April 2016 - Test - lists.nanog.org

BGP FlowSpec
by Martin Bacher 03 May '16

03 May '16

Dear Nanog Members, My name is Martin Bacher. I am a Student at UAS Technikum-Wien and I am currently writing my master’s thesis with topic "Addressing DDoS Attacks with BGP FlowSpec“. It would be very helpful for me if some of you could share information about the following topics: - Intra-AS BGP FlowSpec deployment: Who is running it? For which kind of attacks are you using it? Are you only dropping or rate-limiting certain traffic or are you also using the redirect/remark capabilities? What are the limitations from your perspective? Are you facing any operational issues? How are you injecting the FlowSpec routes? - Inter-AS: Who is running Inter-AS FlowSpec deployments? What is your experience? Are there any concerns regarding Inter-AS deployments? Has anyone done interop tests? FlowSpec is usually only one part of the whole anti DDoS toolset. So I would also be interested in your answers to the following questions: - How are you detecting DDoS attacks (Netflow, in-line probes, ..?) and which applications are you using for the analysis (Peakflow, Open-Source tools, ..?) - Which countermeasures are you deploying in case of DDoS attacks? ACLs, FlowSpec, Blackhole routes, RTBH, scrubbing center, Cloud based DDoS services or anything else? - What is your operational experience? How fast are you in deploying countermeasures? Do you have any automation or is this always triggered by people? Last but not least: I am also looking for anonymized statistical data about DDoS attacks which I could use in the thesis. I am mainly interested in data about the type of attacks, attack time, sources, source and destination ports, and so on. I know this something which is generally not shared, so I would really appreciate it if someone would be able to share such data. Please send me your answers either via pn or directly to the list. Please also let me know if you think that there is something missing. Any comment or answer is highly appreciated. Looking forward to your replies. Many thanks. Greetings, Martin

8 19

Standards for last mile performance
by Jean-Francois Mezei 02 May '16

02 May '16

The CRTC hearing went well (thanks for all your help). One of the unanswered questions was how to set performance standards for the last mile to ensure people get advertised speeds (within reason). I had asked the question about contention ratio and it appears there is no proper way to set such a moving target as a regulatory standard. During the hearing, someone suggested that advertised speeds be achievable 80% of the time. (chairman then asked if "time" was 24 hours, or just the time you needed to use the internet (aka: peak). Out of curiosity, could such a thing be measured by the last mile operator ? There is the easy answer of synch. For DSL, non delivery of advertised speed is easy since that metric is on the modem statistics. However, for fixed wireless, would a customer too far from tower see a lower synch rate or would he just see poor performance due to lots of retransmits ? So some generic questions: What are the different ways used to determine if the last mile is congested and needs to be upgraded ? >From the network operator's point of view, would it not be looking at 5 minute throughput samples and trigger upgrades when it sees throughput reaching x% of last mile segment capacity for more than X minutes per day ? What other means do network admins use to monitor when it is time to upgrade shared last mile segments such as coax or fixed wireless ? from a policy point of view, is it possible to set the same standard for different technologies or should each (dsl, coax, fixed wireless and satellite) have they own standards and methods of measurements before of intrinsic differences in how they work ? In the case of Rogers (canadian cableco), the CRTC record shows that they trigger node split process when capacity reaches 60%. This is because it takes them so long to do all the paperwork, committees etc that by the time the node split is done, that segment has grown to about 75% utilisation. Would that be a sound basis to set a policy ? For shared last mile, would different technologies have similar thresholds that trigger the need for upgrades or would coax start to degrade at 75% whereas fixed wireless or satellite start to degrade at lower/higher number ? For FTTP, while likely not a big problem yet, would similar number apply when the ~2gbps download and ~1gbps upload start to get filled by the 32 homes served ?

4 7

Superfluous advertisement (was: Friday's Random Comment)
by Jakob Heitz (jheitz) 01 May '16

01 May '16

A use case for a longer prefix with the same nexthop: F / \ D E | | B C \ / A Suppose A is a customer of B and C. B has a large address space: 10.1.0.0/16. B allocates a subset to A: 10.1.1.0/24. B advertises the longer prefix to its backup provider C. C propagates it to E and then to F. B MUST advertise both 10.1.0.0/16 and 10.1.1.0/24 to D. D MUST propagate both of them to F. Otherwise, if F only receives 10.1.0.0/16 from D, then F will have the longer match 10.1.1.0/24 to E, but E is only the backup route. Thanks, Jakob. > -----Original Message----- > Date: Fri, 29 Apr 2016 08:17:41 -0400 > From: Alain Hebert <ahebert(a)pubnix.net> > To: "'NANOG list'" <nanog(a)nanog.org> > Subject: Friday's Random Comment - About: Arista and FIB/RIB's > Message-ID: <00ea292f-e779-25ad-ce89-eae897e9516d(a)pubnix.net> > Content-Type: text/plain; charset=utf-8 > > While following that Arista chat... That reminded me of that little > afternoon project years ago. > > So I decided to find new hamsters, fire up that VM, refresh the DB's and > from the view point of a tiny 7206VXR/G1 with 2 T3 peers... > > The amount of superfluous subnet advertisement drop to ~120k from > ~166k from the previous snapshot. > > And this is the distribution by country. > > country | superfluous > --------------------+------------- > United States | 28254 > Brazil | 10012 > China | 7537 > India | 6449 > Russian Federation | 4524 > Korea, Republic of | 4062 > Saudi Arabia | 3297 > Australia | 2989 > Indonesia | 2878 > Hong Kong | 2251 > Thailand | 2093 > Canada | 2019 > Taiwan | 1955 > Ukraine | 1877 > Singapore | 1856 > Bulgaria | 1488 > Argentina | 1436 > Japan | 1403 > Mexico | 1351 > Chile | 1271 > > (Damn Canada, can't break top 10 again). > > PS: "Superfluous" is a nice way to say that the best path of a > subnet is the same as his supernet. And yes I'm aware of the Weekly > Routing Report, I was just curious to see it by country =D. > > ----- > Alain Hebert ahebert(a)pubnix.net > PubNIX Inc. > 50 boul. St-Charles > P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 > Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443

4 7

Re: BGP FlowSpec
by dennis 01 May '16

01 May '16

Hi Amplification attacks and syn floods are just touching the surface of ddos attack vectors. You should look into some industry reports: Here are a couple examples to get you started. https://www.radware.com/ert-report-2015/ http://www.verizonenterprise.com/verizon-insights-lab/dbir/2016/ Sent via the Samsung GALAXY S® 5, an AT&T 4G LTE smartphone -------- Original message -------- From: Martin Bacher <ti14m028(a)technikum-wien.at> Date: 4/29/2016 2:02 AM (GMT-08:00) To: Tyler Haske <tyler.haske(a)gmail.com> Cc: NANOG list <nanog(a)nanog.org> Subject: Re: BGP FlowSpec Hello Tyler, thanks for your reply. > Am 28.04.2016 um 17:37 schrieb Tyler Haske <tyler.haske(a)gmail.com>: > > Martin, > > > > Last but not least: I am also looking for anonymized statistical data about DDoS attacks which I could use in the thesis. I am mainly interested in data about the > > type of attacks, attack time, sources, source and destination ports, and so on. I know this something which is generally not shared, so I would really appreciate it if > > someone would be able to share such data. > > Many companies are extremely reluctant to share their attack data. But that's OK, because there are other ways to get it. > > Have you investigated backscatter analysis? It's used to see ongoing and current Internet scope DDoS attacks. I just had a look on that and thought that its only be able to detect some of the attacks. You might not detect large state of the art reflection and amplification attacks with that method. But i think it is useful for some sort of attacks like SYN flood. Do you agree? > > Inferring Internet Denial of Service Activity > https://cseweb.ucsd.edu/~savage/papers/UsenixSec01.pdf > > Analyzing Large DDoS Attacks Using Multiple Data Sources > https://www.cs.utah.edu/~kobus/docs/ddos.lsad.pdf > > ISP Security - Real World Techniques > https://www.nanog.org/meetings/nanog23/presentations/greene.ppt > > A Summary of DoS/DDoS Prevention, Monitoring and Mitigation Techniques in a Service Provider Environment > https://www.sans.org/reading-room/whitepapers/intrusion/summary-dos-ddos-pr… > > Maybe you have access to some public IPs, then you can do this data collection yourself. Sure, I will definitely think about hat. Thanks again for your reply and for providing the links. Greetings, Martin > > Regards, > > Tyler >

4 3

Weekly Routing Table Report
by Routing Analysis Role Account 29 Apr '16

29 Apr '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, PaNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 30 Apr, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 593320 Prefixes after maximum aggregation (per Origin AS): 217357 Deaggregation factor: 2.73 Unique aggregates announced (without unneeded subnets): 290159 Total ASes present in the Internet Routing Table: 53574 Prefixes per ASN: 11.07 Origin-only ASes present in the Internet Routing Table: 36587 Origin ASes announcing only one prefix: 15699 Transit ASes present in the Internet Routing Table: 6432 Transit-only ASes present in the Internet Routing Table: 172 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 45 Max AS path prepend of ASN ( 40285) 42 Prefixes from unregistered ASNs in the Routing Table: 1012 Unregistered ASNs in the Routing Table: 366 Number of 32-bit ASNs allocated by the RIRs: 13668 Number of 32-bit ASNs visible in the Routing Table: 10555 Prefixes from 32-bit ASNs in the Routing Table: 41431 Number of bogon 32-bit ASNs visible in the Routing Table: 13 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 389 Number of addresses announced to Internet: 2810793284 Equivalent to 167 /8s, 137 /16s and 77 /24s Percentage of available address space announced: 75.9 Percentage of allocated address space announced: 75.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.1 Total number of prefixes smaller than registry allocations: 193746 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 151960 Total APNIC prefixes after maximum aggregation: 42211 APNIC Deaggregation factor: 3.60 Prefixes being announced from the APNIC address blocks: 162661 Unique aggregates announced from the APNIC address blocks: 66214 APNIC Region origin ASes present in the Internet Routing Table: 5164 APNIC Prefixes per ASN: 31.50 APNIC Region origin ASes announcing only one prefix: 1184 APNIC Region transit ASes present in the Internet Routing Table: 913 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 39 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2033 Number of APNIC addresses announced to Internet: 754267460 Equivalent to 44 /8s, 245 /16s and 53 /24s Percentage of available APNIC address space announced: 88.2 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 131072-135580 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 180907 Total ARIN prefixes after maximum aggregation: 89400 ARIN Deaggregation factor: 2.02 Prefixes being announced from the ARIN address blocks: 186041 Unique aggregates announced from the ARIN address blocks: 88502 ARIN Region origin ASes present in the Internet Routing Table: 16367 ARIN Prefixes per ASN: 11.37 ARIN Region origin ASes announcing only one prefix: 5842 ARIN Region transit ASes present in the Internet Routing Table: 1713 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 45 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1161 Number of ARIN addresses announced to Internet: 1101677376 Equivalent to 65 /8s, 170 /16s and 67 /24s Percentage of available ARIN address space announced: 58.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-395164 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 143000 Total RIPE prefixes after maximum aggregation: 70238 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 152054 Unique aggregates announced from the RIPE address blocks: 93146 RIPE Region origin ASes present in the Internet Routing Table: 18078 RIPE Prefixes per ASN: 8.41 RIPE Region origin ASes announcing only one prefix: 7914 RIPE Region transit ASes present in the Internet Routing Table: 3001 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 29 Number of RIPE region 32-bit ASNs visible in the Routing Table: 4709 Number of RIPE addresses announced to Internet: 704653696 Equivalent to 42 /8s, 0 /16s and 41 /24s Percentage of available RIPE address space announced: 102.4 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-204287 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 61721 Total LACNIC prefixes after maximum aggregation: 12271 LACNIC Deaggregation factor: 5.03 Prefixes being announced from the LACNIC address blocks: 76026 Unique aggregates announced from the LACNIC address blocks: 36089 LACNIC Region origin ASes present in the Internet Routing Table: 2474 LACNIC Prefixes per ASN: 30.73 LACNIC Region origin ASes announcing only one prefix: 578 LACNIC Region transit ASes present in the Internet Routing Table: 562 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 24 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2442 Number of LACNIC addresses announced to Internet: 171320128 Equivalent to 10 /8s, 54 /16s and 35 /24s Percentage of available LACNIC address space announced: 102.1 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-265628 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 14187 Total AfriNIC prefixes after maximum aggregation: 3196 AfriNIC Deaggregation factor: 4.44 Prefixes being announced from the AfriNIC address blocks: 16149 Unique aggregates announced from the AfriNIC address blocks: 5855 AfriNIC Region origin ASes present in the Internet Routing Table: 738 AfriNIC Prefixes per ASN: 21.88 AfriNIC Region origin ASes announcing only one prefix: 181 AfriNIC Region transit ASes present in the Internet Routing Table: 170 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 22 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 210 Number of AfriNIC addresses announced to Internet: 78506240 Equivalent to 4 /8s, 173 /16s and 233 /24s Percentage of available AfriNIC address space announced: 78.0 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5560 4192 76 China Education and Research 7545 3297 354 214 TPG Telecom Limited 4766 3168 11160 1126 Korea Telecom 17974 2924 914 96 PT Telekomunikasi Indonesia 9829 2497 1467 462 National Internet Backbone 4755 2089 432 240 TATA Communications formerly 9808 1883 8717 30 Guangdong Mobile Communicatio 4808 1656 2299 541 CNCGROUP IP network China169 9583 1510 121 564 Sify Limited 38197 1487 92 212 Sun Network (Hong Kong) Limit Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3309 2948 145 Cox Communications Inc. 6389 2322 3671 41 BellSouth.net Inc. 18566 2204 394 275 MegaPath Corporation 20115 1923 1937 404 Charter Communications 30036 1779 350 179 Mediacom Communications Corp 6983 1690 849 232 EarthLink, Inc. 209 1572 4666 1241 Qwest Communications Company, 4323 1567 1004 386 tw telecom holdings, inc. 701 1296 10702 704 MCI Communications Services, 7018 1278 19906 974 AT&T Services, Inc. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 2901 151 11 SaudiNet, Saudi Telecom Compa 20940 2453 928 1789 Akamai International B.V. 34984 1968 323 417 TELLCOM ILETISIM HIZMETLERI A 8551 1630 376 55 Bezeq International-Ltd 12479 1173 979 92 France Telecom Espana SA 6849 1152 355 21 JSC "Ukrtelecom" 13188 1079 98 66 TOV "Bank-Inform" 8402 1046 544 15 OJSC "Vimpelcom" 31148 1027 47 41 Freenet Ltd. 9198 957 352 25 JSC Kazakhtelecom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3469 542 147 Telmex Colombia S.A. 8151 2248 3401 577 Uninet S.A. de C.V. 7303 1515 940 237 Telecom Argentina S.A. 11830 1483 368 53 Instituto Costarricense de El 6503 1434 437 57 Axtel, S.A.B. de C.V. 3816 997 478 187 COLOMBIA TELECOMUNICACIONES S 26615 989 2325 34 Tim Celular S.A. 7738 987 1882 40 Telemar Norte Leste S.A. 11172 869 125 76 Alestra, S. de R.L. de C.V. 18881 867 1036 22 Global Village Telecom Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1227 402 40 Link Egypt (Link.NET) 37611 641 48 2 Afrihost-Brevis Computer Serv 36903 616 310 110 Office National des Postes et 8452 538 1472 15 TE-AS 36992 511 1357 26 ETISALAT MISR 37492 395 234 68 Orange Tunisie 24835 328 338 15 Vodafone Data 29571 301 37 13 Cote d'Ivoire Telecom 2018 256 327 74 TENET (The UNINET Project) 36947 237 807 13 Telecom Algeria Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5560 4192 76 China Education and Research 10620 3469 542 147 Telmex Colombia S.A. 22773 3309 2948 145 Cox Communications Inc. 7545 3297 354 214 TPG Telecom Limited 4766 3168 11160 1126 Korea Telecom 17974 2924 914 96 PT Telekomunikasi Indonesia 39891 2901 151 11 SaudiNet, Saudi Telecom Compa 9829 2497 1467 462 National Internet Backbone 20940 2453 928 1789 Akamai International B.V. 6389 2322 3671 41 BellSouth.net Inc. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 10620 3469 3322 Telmex Colombia S.A. 22773 3309 3164 Cox Communications Inc. 7545 3297 3083 TPG Telecom Limited 39891 2901 2890 SaudiNet, Saudi Telecom Compa 17974 2924 2828 PT Telekomunikasi Indonesia 6389 2322 2281 BellSouth.net Inc. 4766 3168 2042 Korea Telecom 9829 2497 2035 National Internet Backbone 18566 2204 1929 MegaPath Corporation 9808 1883 1853 Guangdong Mobile Communicatio Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 OJSC Rostelecom 30662 UNALLOCATED 8.2.129.0/24 3356 Level 3 Communicatio 53506 UNALLOCATED 8.17.102.0/23 3356 Level 3 Communicatio 46467 UNALLOCATED 8.19.192.0/24 46887 Lightower Fiber Netw 16589 UNALLOCATED 8.20.247.0/24 35838 CCANET Limited 16589 UNALLOCATED 8.26.56.0/24 35838 CCANET Limited 46473 UNALLOCATED 8.27.122.0/24 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.124.0/24 3356 Level 3 Communicatio 27205 UNALLOCATED 8.38.16.0/21 3356 Level 3 Communicatio 27205 UNALLOCATED 8.38.20.0/24 32787 Prolexic Technologie Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.226.112.0/20 62788 >>UNKNOWN<< 23.249.144.0/20 40430 colo4jax, LLC 27.100.7.0/24 56096 >>UNKNOWN<< 41.73.1.0/24 37004 >>UNKNOWN<< 41.73.2.0/24 37004 >>UNKNOWN<< 41.73.3.0/24 37004 >>UNKNOWN<< 41.73.4.0/24 37004 >>UNKNOWN<< 41.73.5.0/24 37004 >>UNKNOWN<< 41.73.6.0/24 37004 >>UNKNOWN<< 41.73.7.0/24 37004 >>UNKNOWN<< Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:101 /12:267 /13:509 /14:1036 /15:1767 /16:13000 /17:7613 /18:12769 /19:25947 /20:38243 /21:39996 /22:65749 /23:57212 /24:327351 /25:561 /26:593 /27:418 /28:44 /29:32 /30:14 /31:1 /32:32 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 39891 2664 2901 SaudiNet, Saudi Telecom Compa 22773 2506 3309 Cox Communications Inc. 18566 2106 2204 MegaPath Corporation 30036 1593 1779 Mediacom Communications Corp 6389 1487 2322 BellSouth.net Inc. 10620 1361 3469 Telmex Colombia S.A. 6983 1339 1690 EarthLink, Inc. 34984 1252 1968 TELLCOM ILETISIM HIZMETLERI A 11492 1172 1266 CABLE ONE, INC. 8551 1126 1630 Bezeq International-Ltd Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1575 2:747 4:21 5:2061 6:28 8:952 12:1773 13:39 14:1683 15:45 16:2 17:84 18:89 20:48 23:1521 24:1768 27:2277 31:1766 32:59 33:2 34:2 35:5 36:292 37:2262 38:1211 39:27 40:89 41:2759 42:396 43:1737 44:42 45:1807 46:2509 47:78 49:1130 50:881 51:24 52:173 54:328 55:5 56:6 57:42 58:1550 59:862 60:350 61:1811 62:1487 63:1924 64:4486 65:2146 66:4242 67:2151 68:1087 69:3249 70:1071 71:466 72:1992 74:2543 75:343 76:356 77:1377 78:1253 79:1069 80:1319 81:1371 82:929 83:695 84:820 85:1577 86:476 87:1047 88:562 89:1997 90:168 91:6100 92:887 93:2334 94:2339 95:2311 96:484 97:358 98:943 99:46 100:74 101:1051 103:10514 104:2391 105:123 106:401 107:1133 108:666 109:2325 110:1248 111:1645 112:958 113:1165 114:1047 115:1552 116:1588 117:1454 118:2058 119:1613 120:925 121:1168 122:2209 123:2012 124:1568 125:1752 128:692 129:407 130:404 131:1339 132:631 133:174 134:447 135:125 136:374 137:351 138:1718 139:259 140:540 141:471 142:642 143:911 144:665 145:156 146:857 147:686 148:1466 149:499 150:651 151:882 152:607 153:271 154:618 155:948 156:494 157:486 158:348 159:1110 160:476 161:747 162:2311 163:559 164:751 165:1048 166:312 167:1133 168:1763 169:651 170:1575 171:264 172:540 173:1709 174:734 175:730 176:1728 177:3950 178:2205 179:1143 180:2056 181:1698 182:1886 183:934 184:800 185:6331 186:3135 187:2090 188:2138 189:1741 190:7623 191:1232 192:8920 193:5724 194:4367 195:3758 196:1722 197:1057 198:5546 199:5702 200:6921 201:3679 202:10086 203:9636 204:4493 205:2708 206:2976 207:3104 208:4055 209:3812 210:3923 211:2045 212:2682 213:2221 214:852 215:71 216:5781 217:1934 218:791 219:577 220:1675 221:871 222:664 223:1213 End of report

1 0

SAFNOG-3: Registration Now Open!
by Mark Tinka 29 Apr '16

29 Apr '16

Hello all. Pleased to inform you that registration for the SAFNOG-3 meeting, to be held in Windhoek, Namibia, 8th - 10th August, 2016, is now open. To register your participation for SAFNOG-3, please visit the link below: http://www.safnog.org/ Please note that you will be able to view who else is attending SAFNOG-3 at the bottom of the registration web site. We look forward to seeing you all in Windhoek. Cheers, Mark Tinka On Behalf of the SAFNOG Management Committee

1 0

Multiple VRFs from provider, IP addressing
by Craig Rivenburg 29 Apr '16

29 Apr '16

Hi Nanog...looking for some advice. I have a customer who has a large network...approximately 130 sites across the US. Each site is fed via two providers, via two Separate CE Routers. It's a L3-VPN service. Each provider currently provides connectivity for 6 VRFs, each over a single service multiplexed UNI. Ie...there are 6 dot1q interfaces facing each provider, each sub-interface is in its own VRF. The network is going through a redesign, and one of my tasks is to consolidate and "streamline" IP addressing. Looking for a sanity check...I have this idea to make every dot1q sub-interface facing the provider the same point-to-point subnet. Specifically, facing a single provider, I want to use the same /30 subnet for all 6 VRFs. I'd use a separate /30 for each of the CE routers per site, so I could go from 12 /30s to 2 per site. I should note, PE-CE protocol is BGP, and behind the CE routers is a small iBGP network. I know it's technically possible to configure the OPs this way and under normal circumstances its fine. But, in this case, there is a whole lot of route leaking / cross target exchanges happening between VRFs. I still think it's okay...but can anyone think of a a failure mode that I may not have? Is what I'm thinking common practice? Is there a best practice for this sort of thing? Thanks!

2 1

Reporter's questions
by Dave Burstein 29 Apr '16

29 Apr '16

Folks I've long lurked here and thought to ask about the story below and related. The news here is that Hurricane Electric is opening Africa pops and likely bringing down prices significantly. I made some (semi-informed) guesses about the relation of backhaul/transit to ISP costs. Anyone with date, I'd welcome it on or off list. Also, pointers to other sources of attractive pricing in the Global South welcome. I've been to several international meetings where I hear that's a huge problem. Improvements welcome. I'm always looking for news about broadband and related policy. I've just been to a major 5G conference and have been learing a great deal. Quick takeaways: Field trials coming next year at both Verizon & AT&T. Test data so far is very positive. MU MIMO should be ready for market this decade, with 10x improvement in the right places. Millimeter wave is also looking good but few expect volume before 2020-2023. Very expensive because short range of high frequencies means many, many cell sites. Short range means that those with fiber in place for backhaul have an enormous advantage. That's mostly the incumbents. I believe this will be a huge problem for competition but DC hasn't caught on yet. If any of this isn't appropriate for the list, let me know. Dave Burstein http://fastnet.news/index.php/97-fnn/368-hurricane-s-incredible-backhaul-pr… Hurricane's Expected Incredible Backhaul Prices to Joburg & Nairobi could kickstart Africa's Internet <http://fastnet.news/index.php/97-fnn/368-hurricane-s-incredible-backhaul-pr…> [image: Hurricane Africa 250]Not quite as low as the $0.27/megabit price in Riga. Hurricane Electric, a major Internet backbone, is coming to Africa. Although they aren't announcing prices, I predict they will offer much less expensive backhaul/transit. Most of the continent suffers from brutally high, cartel-like prices for wholesale connections. If HE prices as I expect they will, that could easily reduce consumer Internet prices by 15% to 35%. In turn, that will allow tens of millions more to connect. In 2012 at the WCIT, a dozen Africans told me the high the cost of transit/backhaul was by far the most important international obstacle to bringing the Internet to more Africans. A friend of mine was quoted $70/megabit for a Gig-E in Lagos last year. The cost in most European or American cities would be between $0.50 and perhaps $4.00. The current high price of backhaul raises the cost of a robust broadband connection probably $10-20 over what it could be. Even a second-rate service with a low cap is probably $5 more expensive than necessary. There is a real cost involved carrying data 6,000 miles undersea but that explains only a small part of the 50-1 difference in the price between London and most of Africa. Most coastal countries are now served by more than one undersea cable. South Africa has five and Kenya three, Take a look at Steve Song's remarkable map. <https://manypossibilities.net/african-undersea-cables/>The Africans have been chomping at the bit to reduce the impact of the cartel, but the U.S. has been blocking that at the ITU. Hurricane offers a $2,700/month price for a 10 gigabit pipe in several dozen cities in Europe and North America, including Riga, Latvia and Rochester, Minnesota. That's on a five year contract. Three years would be somewhat higher. The Africa price will be higher but I believe will create a new market level. The cable middleman must be paid. A Gig-E can serve a thousand robust connections and easily five thousand with low caps. 10 gigs is enough for ten thousand good connections. HE keeps prices down by doing little advertising and less pr and run lean in all ways. They;ve been around since 1994, were early to IPv6 and other technical advances, and service many world-class clients. The ISP needs to carry the data from the Hurricane POP to their local networks. Fortunately, land-based fiber nets are growing rapidly. With 700M mobile subs in Africa, the market is booming. Afterfibre has a map <https://afterfibre.nsrc.org/> worth looking at. Africa will have more than 315M broadband users, the population of the United States, within the next 18 months. Ericsson expects a total of 500M new broadband users in Africa between 2015 & 2020. A bit further - All cost figures here other than actual price quotes are my somewhat informed estimates based on scattered details of actual ISP internal costs I've accumulated over the years. They aren't precise. Cost accounting in a high fixed cost/low marginal cost industry is highly subjective. That's especially true here because the decision how to allocate backhaul costs between voice and data varies. Also, expect a lag between the wholesale and retail price changes. In developed countries with typically robust regional fiber, a large carrier's network cost from the peering point to the local exchange was similar to transit costs. Both seem to typically equate to 3-5 hops worth of switches/routers. So if I double transit costs, which have a competitive market, I get a usable estimate of the marginal cost of the bandwidth delivered to the local exchange. If transit costs $0.27/megabit in the local market, I believe the marginal cost of bandwidth will be well under $1. That's confirmed off the record numerous times by the carriers but very rarely discussed in public. (Because bandwidth is such a small part of broadband costs, any policy discussion that focuses on how much bandwidth a consumer takes is unsound.) However, as I testified to the U.S. Broadband Commission, rural areas and small companies often have much higher costs. ISPs and telcos under ~ 20,000 customers cannot efficiently buy backhaul in many locations. (That's when I developed some rules of thumb between transit costs and the delivered cost of broadband,) I suspect the effect is even more extreme in African rural areas or where customers are relatively few. I'd welcome any data people might have. -- Editor, Fast Net News, Net Policy News and DSL Prime Author with Jennie Bourne DSL (Wiley) and Web Video: Making It Great, Getting It Noticed (Peachpit)

1 0

Re: Arista Routing Solutions
by Ryan Woolley 29 Apr '16

29 Apr '16

Colton Conor wrote: > I know Arista is typically a switch manufacturer, but with their recently > announced Arista 7500R Series and soon to be announced but already shipping > 7280R Series Arista is officially getting into the routing game. The fixed > 1U 7280R Series looks quite impressive. The 7500R series is your > traditional chassis and line card based solution. > > Both of these products have the ability to hold the full internet routing > table, and Arista is working on MPLS features. Both of these new products > use the latest Broadcom Jerico chipsets. We (Netflix) have been deploying the previous gen (7500E) as edge routers for about two years in high traffic, low route count applications in our CDN, and have been working with Arista for almost as long to improve route scale so that we could turn off all our traditional routers. The features that enable full routes on Jericho are running in our production network today and we also have the 7500R and 7280R working with full tables. I can't speak to MPLS, but for our use case (all L3, very high-density 10/40/100G, BGP, IS-IS and light QoS), it's working well. So, yes, I'd say those two products are quite viable and competitive options in the edge router space.

7 8

carrier grade fax boards?
by Ryan Finnesey 28 Apr '16

28 Apr '16

I was wondering if anyone had any recommendations on carrier grade fax boards that are SIP based? Cheers Ryan

8 8