April 2016 - Test - lists.nanog.org

Re: how to deal with port scan and brute force attack from AS 8075 ?
by Todd Crane 11 Apr '16

11 Apr '16

I must have missed that… my bad. > On Mar 31, 2016, at 2:01 AM, Dan Hollis <goemon(a)sasami.anime.net> wrote: > > It's right there in his email: > > "We have sent email to abuse(a)microsoft.com, but no answer." > > -Dan > > On Thu, 31 Mar 2016, Todd Crane wrote: > >> Oh and, >> >> I’m assuming you contacted Microsoft’s abuse? If not, it’s not cool, not to mention unprofessional, to publicly call them out on such a public forum without giving them an opportunity to correct it first. >> >>> On Mar 31, 2016, at 1:15 AM, Todd Crane <todd.crane(a)n5tech.com> wrote: >>> >>> Marcel >>> >>> Depending on what is on those machines, I would just recommend using fail2ban. The default is that if an ip address fails ssh auth 3 times in 5 minutes, their ip gets blocked via iptables for 5 minutes. This is enough to thwart most scripted attacks, especially those from a certain government in Asia. This is configurable to various applications, timing schemes, and blocking/jailing mechanisms. >>> >>> -Todd >>>> On Mar 31, 2016, at 1:02 AM, marcel.duregards--- via NANOG <nanog(a)nanog.org> wrote: >>>> >>>> Dear Nanog'er, >>>> >>>> We are facing a lot of port scan and brute force attack on port 22 (but >>>> not limited to) from Microsoft AS 8075 range toward our own infra, or >>>> toward our customers. >>>> We have sent email to abuse(a)microsoft.com, but no answer. >>>> >>>> source ip are: >>>> NetRange: 40.74.0.0 - 40.125.127.255 >>>> CIDR: 40.74.0.0/15, 40.112.0.0/13, 40.124.0.0/16, >>>> 40.76.0.0/14, 40.80.0.0/12, 40.125.0.0/17, 40.96.0.0/12, 40.120.0.0/14 >>>> NetName: MSFT >>>> >>>> >>>> >>>> We consider port scan and brute force on ssh port as an attack, and even >>>> as a pre-DDOS phase (could be use to install botnet, detect unpatched >>>> host, and so one). >>>> >>>> It's one thing to propose services and make money over an infra, it's an >>>> other thing to take care that you clients do not use this infra to make >>>> illegal stuffs. >>>> >>>> >>>> How do you deal with such massive amount of 'illegal' traffic ? >>>> >>>> Thank, >>>> Best Regards >>>> Marcel >>>> >>>> >>>> >>>> >>>> >>>> He are some examples (we have more than 3000 such packets per day just >>>> from them, probably Azure), and source ip is always differents of course: >>>> >>>> >>>> Flow Filtering Expression >>>> src AS 8075 and dst port 22 and packets=1 >>>> Limit Flows >>>> 40000 >>>> Sorting >>>> By Date >>>> >>>> Date_first_seen Duration Proto _IP_Addr:Port >>>> Dst_IP_Addr:Port Flags Packets >>>> 2016-02-29 14:55:20.108 0.000 6 104.45.210.69:1160 -> >>>> x.x.231:22 ...... 1 >>>> 2016-02-29 14:55:20.611 0.000 6 104.45.210.69:1161 -> >>>> x.x.231:22 ...... 1 >>>> 2016-02-29 14:56:41.004 0.000 6 40.76.55.204:1090 -> >>>> x.x..14:22 ...... 1 >>>> 2016-02-29 14:56:41.324 0.000 6 40.76.55.204:1091 -> >>>> x.x..14:22 ...... 1 >>>> 2016-02-29 15:00:05.670 0.000 6 40.76.55.204:1088 -> >>>> x.x.125:22 ...... 1 >>>> 2016-02-29 15:00:06.003 0.000 6 40.76.55.204:1089 -> >>>> x.x.125:22 ...... 1 >>>> 2016-02-29 15:01:17.358 0.000 6 40.76.70.58:1168 -> >>>> x.x..80:22 ...... 1 >>>> 2016-02-29 15:01:17.676 0.000 6 40.76.70.58:1169 -> >>>> x.x..80:22 ...... 1 >>>> 2016-02-29 15:02:42.637 0.000 6 40.76.55.204:1176 -> >>>> x.x.193:22 ...... 1 >>>> 2016-02-29 15:02:42.878 0.000 6 40.76.55.204:1177 -> >>>> x.x.193:22 ...... 1 >>>> 2016-02-29 15:02:48.067 0.000 6 104.45.210.69:1160 -> >>>> x.x.173:22 ...... 1 >>>> 2016-02-29 15:02:48.394 0.000 6 104.45.210.69:1161 -> >>>> x.x.173:22 ...... 1 >>>> 2016-02-29 15:03:18.854 0.000 6 40.121.53.153:1041 -> >>>> x.x..88:22 ...... 1 >>>> 2016-02-29 15:03:19.172 0.000 6 40.121.53.153:1042 -> >>>> x.x..88:22 ...... 1 >>>> 2016-02-29 15:06:36.248 0.000 6 40.76.55.204:1056 -> >>>> x.x..45:22 ...... 1 >>>> 2016-02-29 15:07:31.882 0.000 6 40.76.80.17:44895 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 15:07:32.245 0.000 6 40.76.80.17:44896 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 15:09:08.433 0.000 6 40.76.70.58:1168 -> >>>> x.x..31:22 ...... 1 >>>> 2016-02-29 15:09:08.744 0.000 6 40.76.70.58:1169 -> >>>> x.x..31:22 ...... 1 >>>> 2016-02-29 15:11:45.668 0.000 6 40.76.80.17:47993 -> >>>> x.x.157:22 ...... 1 >>>> 2016-02-29 15:11:45.987 0.000 6 40.76.80.17:47994 -> >>>> x.x.157:22 ...... 1 >>>> 2016-02-29 15:12:09.543 0.000 6 40.76.70.58:1168 -> >>>> x.x..24:22 ...... 1 >>>> 2016-02-29 15:12:09.925 0.000 6 40.76.70.58:1169 -> >>>> x.x..24:22 ...... 1 >>>> 2016-02-29 15:17:05.920 0.000 6 40.76.70.58:1168 -> >>>> x.x.243:22 ...... 1 >>>> 2016-02-29 15:17:06.241 0.000 6 40.76.70.58:1169 -> >>>> x.x.243:22 ...... 1 >>>> 2016-02-29 15:19:21.364 0.000 6 40.83.121.211:62936 -> >>>> x.x..81:22 ...... 1 >>>> 2016-02-29 15:19:21.704 0.000 6 40.83.121.211:62937 -> >>>> x.x..81:22 ...... 1 >>>> 2016-02-29 15:19:45.891 0.000 6 40.76.70.58:1168 -> >>>> x.x..39:22 ...... 1 >>>> 2016-02-29 15:19:46.273 0.000 6 40.76.70.58:1169 -> >>>> x.x..39:22 ...... 1 >>>> 2016-02-29 15:21:52.030 0.000 6 40.76.70.58:1168 -> >>>> x.x.120:22 ...... 1 >>>> 2016-02-29 15:21:52.349 0.000 6 40.76.70.58:1169 -> >>>> x.x.120:22 ...... 1 >>>> 2016-02-29 15:24:07.614 0.000 6 40.76.55.204:1048 -> >>>> x.x.237:22 ...... 1 >>>> 2016-02-29 15:24:07.933 0.000 6 40.76.55.204:1128 -> >>>> x.x.237:22 ...... 1 >>>> 2016-02-29 15:27:31.289 0.000 6 40.121.53.153:1041 -> >>>> x.x.133:22 ...... 1 >>>> 2016-02-29 15:27:31.544 0.000 6 40.121.53.153:1042 -> >>>> x.x.133:22 ...... 1 >>>> 2016-02-29 15:27:59.120 0.000 6 40.76.70.58:1168 -> >>>> x.x.9.3:22 ...... 1 >>>> 2016-02-29 15:27:59.440 0.000 6 40.76.70.58:1169 -> >>>> x.x.9.3:22 ...... 1 >>>> 2016-02-29 15:29:30.933 0.000 6 40.76.70.58:1168 -> >>>> x.x.211:22 ...... 1 >>>> 2016-02-29 15:29:31.031 0.000 6 40.76.70.58:1169 -> >>>> x.x.211:22 ...... 1 >>>> 2016-02-29 15:29:33.729 0.000 6 40.76.55.204:1142 -> >>>> x.x.166:22 ...... 1 >>>> 2016-02-29 15:29:34.032 0.000 6 40.76.55.204:1143 -> >>>> x.x.166:22 ...... 1 >>>> 2016-02-29 15:31:41.947 0.000 6 40.76.70.58:1168 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 15:31:42.266 0.000 6 40.76.70.58:1169 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 15:32:10.044 0.000 6 40.121.53.153:1041 -> >>>> x.x..71:22 ...... 1 >>>> 2016-02-29 15:32:10.348 0.000 6 40.121.53.153:1042 -> >>>> x.x..71:22 ...... 1 >>>> 2016-02-29 15:32:10.442 0.000 6 104.45.210.69:1161 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 15:32:10.475 0.000 6 104.45.210.69:1160 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 15:32:29.165 0.000 6 40.121.143.132:1040 -> >>>> x.x..62:22 ...... 1 >>>> 2016-02-29 15:32:29.466 0.000 6 40.121.143.132:1041 -> >>>> x.x..62:22 ...... 1 >>>> 2016-02-29 15:37:07.616 0.000 6 40.76.80.17:56902 -> >>>> x.x..51:22 ...... 1 >>>> 2016-02-29 15:37:07.925 0.000 6 40.76.80.17:56903 -> >>>> x.x..51:22 ...... 1 >>>> 2016-02-29 15:40:04.546 0.000 6 40.121.53.153:1041 -> >>>> x.x.186:22 ...... 1 >>>> 2016-02-29 15:40:04.866 0.000 6 40.121.53.153:1042 -> >>>> x.x.186:22 ...... 1 >>>> 2016-02-29 15:40:28.870 0.000 6 40.76.70.58:1168 -> >>>> x.x.171:22 ...... 1 >>>> 2016-02-29 15:40:29.125 0.000 6 40.76.70.58:1169 -> >>>> x.x.171:22 ...... 1 >>>> 2016-02-29 15:41:57.034 0.000 6 40.76.55.204:1128 -> >>>> x.x.181:22 ...... 1 >>>> 2016-02-29 15:41:57.354 0.000 6 40.76.55.204:1176 -> >>>> x.x.181:22 ...... 1 >>>> >>>> >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.163:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.176:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.206:22 ...... 1 >>>> 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> >>>> x.x.158:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.185:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.251:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.255:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.141:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.136:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.235:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.242:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.240:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.100:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.244:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x.217:22 ...... 1 >>>> 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> >>>> x.x..72:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.221:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.5.4:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.150:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.145:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.119:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..52:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..75:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.127:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..22:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..77:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.246:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x.137:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..85:22 ...... 1 >>>> 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> >>>> x.x..35:22 ...... 1 >>>> >>>> >>>> >>>> >>> >>

5 6

Would someone who works for Brighthouse please contact me offlist to resolve a connectivity issue?
by Andrew Kirch 08 Apr '16

08 Apr '16

I can't access http://jimtest.delong.com via your Cable Modem network. Thanks! Andrew

1 0

Apple blocking downloads to certain IP address
by Darin Steffl 08 Apr '16

08 Apr '16

Hello all, We seem to keep having problems with Apple blocking app downloads and software updates to one of our IP addresses we use to NAT some customers to. To fix it in the past, we've switched customers to a different IP and it works awhile then it stops again. Anyone have a contact for Apple so we can get our entire subnet whitelisted to not be blocked? Thanks -- Darin Steffl Minnesota WiFi www.mnwifi.com 507-634-WiFi <http://www.facebook.com/minnesotawifi> Like us on Facebook <http://www.facebook.com/minnesotawifi>

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 08 Apr '16

08 Apr '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, PaNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 09 Apr, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 589751 Prefixes after maximum aggregation (per Origin AS): 216647 Deaggregation factor: 2.72 Unique aggregates announced (without unneeded subnets): 288363 Total ASes present in the Internet Routing Table: 53345 Prefixes per ASN: 11.06 Origin-only ASes present in the Internet Routing Table: 36594 Origin ASes announcing only one prefix: 15723 Transit ASes present in the Internet Routing Table: 6418 Transit-only ASes present in the Internet Routing Table: 174 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 39 Max AS path prepend of ASN ( 40285) 34 Prefixes from unregistered ASNs in the Routing Table: 960 Unregistered ASNs in the Routing Table: 357 Number of 32-bit ASNs allocated by the RIRs: 13382 Number of 32-bit ASNs visible in the Routing Table: 10333 Prefixes from 32-bit ASNs in the Routing Table: 40300 Number of bogon 32-bit ASNs visible in the Routing Table: 13 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 396 Number of addresses announced to Internet: 2806952004 Equivalent to 167 /8s, 78 /16s and 176 /24s Percentage of available address space announced: 75.8 Percentage of allocated address space announced: 75.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.1 Total number of prefixes smaller than registry allocations: 192907 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 151042 Total APNIC prefixes after maximum aggregation: 42035 APNIC Deaggregation factor: 3.59 Prefixes being announced from the APNIC address blocks: 161299 Unique aggregates announced from the APNIC address blocks: 65695 APNIC Region origin ASes present in the Internet Routing Table: 5147 APNIC Prefixes per ASN: 31.34 APNIC Region origin ASes announcing only one prefix: 1185 APNIC Region transit ASes present in the Internet Routing Table: 910 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 39 Number of APNIC region 32-bit ASNs visible in the Routing Table: 1975 Number of APNIC addresses announced to Internet: 751850820 Equivalent to 44 /8s, 208 /16s and 85 /24s Percentage of available APNIC address space announced: 87.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 131072-135580 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 180298 Total ARIN prefixes after maximum aggregation: 89148 ARIN Deaggregation factor: 2.02 Prefixes being announced from the ARIN address blocks: 185444 Unique aggregates announced from the ARIN address blocks: 87967 ARIN Region origin ASes present in the Internet Routing Table: 16393 ARIN Prefixes per ASN: 11.31 ARIN Region origin ASes announcing only one prefix: 5871 ARIN Region transit ASes present in the Internet Routing Table: 1713 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 37 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1120 Number of ARIN addresses announced to Internet: 1101672000 Equivalent to 65 /8s, 170 /16s and 46 /24s Percentage of available ARIN address space announced: 58.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-395164 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 141875 Total RIPE prefixes after maximum aggregation: 70011 RIPE Deaggregation factor: 2.03 Prefixes being announced from the RIPE address blocks: 150551 Unique aggregates announced from the RIPE address blocks: 92796 RIPE Region origin ASes present in the Internet Routing Table: 18062 RIPE Prefixes per ASN: 8.34 RIPE Region origin ASes announcing only one prefix: 7904 RIPE Region transit ASes present in the Internet Routing Table: 2997 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 29 Number of RIPE region 32-bit ASNs visible in the Routing Table: 4631 Number of RIPE addresses announced to Internet: 704286592 Equivalent to 41 /8s, 250 /16s and 143 /24s Percentage of available RIPE address space announced: 102.4 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-204287 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 61962 Total LACNIC prefixes after maximum aggregation: 12210 LACNIC Deaggregation factor: 5.07 Prefixes being announced from the LACNIC address blocks: 76046 Unique aggregates announced from the LACNIC address blocks: 35816 LACNIC Region origin ASes present in the Internet Routing Table: 2470 LACNIC Prefixes per ASN: 30.79 LACNIC Region origin ASes announcing only one prefix: 577 LACNIC Region transit ASes present in the Internet Routing Table: 553 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 21 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2407 Number of LACNIC addresses announced to Internet: 170680384 Equivalent to 10 /8s, 44 /16s and 96 /24s Percentage of available LACNIC address space announced: 101.7 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-265628 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 14193 Total AfriNIC prefixes after maximum aggregation: 3202 AfriNIC Deaggregation factor: 4.43 Prefixes being announced from the AfriNIC address blocks: 16015 Unique aggregates announced from the AfriNIC address blocks: 5732 AfriNIC Region origin ASes present in the Internet Routing Table: 740 AfriNIC Prefixes per ASN: 21.64 AfriNIC Region origin ASes announcing only one prefix: 186 AfriNIC Region transit ASes present in the Internet Routing Table: 170 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 200 Number of AfriNIC addresses announced to Internet: 78087168 Equivalent to 4 /8s, 167 /16s and 132 /24s Percentage of available AfriNIC address space announced: 77.6 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5594 4192 76 China Education and Research 7545 3299 353 199 TPG Telecom Limited 4766 3153 11142 1119 Korea Telecom 17974 2920 914 96 PT Telekomunikasi Indonesia 9829 2471 1456 445 National Internet Backbone 4755 2099 432 243 TATA Communications formerly 9808 1855 8717 30 Guangdong Mobile Communicatio 4808 1657 2299 539 CNCGROUP IP network China169 4788 1537 645 62 TM Net, Internet Service Prov 38197 1508 93 203 Sun Network (Hong Kong) Limit Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3355 2948 148 Cox Communications Inc. 6389 2357 3687 42 BellSouth.net Inc. 18566 2209 394 276 MegaPath Corporation 20115 1922 1933 403 Charter Communications 30036 1753 345 215 Mediacom Communications Corp 6983 1691 849 231 EarthLink, Inc. 4323 1568 1004 386 tw telecom holdings, inc. 209 1543 4619 1225 Qwest Communications Company, 701 1399 11446 660 MCI Communications Services, 11492 1271 235 601 CABLE ONE, INC. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 2708 143 10 SaudiNet, Saudi Telecom Compa 20940 2423 931 1761 Akamai International B.V. 34984 1960 323 413 TELLCOM ILETISIM HIZMETLERI A 8551 1412 376 56 Bezeq International-Ltd 6849 1152 355 21 JSC "Ukrtelecom" 12479 1150 981 86 France Telecom Espana SA 8402 1088 544 15 OJSC "Vimpelcom" 13188 1079 98 69 TOV "Bank-Inform" 31148 1035 47 41 Freenet Ltd. 6830 889 2711 463 Liberty Global Operations B.V Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3439 539 176 Telmex Colombia S.A. 8151 2219 3312 543 Uninet S.A. de C.V. 7303 1510 939 240 Telecom Argentina S.A. 11830 1477 368 51 Instituto Costarricense de El 6503 1434 453 56 Axtel, S.A.B. de C.V. 6147 1055 377 27 Telefonica del Peru S.A.A. 3816 995 478 185 COLOMBIA TELECOMUNICACIONES S 26615 993 2325 34 Tim Celular S.A. 7738 987 1882 40 Telemar Norte Leste S.A. 28573 879 2175 156 NET Serviços de Comunicação S Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1229 402 40 Link Egypt (Link.NET) 37611 643 48 2 Afrihost-Brevis Computer Serv 8452 619 1472 15 TE-AS 36903 585 294 107 Office National des Postes et 36992 509 1357 25 ETISALAT MISR 37492 370 225 65 Orange Tunisie 24835 297 210 13 Vodafone Data 29571 280 37 12 Cote d'Ivoire Telecom 2018 256 327 74 TENET (The UNINET Project) 36947 236 807 13 Telecom Algeria Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5594 4192 76 China Education and Research 10620 3439 539 176 Telmex Colombia S.A. 22773 3355 2948 148 Cox Communications Inc. 7545 3299 353 199 TPG Telecom Limited 4766 3153 11142 1119 Korea Telecom 17974 2920 914 96 PT Telekomunikasi Indonesia 39891 2708 143 10 SaudiNet, Saudi Telecom Compa 9829 2471 1456 445 National Internet Backbone 20940 2423 931 1761 Akamai International B.V. 6389 2357 3687 42 BellSouth.net Inc. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 10620 3439 3263 Telmex Colombia S.A. 22773 3355 3207 Cox Communications Inc. 7545 3299 3100 TPG Telecom Limited 17974 2920 2824 PT Telekomunikasi Indonesia 39891 2708 2698 SaudiNet, Saudi Telecom Compa 6389 2357 2315 BellSouth.net Inc. 4766 3153 2034 Korea Telecom 9829 2471 2026 National Internet Backbone 18566 2209 1933 MegaPath Corporation 4755 2099 1856 TATA Communications formerly Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 30662 UNALLOCATED 8.2.129.0/24 3356 Level 3 Communicatio 53506 UNALLOCATED 8.17.102.0/23 3356 Level 3 Communicatio 46467 UNALLOCATED 8.19.192.0/24 46887 Lightower Fiber Netw 16589 UNALLOCATED 8.20.247.0/24 35838 CCANET Limited 16589 UNALLOCATED 8.26.56.0/24 35838 CCANET Limited 46473 UNALLOCATED 8.27.122.0/24 3356 Level 3 Communicatio 46473 UNALLOCATED 8.27.124.0/24 3356 Level 3 Communicatio 27205 UNALLOCATED 8.38.16.0/21 3356 Level 3 Communicatio 27205 UNALLOCATED 8.38.22.0/24 32787 Prolexic Technologie 15347 UNALLOCATED 8.224.147.0/24 12064 Cox Communications I Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 5.100.241.0/24 23456 32bit Transition AS 23.178.0.0/24 23456 32bit Transition AS 23.226.112.0/20 62788 >>UNKNOWN<< 23.249.144.0/20 40430 colo4jax, LLC 27.100.7.0/24 56096 >>UNKNOWN<< 37.46.10.0/23 36351 SoftLayer Technologies Inc. 37.46.14.0/24 36351 SoftLayer Technologies Inc. 37.46.15.0/24 36351 SoftLayer Technologies Inc. 41.73.1.0/24 37004 >>UNKNOWN<< 41.73.2.0/24 37004 >>UNKNOWN<< Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:101 /12:267 /13:512 /14:1029 /15:1758 /16:12964 /17:7576 /18:12737 /19:25828 /20:38174 /21:40038 /22:65173 /23:56630 /24:325217 /25:552 /26:595 /27:412 /28:45 /29:31 /30:14 /31:1 /32:32 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 39891 2664 2708 SaudiNet, Saudi Telecom Compa 22773 2532 3355 Cox Communications Inc. 18566 2111 2209 MegaPath Corporation 30036 1567 1753 Mediacom Communications Corp 6389 1499 2357 BellSouth.net Inc. 6983 1340 1691 EarthLink, Inc. 10620 1340 3439 Telmex Colombia S.A. 34984 1245 1960 TELLCOM ILETISIM HIZMETLERI A 11492 1175 1271 CABLE ONE, INC. 6849 970 1152 JSC "Ukrtelecom" Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1661 2:735 4:20 5:2046 6:28 8:946 12:1778 13:39 14:1669 15:45 16:2 17:77 18:89 20:48 23:1445 24:1780 27:2281 31:1761 32:54 33:2 34:2 35:5 36:279 37:2263 38:1182 39:24 40:87 41:2781 42:393 43:1704 44:41 45:1783 46:2480 47:74 49:1140 50:844 51:8 52:143 54:220 55:4 56:6 57:45 58:1535 59:873 60:570 61:1814 62:1482 63:1920 64:4473 65:2149 66:4299 67:2170 68:1101 69:3279 70:1063 71:468 72:1984 74:2542 75:340 76:418 77:1340 78:1270 79:837 80:1329 81:1360 82:940 83:687 84:816 85:1580 86:472 87:1015 88:561 89:1947 90:168 91:6058 92:850 93:2319 94:2313 95:2306 96:475 97:358 98:956 99:45 100:71 101:1018 103:10298 104:2347 105:162 106:392 107:1081 108:676 109:2276 110:1259 111:1658 112:960 113:1140 114:1040 115:1699 116:1539 117:1426 118:2151 119:1580 120:521 121:1166 122:2212 123:2009 124:1620 125:1760 128:716 129:381 130:413 131:1316 132:628 133:174 134:451 135:123 136:372 137:349 138:1716 139:239 140:251 141:467 142:642 143:883 144:611 145:162 146:853 147:675 148:1456 149:496 150:653 151:765 152:608 153:277 154:573 155:950 156:491 157:473 158:342 159:1108 160:450 161:740 162:2294 163:547 164:753 165:1039 166:313 167:1103 168:1675 169:638 170:1583 171:271 172:527 173:1697 174:729 175:909 176:1678 177:4076 178:2241 179:1145 180:2064 181:1724 182:1907 183:681 184:788 185:6120 186:3127 187:2117 188:2154 189:1744 190:7700 191:1199 192:8932 193:5723 194:4367 195:3773 196:1713 197:1064 198:5541 199:5655 200:6942 201:3713 202:10112 203:9662 204:4656 205:2702 206:2982 207:3079 208:4060 209:3789 210:3937 211:2011 212:2633 213:2190 214:836 215:72 216:5738 217:1932 218:763 219:567 220:1678 221:858 222:663 223:970 End of report

1 0

Yahoo geo IP help
by Stuart Clark 08 Apr '16

08 Apr '16

Could someone reach out to me off list from Yahoo please. Cheers! Sent from my iPhone

1 0

JANOG38 Meeting Call for Presentations
by Hiroya Kaneko 07 Apr '16

07 Apr '16

Hello, JANOG38 Meeting will take place on 6-8 July 2016 in OKINAWA, Japan. JANOG is making a call for presentations until 15 April 2016. Our meetings are in Japanese, but we have had several non-Japanese speakers who made presentations in the past. We are looking forward to your proposals for presentations. Shishio Tsuchiya,Hiroya Kaneko JANOG38 Programme Committee Co-Chairs ---------------------------------------------------------------------- ** JANOG38 MEETING ---------------------------------------------------------------------- - Host : OKIT Corporation - Date : 6 July., 2016 - 8 July., 2016 - Venue : TBD (Naha, Okinawa) - Fees : Conference(6-8 July): Free Banquet(in the evening on 7th): TBD ---------------------------------------------------------------------- ** HOW TO SUBMIT PRESENTATIONS ---------------------------------------------------------------------- If you are interested to give a presentation, submissions are welcome via e-mail at:"meeting-38[at]janog.gr.jp" with the following information. 1. Speaker's name(s) 2. Speaker's organization(s) 3. Preferred contact email address 4. Submission category (General Session or Panel Session) * If your choice is panel, please tell us the number of speakers 5. Presentation title 6. Abstract 7. Desired presentation time and discussion time 8. Slides (attachment or URL), in PowerPoint or PDF format. Our Meetings are in Japanese, so non-Japanese speakers usually arrange an informal interpreter. If you are interested in making a presentation at JANOG but cannot arrange an interpreter by yourself, you could consult with us at: "meeting-38[at]janog.gr.jp". Although we cannot guarantee, we may be able to help you on volunteer basis. Let us know if you have any questions : meeting-38[at]janog.gr.jp ---------------------------------------------------------------------- ** THE KEY DATE FOR JANOG38 SUBMISSIONS ---------------------------------------------------------------------- CFP Deadline : 15 April 23:59 JST The Program Committee will notify you after 25th April about your submission. ---------------------------------------------------------------------- ** VISA ---------------------------------------------------------------------- Foreign visitor entering Japan must have a passport which has valid period during you stay in Japan. Passport holders from some countries are required to have a visa to visit Japan before they depart toward Japan. Many are exempt from this requirement and can get their visa on entry to Japan. Please determine whether you are exempt from the visa requirement. Please refer to the official website from Ministry of Foreign Affairs of Japan or any other appropriate website to get more information about Visa application. Ministry of Foreign Affairs of Japan - Guide to Japanese Visas http://www.mofa.go.jp/j_info/visit/visa/index.html List of Countries and Regions for Visa Exemptions http://www.mofa.go.jp/j_info/visit/visa/short/novisa.html Please note that JANOG can not assist you with your visa application. If you have any questions about the meeting, please feel free to contact meeting-38[at]janog.gr.jp. ---------------------------------------------------------------------- ** ABOUT JANOG ---------------------------------------------------------------------- JANOG webpage in English is available at: http://www.janog.gr.jp/en/ ---------------------------------------------------------------------- ******************************************************* Hiroya Kaneko NEC Cloud System Research Laboratories 1753, Shimonumabe, Nakahara-ku, Kawasaki Kanagawa 211-8666, Japan TEL +8150-3381-7597 Mail: h-kaneko(a)dr.jp.nec.com

2 1

Microwave link capacity
by Jean-Francois Mezei 07 Apr '16

07 Apr '16

In a context of providing rural communities with modern broadband. Reading some tells me that Microwave links can be raised to 1gbps. How common is that ? I assume that cell phone towers have modern microwave links (when not directly on fibre). What sort of capacity would typically be provided ? And in the case of a remote village/town served by microwave originally designed to handle just phone calls, how difficult/expensive is it to upgrade to 1gbps or higher capacity ? Just a change of radio ? or radio and antenna, keeping only the tower ? (keeping spectrum acquisition out of discussion as that is a whole other ball game).

13 15

how to deal with port scan and brute force attack from AS 8075 ?
by marcel.duregards＠yahoo.fr 07 Apr '16

07 Apr '16

Dear Nanog'er, We are facing a lot of port scan and brute force attack on port 22 (but not limited to) from Microsoft AS 8075 range toward our own infra, or toward our customers. We have sent email to abuse(a)microsoft.com, but no answer. source ip are: NetRange: 40.74.0.0 - 40.125.127.255 CIDR: 40.74.0.0/15, 40.112.0.0/13, 40.124.0.0/16, 40.76.0.0/14, 40.80.0.0/12, 40.125.0.0/17, 40.96.0.0/12, 40.120.0.0/14 NetName: MSFT We consider port scan and brute force on ssh port as an attack, and even as a pre-DDOS phase (could be use to install botnet, detect unpatched host, and so one). It's one thing to propose services and make money over an infra, it's an other thing to take care that you clients do not use this infra to make illegal stuffs. How do you deal with such massive amount of 'illegal' traffic ? Thank, Best Regards Marcel He are some examples (we have more than 3000 such packets per day just from them, probably Azure), and source ip is always differents of course: Flow Filtering Expression src AS 8075 and dst port 22 and packets=1 Limit Flows 40000 Sorting By Date Date_first_seen Duration Proto _IP_Addr:Port Dst_IP_Addr:Port Flags Packets 2016-02-29 14:55:20.108 0.000 6 104.45.210.69:1160 -> x.x.231:22 ...... 1 2016-02-29 14:55:20.611 0.000 6 104.45.210.69:1161 -> x.x.231:22 ...... 1 2016-02-29 14:56:41.004 0.000 6 40.76.55.204:1090 -> x.x..14:22 ...... 1 2016-02-29 14:56:41.324 0.000 6 40.76.55.204:1091 -> x.x..14:22 ...... 1 2016-02-29 15:00:05.670 0.000 6 40.76.55.204:1088 -> x.x.125:22 ...... 1 2016-02-29 15:00:06.003 0.000 6 40.76.55.204:1089 -> x.x.125:22 ...... 1 2016-02-29 15:01:17.358 0.000 6 40.76.70.58:1168 -> x.x..80:22 ...... 1 2016-02-29 15:01:17.676 0.000 6 40.76.70.58:1169 -> x.x..80:22 ...... 1 2016-02-29 15:02:42.637 0.000 6 40.76.55.204:1176 -> x.x.193:22 ...... 1 2016-02-29 15:02:42.878 0.000 6 40.76.55.204:1177 -> x.x.193:22 ...... 1 2016-02-29 15:02:48.067 0.000 6 104.45.210.69:1160 -> x.x.173:22 ...... 1 2016-02-29 15:02:48.394 0.000 6 104.45.210.69:1161 -> x.x.173:22 ...... 1 2016-02-29 15:03:18.854 0.000 6 40.121.53.153:1041 -> x.x..88:22 ...... 1 2016-02-29 15:03:19.172 0.000 6 40.121.53.153:1042 -> x.x..88:22 ...... 1 2016-02-29 15:06:36.248 0.000 6 40.76.55.204:1056 -> x.x..45:22 ...... 1 2016-02-29 15:07:31.882 0.000 6 40.76.80.17:44895 -> x.x..75:22 ...... 1 2016-02-29 15:07:32.245 0.000 6 40.76.80.17:44896 -> x.x..75:22 ...... 1 2016-02-29 15:09:08.433 0.000 6 40.76.70.58:1168 -> x.x..31:22 ...... 1 2016-02-29 15:09:08.744 0.000 6 40.76.70.58:1169 -> x.x..31:22 ...... 1 2016-02-29 15:11:45.668 0.000 6 40.76.80.17:47993 -> x.x.157:22 ...... 1 2016-02-29 15:11:45.987 0.000 6 40.76.80.17:47994 -> x.x.157:22 ...... 1 2016-02-29 15:12:09.543 0.000 6 40.76.70.58:1168 -> x.x..24:22 ...... 1 2016-02-29 15:12:09.925 0.000 6 40.76.70.58:1169 -> x.x..24:22 ...... 1 2016-02-29 15:17:05.920 0.000 6 40.76.70.58:1168 -> x.x.243:22 ...... 1 2016-02-29 15:17:06.241 0.000 6 40.76.70.58:1169 -> x.x.243:22 ...... 1 2016-02-29 15:19:21.364 0.000 6 40.83.121.211:62936 -> x.x..81:22 ...... 1 2016-02-29 15:19:21.704 0.000 6 40.83.121.211:62937 -> x.x..81:22 ...... 1 2016-02-29 15:19:45.891 0.000 6 40.76.70.58:1168 -> x.x..39:22 ...... 1 2016-02-29 15:19:46.273 0.000 6 40.76.70.58:1169 -> x.x..39:22 ...... 1 2016-02-29 15:21:52.030 0.000 6 40.76.70.58:1168 -> x.x.120:22 ...... 1 2016-02-29 15:21:52.349 0.000 6 40.76.70.58:1169 -> x.x.120:22 ...... 1 2016-02-29 15:24:07.614 0.000 6 40.76.55.204:1048 -> x.x.237:22 ...... 1 2016-02-29 15:24:07.933 0.000 6 40.76.55.204:1128 -> x.x.237:22 ...... 1 2016-02-29 15:27:31.289 0.000 6 40.121.53.153:1041 -> x.x.133:22 ...... 1 2016-02-29 15:27:31.544 0.000 6 40.121.53.153:1042 -> x.x.133:22 ...... 1 2016-02-29 15:27:59.120 0.000 6 40.76.70.58:1168 -> x.x.9.3:22 ...... 1 2016-02-29 15:27:59.440 0.000 6 40.76.70.58:1169 -> x.x.9.3:22 ...... 1 2016-02-29 15:29:30.933 0.000 6 40.76.70.58:1168 -> x.x.211:22 ...... 1 2016-02-29 15:29:31.031 0.000 6 40.76.70.58:1169 -> x.x.211:22 ...... 1 2016-02-29 15:29:33.729 0.000 6 40.76.55.204:1142 -> x.x.166:22 ...... 1 2016-02-29 15:29:34.032 0.000 6 40.76.55.204:1143 -> x.x.166:22 ...... 1 2016-02-29 15:31:41.947 0.000 6 40.76.70.58:1168 -> x.x.137:22 ...... 1 2016-02-29 15:31:42.266 0.000 6 40.76.70.58:1169 -> x.x.137:22 ...... 1 2016-02-29 15:32:10.044 0.000 6 40.121.53.153:1041 -> x.x..71:22 ...... 1 2016-02-29 15:32:10.348 0.000 6 40.121.53.153:1042 -> x.x..71:22 ...... 1 2016-02-29 15:32:10.442 0.000 6 104.45.210.69:1161 -> x.x.246:22 ...... 1 2016-02-29 15:32:10.475 0.000 6 104.45.210.69:1160 -> x.x.246:22 ...... 1 2016-02-29 15:32:29.165 0.000 6 40.121.143.132:1040 -> x.x..62:22 ...... 1 2016-02-29 15:32:29.466 0.000 6 40.121.143.132:1041 -> x.x..62:22 ...... 1 2016-02-29 15:37:07.616 0.000 6 40.76.80.17:56902 -> x.x..51:22 ...... 1 2016-02-29 15:37:07.925 0.000 6 40.76.80.17:56903 -> x.x..51:22 ...... 1 2016-02-29 15:40:04.546 0.000 6 40.121.53.153:1041 -> x.x.186:22 ...... 1 2016-02-29 15:40:04.866 0.000 6 40.121.53.153:1042 -> x.x.186:22 ...... 1 2016-02-29 15:40:28.870 0.000 6 40.76.70.58:1168 -> x.x.171:22 ...... 1 2016-02-29 15:40:29.125 0.000 6 40.76.70.58:1169 -> x.x.171:22 ...... 1 2016-02-29 15:41:57.034 0.000 6 40.76.55.204:1128 -> x.x.181:22 ...... 1 2016-02-29 15:41:57.354 0.000 6 40.76.55.204:1176 -> x.x.181:22 ...... 1 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> x.x.163:22 ...... 1 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> x.x.176:22 ...... 1 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> x.x.206:22 ...... 1 2016-02-29 16:55:49.183 0.000 6 40.117.96.192:1120 -> x.x.158:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.185:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.251:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.255:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.141:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.136:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.235:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.242:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.240:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.100:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.244:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x.217:22 ...... 1 2016-02-29 16:55:49.186 0.000 6 40.117.96.192:1120 -> x.x..72:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.221:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.5.4:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.150:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.145:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.119:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..52:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..75:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.127:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..22:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..77:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.246:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x.137:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..85:22 ...... 1 2016-02-29 16:55:49.187 0.000 6 40.117.96.192:1120 -> x.x..35:22 ...... 1

11 12

Best practices for sending network maintenance notifications
by Dan Mahoney, System Admin 06 Apr '16

06 Apr '16

All, We recently, at $dayjob, had one of our peers (at Symantec) send out a network maint notification, putting 70 addresses in the "To:" field, rather than using BCC or the exchange's mailing list. Naturally, when you mail 30 addresses, of the forms peering@ and noc@ various organizations, you're likely to hit at least a few autoresponders and ticket systems... And at least one or two of those autoresponders are of course brainded and configured to reply-all. (In this case, Verizon's ServiceNow setup was such a stupid responder). And that made things fun in our own ticket system, as our RT setup happily created a bunch of tickets. My question for the group -- does anyone know if there's a "best practices" for sending maint notifications like this? An RFC sort of thing? While it would define a social protocol, rather than a truly technical one, if there's not such a document, it seems like it could useful. And once such a thing exists, exchanges could of course helpfully point their members AT it (for both their humans, and ticket systems, to follow). -Dan --

9 8

RE: Best practices for sending network maintenance notifications
by Scott Weeks 06 Apr '16

06 Apr '16

--- ray(a)orsiniit.com wrote: From: Ray Orsini <ray(a)orsiniit.com> "The other "don't do that" is never configure Music on Hold for any NOC/SOC lines. Few things are more annoying than a eight hour trouble shooting conference bridge, and one of the dozen NOC/SOCs on the bridge hits the Hold button." Now that you've said it it seems so obvious. But, honestly I'd never thought it until right now. Thanks! ------------------------------- It only takes one time on a hectic multi-party call to learn this one. It's painful and at the worst possible time, especially if they left the room and no one can be contacted to get it turned off. scott

1 0