeed get odd results. Some on my local network... This is from a chronyd host to an ntpsec host. I monitor them both continuously and both seem to be keeping good time. 17:36:11.369329 IP (tos 0x0, ttl 64, id 21405, offset 0, flags [DF], proto UDP ( 17), length 76) 204.17.205.7.50937 > 204.17.205.27.123: [udp sum ok] NTPv4, length 48 Client, Leap indicator: clock unsynchronized (192), Stratum 0 (unspecifi ed), poll 6 (64s), precision 32 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 3691013707.207257069 (2016/12/17 17:35:07) Receive Timestamp: 276521666.321684728 (2044/11/11 10:02:42) Transmit Timestamp: 3684123061.899235956 (2016/09/29 00:31:01) Originator - Receive Timestamp: +880475255.114427658 Originator - Transmit Timestamp: -6890645.308021113 That 'Receive Timestamp' is strange. Here is another one from the same chronyd host, to another ntpsec host: 17:36:23.395415 IP (tos 0x0, ttl 64, id 3599, offset 0, flags [DF], proto UDP (1 7), length 76) 204.17.205.7.33551 > 204.17.205.1.123: [udp sum ok] NTPv4, length 48 Client, Leap indicator: clock unsynchronized (192), Stratum 0 (unspecifi ed), poll 6 (64s), precision 32 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 3691013718.824150890 (2016/12/17 17:35:18) Receive Timestamp: 1779216017.648483479 (2092/06/24 18:08:33) Transmit Timestamp: 1405803137.064633429 (2080/08/24 20:20:33) Originator - Receive Timestamp: -1911797701.175667410 Originator - Transmit Timestamp: +2009756714.240482539 Note both the 'Receive Timestamp' and 'Transmit Timestamp' are both strange. All three hosts have GPS for local time. Here is one from a laptop, running chrony, that has not GPS: 17:36:52.643814 IP (tos 0x0, ttl 64, id 24624, offset 0, flags [DF], proto UDP ( 17), length 76) 204.17.205.21.41485 > 204.17.205.8.123: [udp sum ok] NTPv4, length 48 Client, Leap indicator: (0), Stratum 0 (unspecified), poll 6 (64s), pre cision 32 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 3691013747.797479298 (2016/12/17 17:35:47) Receive Timestamp: 317494016.811980062 (2046/02/28 15:15:12) Transmit Timestamp: 127487236.597620268 (2040/02/21 11:35:32) Originator - Receive Timestamp: +921447565.014500764 Originator - Transmit Timestamp: +731440784.800140969 I have only seen this oddity from chronyd hosts... RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703 gem(a)rellim.com Tel:+1 541 382 8588

26 50

Weekly Routing Table Report
by cscora＠apnic.net 30 Dec '16

30 Dec '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 31 Dec, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 626822 Prefixes after maximum aggregation (per Origin AS): 221601 Deaggregation factor: 2.83 Unique aggregates announced (without unneeded subnets): 304431 Total ASes present in the Internet Routing Table: 55506 Prefixes per ASN: 11.29 Origin-only ASes present in the Internet Routing Table: 36264 Origin ASes announcing only one prefix: 15201 Transit ASes present in the Internet Routing Table: 6538 Transit-only ASes present in the Internet Routing Table: 169 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 38 Max AS path prepend of ASN ( 55644) 36 Prefixes from unregistered ASNs in the Routing Table: 52 Unregistered ASNs in the Routing Table: 17 Number of 32-bit ASNs allocated by the RIRs: 16714 Number of 32-bit ASNs visible in the Routing Table: 12704 Prefixes from 32-bit ASNs in the Routing Table: 52166 Number of bogon 32-bit ASNs visible in the Routing Table: 656 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 376 Number of addresses announced to Internet: 2834970340 Equivalent to 168 /8s, 250 /16s and 54 /24s Percentage of available address space announced: 76.6 Percentage of allocated address space announced: 76.6 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.4 Total number of prefixes smaller than registry allocations: 207813 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 156571 Total APNIC prefixes after maximum aggregation: 43183 APNIC Deaggregation factor: 3.63 Prefixes being announced from the APNIC address blocks: 171063 Unique aggregates announced from the APNIC address blocks: 70682 APNIC Region origin ASes present in the Internet Routing Table: 5188 APNIC Prefixes per ASN: 32.97 APNIC Region origin ASes announcing only one prefix: 1132 APNIC Region transit ASes present in the Internet Routing Table: 939 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 38 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2579 Number of APNIC addresses announced to Internet: 761702276 Equivalent to 45 /8s, 102 /16s and 167 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 188253 Total ARIN prefixes after maximum aggregation: 89318 ARIN Deaggregation factor: 2.11 Prefixes being announced from the ARIN address blocks: 195160 Unique aggregates announced from the ARIN address blocks: 89620 ARIN Region origin ASes present in the Internet Routing Table: 16071 ARIN Prefixes per ASN: 12.14 ARIN Region origin ASes announcing only one prefix: 5598 ARIN Region transit ASes present in the Internet Routing Table: 1707 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1679 Number of ARIN addresses announced to Internet: 1106805408 Equivalent to 65 /8s, 248 /16s and 130 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 150572 Total RIPE prefixes after maximum aggregation: 73138 RIPE Deaggregation factor: 2.06 Prefixes being announced from the RIPE address blocks: 162013 Unique aggregates announced from the RIPE address blocks: 99014 RIPE Region origin ASes present in the Internet Routing Table: 18145 RIPE Prefixes per ASN: 8.93 RIPE Region origin ASes announcing only one prefix: 7750 RIPE Region transit ASes present in the Internet Routing Table: 3053 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 28 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5103 Number of RIPE addresses announced to Internet: 709633664 Equivalent to 42 /8s, 76 /16s and 38 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 63826 Total LACNIC prefixes after maximum aggregation: 12660 LACNIC Deaggregation factor: 5.04 Prefixes being announced from the LACNIC address blocks: 80478 Unique aggregates announced from the LACNIC address blocks: 38041 LACNIC Region origin ASes present in the Internet Routing Table: 2488 LACNIC Prefixes per ASN: 32.35 LACNIC Region origin ASes announcing only one prefix: 552 LACNIC Region transit ASes present in the Internet Routing Table: 591 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 30 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 3059 Number of LACNIC addresses announced to Internet: 170855744 Equivalent to 10 /8s, 47 /16s and 13 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 15381 Total AfriNIC prefixes after maximum aggregation: 3294 AfriNIC Deaggregation factor: 4.67 Prefixes being announced from the AfriNIC address blocks: 17732 Unique aggregates announced from the AfriNIC address blocks: 6730 AfriNIC Region origin ASes present in the Internet Routing Table: 735 AfriNIC Prefixes per ASN: 24.13 AfriNIC Region origin ASes announcing only one prefix: 169 AfriNIC Region transit ASes present in the Internet Routing Table: 183 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 284 Number of AfriNIC addresses announced to Internet: 85518848 Equivalent to 5 /8s, 24 /16s and 234 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5550 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3712 390 250 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2984 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2722 11133 741 KIXS-AS-KR Korea Telecom, KR 9829 2692 1499 535 BSNL-NIB National Internet Backbone, IN 9808 2253 8698 33 CMNET-GD Guangdong Mobile Communication 4755 2043 428 216 TATACOMM-AS TATA Communications formerl 45899 1749 1265 99 VNPT-AS-VN VNPT Corp, VN 4808 1651 2169 469 CHINA169-BJ China Unicom Beijing Provin 24560 1583 561 242 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3614 2968 152 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3251 1333 82 SHAW - Shaw Communications Inc., CA 18566 2195 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 1956 2021 402 CHARTER-NET-HKY-NC - Charter Communicat 30036 1747 328 398 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1731 5066 640 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1676 848 227 ITCDELTA - Earthlink, Inc., US 701 1599 10629 662 UUNET - MCI Communications Services, In 16509 1526 3029 522 AMAZON-02 - Amazon.com, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3141 163 17 ALJAWWALSTC-AS , SA 20940 2952 1108 2100 AKAMAI-ASN1 , US 9121 2267 1707 95 TTNET , TR 34984 1993 327 376 TELLCOM-AS , TR 13188 1603 99 61 TRIOLAN , UA 12479 1414 1033 51 UNI2-AS , ES 6849 1312 355 22 UKRTELNET , UA 8551 1205 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 8402 1128 544 15 CORBINA-AS OJSC "Vimpelcom", RU 12389 996 1156 445 ROSTELECOM-AS , RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3527 543 179 Telmex Colombia S.A., CO 8151 2483 3370 553 Uninet S.A. de C.V., MX 11830 1799 368 66 Instituto Costarricense de Electricidad 6503 1544 437 54 Axtel, S.A.B. de C.V., MX 7303 1522 970 251 Telecom Argentina S.A., AR 6147 1354 377 27 Telefonica del Peru S.A.A., PE 28573 1050 2271 177 CLARO S.A., BR 3816 1030 480 193 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 914 126 78 Alestra, S. de R.L. de C.V., MX 18881 879 1036 22 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1293 398 42 LINKdotNET-AS, EG 36903 687 345 122 MT-MPLS, MA 37611 676 67 6 Afrihost, ZA 36992 579 1373 25 ETISALAT-MISR, EG 24835 492 658 16 RAYA-AS, EG 8452 485 1474 16 TE-AS TE-AS, EG 37492 396 288 72 ORANGE-TN, TN 29571 368 36 10 CITelecom-AS, CI 15399 314 35 6 WANANCHI-KE, KE 2018 285 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5550 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3712 390 250 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3614 2968 152 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3527 543 179 Telmex Colombia S.A., CO 6327 3251 1333 82 SHAW - Shaw Communications Inc., CA 39891 3141 163 17 ALJAWWALSTC-AS , SA 17974 2984 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2952 1108 2100 AKAMAI-ASN1 , US 4766 2722 11133 741 KIXS-AS-KR Korea Telecom, KR 9829 2692 1499 535 BSNL-NIB National Internet Backbone, IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 7545 3712 3462 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3614 3462 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3527 3348 Telmex Colombia S.A., CO 6327 3251 3169 SHAW - Shaw Communications Inc., CA 39891 3141 3124 ALJAWWALSTC-AS , SA 17974 2984 2913 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2253 2220 CMNET-GD Guangdong Mobile Communication 9121 2267 2172 TTNET , TR 9829 2692 2157 BSNL-NIB National Internet Backbone, IN 18566 2195 2086 MEGAPATH5-US - MegaPath Corporation, US Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65001 PRIVATE 46.237.32.0/20 13118 ASN-YARTELECOM PJSC Rostelecom 65001 PRIVATE 94.242.128.0/20 15468 KLGELECS-AS 38, Teatralnaya st Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.128.12.0/22 55763 UNKNOWN 14.128.12.0/24 55763 UNKNOWN 14.128.13.0/24 55763 UNKNOWN 14.128.15.0/24 55763 UNKNOWN 27.100.7.0/24 56096 UNKNOWN 41.62.1.0/24 19136 NNET, ZA 41.73.16.0/24 37004 Suburban-Broadband-AS, NG 41.73.17.0/24 37004 Suburban-Broadband-AS, NG 41.73.18.0/24 37004 Suburban-Broadband-AS, NG 41.73.19.0/24 37004 Suburban-Broadband-AS, NG Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:103 /12:276 /13:530 /14:1049 /15:1801 /16:13173 /17:7811 /18:13022 /19:25260 /20:38054 /21:40602 /22:73135 /23:61420 /24:349161 /25:548 /26:411 /27:312 /28:29 /29:16 /30:17 /31:0 /32:27 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3047 3251 SHAW - Shaw Communications Inc., CA 39891 2896 3141 ALJAWWALSTC-AS , SA 22773 2815 3614 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2088 2195 MEGAPATH5-US - MegaPath Corporation, US 9121 1576 2267 TTNET , TR 30036 1559 1747 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 10620 1446 3527 Telmex Colombia S.A., CO 6389 1393 2095 BELLSOUTH-NET-BLK - BellSouth.net Inc., 13188 1348 1603 TRIOLAN , UA 6983 1323 1676 ITCDELTA - Earthlink, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1585 2:820 4:23 5:2416 6:32 8:1023 12:1811 13:65 14:1780 15:24 16:2 17:104 18:124 19:1 20:51 23:2003 24:1802 27:2400 31:1839 32:83 33:11 34:1 35:3 36:376 37:2479 38:1301 39:44 40:99 41:2969 42:455 43:1908 44:52 45:2283 46:2530 47:120 49:1201 50:951 51:15 52:616 54:355 55:7 56:4 57:40 58:1599 59:975 60:388 61:1863 62:1498 63:1926 64:4538 65:2177 66:4393 67:2215 68:1167 69:3293 70:1303 71:560 72:2058 74:2594 75:404 76:412 77:1419 78:1574 79:915 80:1360 81:1420 82:967 83:722 84:862 85:1689 86:487 87:1129 88:782 89:2050 90:196 91:6099 92:967 93:2373 94:2350 95:2767 96:564 97:359 98:945 99:93 100:148 101:1200 103:13120 104:2632 105:146 106:474 107:1499 108:774 109:2540 110:1280 111:1659 112:1131 113:1172 114:1004 115:1634 116:1680 117:1569 118:2112 119:1590 120:942 121:1074 122:2282 123:2005 124:1599 125:1828 128:709 129:481 130:432 131:1388 132:622 133:187 134:528 135:210 136:385 137:393 138:1819 139:452 140:621 141:474 142:723 143:895 144:752 145:168 146:965 147:647 148:1364 149:559 150:683 151:798 152:703 153:313 154:720 155:950 156:545 157:564 158:427 159:1343 160:564 161:732 162:2452 163:535 164:778 165:1139 166:361 167:1234 168:2459 169:721 170:2519 171:264 172:865 173:1827 174:781 175:718 176:1751 177:4184 178:2423 179:1156 180:2063 181:1946 182:2163 183:1012 184:837 185:8343 186:3218 187:2244 188:2330 189:1780 190:7983 191:1294 192:9295 193:5768 194:4557 195:3859 196:1866 197:1244 198:5590 199:5818 200:7226 201:4142 202:10137 203:9822 204:4462 205:2771 206:2971 207:3170 208:4018 209:3899 210:3907 211:2079 212:2786 213:2453 214:847 215:66 216:5767 217:1974 218:824 219:600 220:1668 221:895 222:727 223:1103 End of report

1 0

SYN Floods from Verizon in the Midwest-Chicago area?
by Bobin Joseph 30 Dec '16

30 Dec '16

Wondering if anyone noticed issues with customers coming from Verizon's handoff in Chicago - 204.255.168.61? We have couple of customers with Verizon that seem to have been flooding us with SYN's. It seems Verizon has acknowledged this, but as we are not customers of VZN, we have no information about this. The SYN floods stopped around 10:20 PST on 12/29. Had enough impact to cause a minor outage. Thanks, Bobin Joseph

1 0

Multi-vendor strategies [was: Re: Benefits (and Detriments) of Standardizing Network Equipment in a Global Organization]
by Chris Grundemann 29 Dec '16

29 Dec '16

On Thu, Dec 29, 2016 at 10:05 AM, Randy Bush <randy(a)psg.com> wrote: > > I apparently wasn't very clear. In the layered approach to multiple > > vendors, you would (obviously) choose your layer definitions to avoid > > such delicate interdependence. > > can you describe in useful detail your operational experience doing > this? I'll certainly try. As one hopefully fairly clear example; at a large (US-nation-wide) metro Ethernet provider, we standardized as follows: L3 devices (aka core, customer edge, and Internet/peering edge routers) were all from Vendor A - These devices spoke OSPF, BGP, and RSVP with each other. L2 devices (aka metro ring switches) were all from Vendor B - These devices spoke STP with each other. L1 devices (aka optical transport) were all from Vendors C or D (individual markets got to choose which, but they could only have one each) - These devices inter-operated with each other at the optical layer. Basic network security was handled by devices from Vendor E - These devices collected netflow data and flagged alerts DNS was handled by software from another vendor on servers from yet another vendor, etc... Is that enough detail to be useful?

1 0

Re: Benefits (and Detriments) of Standardizing Network Equipment in a Global Organization
by Chris Grundemann 29 Dec '16

29 Dec '16

I apparently wasn't very clear. In the layered approach to multiple vendors, you would (obviously) choose your layer definitions to avoid such delicate interdependence. Regardless of my failure to fully explain, I'm curious as to how mixing vendors at the same layer is seen to be less problematic than assigning vendors specific roles? ---- >My Android sent this< http://chrisgrundemann.com On Dec 28, 2016 11:13 PM, "David Barak" <thegameiam(a)yahoo.com> wrote: On Dec 28, 2016, at 5:34 PM, Randy Bush <randy(a)psg.com> wrote: >> An alternative multi-vendor approach is to use 1 vendor per stack layer, >> but alternate layer to layer. That is; Vendor A edge router, Vendor B >> firewall, Vendor A/C switches, Vendor D anti-SPAM software, etc. This >> doesn't address the bug impact issue as well as it alleviates the vendor >> "ownership" issue though... > > i think this is where i say that i hope my competitors do this. it > is a recipe for a complex set of delicate dependencies and great fun > debugging. > One of the more spectacular failures I've seen was a bug in a network core router that caused bad into to be carried by all of that same vendor's routers across the core to the edges (made by a different vendor) which promptly barfed and locked up. So I'd be cautious about saying "vendor X for one layer, vendor Y for adjacent layer" as a multi-vendor strategy. David Barak Sent from mobile device, please excuse autocorrection artifacts

2 1

WEBCAST TODAY: ION Bucharest 2016
by Joly MacFie 28 Dec '16

28 Dec '16

Over the holiday I am taking the opportunity to catch up on some editing. This session, from October, is a series of very informative presentations on the latest in network security practice and IPv6 deployment. I'm afraid the 3rd presentation is in Romanian, but the slides are in English! joly posted: "Today, Wednesday December 28 2016, ION Bucharest 2016 - which took place on October 12 2016 - will be restreamed live on the Internet Society Livestream Channel. The Internet Society's Deploy 360 team host a series of presentations, plus a panel, on the l" [image: Livestream] <https://livestream.com/internetsociety/ionbucharest/>Today, *Wednesday December 28 2016*, *ION Bucharest 2016 <http://www.internetsociety.org/deploy360/blog/2016/10/agenda-speakers-and-w…>* - which took place on October 12 2016 - will be restreamed live on the *Internet Society Livestream Channel <https://livestream.com/internetsociety/ionbucharest/>*. The Internet Society's *Deploy 360 <http://www.internetsociety.org/deploy360/>* team host a series of presentations, plus a panel, on the latest developments with *DNSSEC*, *DANE*, *MANRS*, and *IPv6* with an emphasis on Romania. *What: ION Bucharest 2016 <http://www.internetsociety.org/deploy360/blog/2016/10/agenda-speakers-and-w…> When: Wednesday December 28 2016 9am-12:30pm EST | 13:00-16:30 UTC Webcast: https://livestream.com/internetsociety/ionbucharest/ <https://livestream.com/internetsociety/ionbucharest/> Slides: http://www.internetsociety.org/deploy360/ion/bucharest2016/presentations/ <http://www.internetsociety.org/deploy360/ion/bucharest2016/presentations/> Twitter: https://twitter.com/hashtag/IONConf <https://twitter.com/hashtag/IONConf>* Comment <http://isoc-ny.org/p2/8870#respond> See all comments <http://isoc-ny.org/p2/8870#comments> *Permalink* http://isoc-ny.org/p2/8870 -- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast -------------------------------------------------------------- -

1 0

DWDM on 250 Km dark fiber without re-amplification
by Jeremy 27 Dec '16

27 Dec '16

Hi all, First, i'm sorry for my english, i'm french and i don't have a good level in this language. But i want some informations and i'm sure, someone will be give the good anwser about my question. So, i'm regarding to rent a dual dark fiber in France, the estimated distance is 225 Km, but i know there are a lot of optical switching on the highway where it's fiber is installed (in theory, all 80 Km). So, i used the bad scenario, in adding 25 Km on my need. I would like to buy a amplificator and multiplexer DWDM to add some 10Gb/s waves on this dark fiber. I've see that the amplification is better on 100 Gb/s synchronised ports, but we don't have enoug capacity on our router to add 100 Gb/s interfaces. So, someone has installed this type of hardware on a dark fiber without regeneration on 250 Km of distance ? If yes, with what kind of hardware ? If you are commercial for this hardware, please contact me in private message. Thanks you for your time, Jérémy AS197922

8 7

BCM5341x
by Mike Hammett 26 Dec '16

26 Dec '16

I've asked Broadcom directly, but being as though I don't have an intent to buy tens of thousands of chips (or any at all), I don't expect I'll hear back. I was hoping someone here would have some insight. Do any of you know what functionality is available on those chips? That's the chip that powers the Ubiquiti 10G switches and I figured I would limit my most aggressive feature requests to things they can actually deliver with the platform as is. Other than things you just assume a managed switch has like 802.1p and 802.1q, it mentions an advanced ContentAware™ Engine (which means?), IEEE1588 (sync over Ethernet), 802.1ag (OAM stuff), "Enhanced DoS attack statistics gathering" (which means?), "IPv4/IPv6 L3 packet classification" (which means?), etc. I'm sure there's an array of things to ask about, but MLAG and S-Flow are at the top of my list at the moment. https://www.broadcom.com/products/ethernet-connectivity/switch-fabric/bcm53… ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

4 3

Re: Recent NTP pool traffic increase (update)
by Denys Fedoryshchenko 25 Dec '16

25 Dec '16

Hello, I'm not sure i should continue to CC nanog, if someone interested to be in CC for further updates this story please let me know. TP-Link not related, it was misunderstanding or wrong customer report. Tenda routers i believe most of cheap models are affected by this problem. On ISPs i have access i see too many of them sending requests to 133.100.9.2 (if it is unreachable, repeating each 10 seconds), this particular ip seems hardcoded there. I am sure as soon as your server is down, way they coded - it will make all this routers to ddos this particular ip, repeating NTP queries very often without any backoff/protection mechanism. Particular model i tested - W308R / Wireless N300 Home Router, but i believe many models are affected. Firmware: System Version: 5.0.7.53_en hw version : v1.0 Another possible vendor is LB-Link, but i dont have yet any info from customers who own them. On 2016-12-21 11:00, FUJIMURA Sho wrote: > Hello. > > I'm Sho FUJIMURA. > Thank you for your information. > I operate the public NTP Services as 133.100.9.2 and 133.100.11.8. > I'd like to reduce the traffic because I have trouble with too much > traffic recently. > So, I'm interested in the root of the the problem. > If possible, would you please tell me the model numbers of Tenda and > TP-Link?? > > -- > Sho FUJIMURA > Information Technology Center, Fukuoka University. > 8-19-1, Nanakuma, Jyonan-ku, Fukuoka, 8140180, Japan > > fujimura(a)fukuoka-u.ac.jp > > 2016-12-20 5:33 GMT+09:00 Denys Fedoryshchenko <denys(a)visp.net.lb>: > >> I'm not sure if this issue relevant to discussed topic, Tenda >> routers here for a while on market, and i think i noticed this issue >> just now, >> because NTP servers they are using supposedly for healthcheck went >> down (or NTP owners blocked ISP's i support, due such routers). >> >> At least after checking numerous users, i believe Tenda hardcoded >> those NTP IPs. What worsen issue, that in Lebanon several times per >> day, for example at 18pm - short electricity cutoff, >> and majority of users routers will reboot and surely reconnect, so >> it will look like a countrywide spike in NTP traffic. >> >> I checked for a 10min also this NTP ips in dns responses, none of >> thousands of users tried to resolve any name with them over any DNS >> server, so i conclude they are hardcoded somewhere in firmware. >> >> Here is traffic of Tenda router after reconnecting (but not full >> powercycle, i dont have it in my hands). But as you can see, no DNS >> resolution attempts: >> >> 20:15:59.305739 PPPoE [ses 0x1483] CHAP, Success (0x03), id 1, Msg >> S=XXXXXX M=Authentication succeeded >> 20:15:59.306100 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 1, >> length 12 >> 20:15:59.317840 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 1, >> length 24 >> 20:15:59.317841 PPPoE [ses 0x1483] IPCP, Conf-Ack (0x02), id 1, >> length 12 >> 20:15:59.317867 PPPoE [ses 0x1483] IPCP, Conf-Nack (0x03), id 1, >> length 18 >> 20:15:59.325253 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 2, >> length 24 >> 20:15:59.325273 PPPoE [ses 0x1483] IPCP, Conf-Ack (0x02), id 2, >> length 24 >> 20:15:59.335589 PPPoE [ses 0x1483] IP 172.17.49.245.123 > >> 133.100.9.2.123: NTPv3, Client, length 48 >> 20:15:59.335588 PPPoE [ses 0x1483] IP 172.17.49.245.123 > >> 192.5.41.41.123: NTPv3, Client, length 48 >> 20:15:59.335588 PPPoE [ses 0x1483] IP 172.17.49.245.123 > >> 192.5.41.40.123: NTPv3, Client, length 48 >> >> Here is example of Tenda traffic if it is unable to reach >> destination, it repeats request each 10 seconds endlessly, my guess >> they are using ntp to show >> status of internet connection. >> So, now that NTP servers getting quite significant DDoS such way. >> >> 19:57:52.162863 IP (tos 0x0, ttl 64, id 38515, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 192.5.41.40.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177063.000000000 (2016/12/19 >> 22:57:43) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177063.000000000 >> (2016/12/19 22:57:43) >> 19:57:52.163277 IP (tos 0x0, ttl 64, id 38516, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 192.5.41.41.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177063.000000000 (2016/12/19 >> 22:57:43) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177063.000000000 >> (2016/12/19 22:57:43) >> 19:57:52.164435 IP (tos 0x0, ttl 64, id 38517, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 133.100.9.2.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177063.000000000 (2016/12/19 >> 22:57:43) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177063.000000000 >> (2016/12/19 22:57:43) >> 19:58:02.164781 IP (tos 0x0, ttl 64, id 38518, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 192.5.41.40.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177073.000000000 (2016/12/19 >> 22:57:53) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177073.000000000 >> (2016/12/19 22:57:53) >> 19:58:02.164884 IP (tos 0x0, ttl 64, id 38519, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 192.5.41.41.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177073.000000000 (2016/12/19 >> 22:57:53) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177073.000000000 >> (2016/12/19 22:57:53) >> 19:58:02.165061 IP (tos 0x0, ttl 64, id 38520, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 133.100.9.2.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177073.000000000 (2016/12/19 >> 22:57:53) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177073.000000000 >> (2016/12/19 22:57:53) >> >> On 2016-12-19 21:40, Roland Dobbins wrote: >> On 20 Dec 2016, at 2:22, Denys Fedoryshchenko wrote: >> >> If it is necessary i can investigate further. >> >> Yes, please! >> >> ----------------------------------- >> Roland Dobbins <rdobbins(a)arbor.net>

4 4