March 2017 - Test - lists.nanog.org

Weekly Routing Table Report
by cscora＠apnic.net 03 Mar '17

03 Mar '17

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, MENOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 04 Mar, 2017 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 639225 Prefixes after maximum aggregation (per Origin AS): 248678 Deaggregation factor: 2.57 Unique aggregates announced (without unneeded subnets): 307752 Total ASes present in the Internet Routing Table: 56403 Prefixes per ASN: 11.33 Origin-only ASes present in the Internet Routing Table: 48853 Origin ASes announcing only one prefix: 21709 Transit ASes present in the Internet Routing Table: 7550 Transit-only ASes present in the Internet Routing Table: 207 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 42 Max AS path prepend of ASN ( 22394) 39 Prefixes from unregistered ASNs in the Routing Table: 68 Numnber of instances of unregistered ASNs: 69 Number of 32-bit ASNs allocated by the RIRs: 17548 Number of 32-bit ASNs visible in the Routing Table: 13633 Prefixes from 32-bit ASNs in the Routing Table: 55318 Number of bogon 32-bit ASNs visible in the Routing Table: 44 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 397 Number of addresses announced to Internet: 2836585604 Equivalent to 169 /8s, 18 /16s and 220 /24s Percentage of available address space announced: 76.6 Percentage of allocated address space announced: 76.6 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.5 Total number of prefixes smaller than registry allocations: 213156 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 174750 Total APNIC prefixes after maximum aggregation: 49968 APNIC Deaggregation factor: 3.50 Prefixes being announced from the APNIC address blocks: 174086 Unique aggregates announced from the APNIC address blocks: 71703 APNIC Region origin ASes present in the Internet Routing Table: 7887 APNIC Prefixes per ASN: 22.07 APNIC Region origin ASes announcing only one prefix: 2205 APNIC Region transit ASes present in the Internet Routing Table: 1123 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 41 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2726 Number of APNIC addresses announced to Internet: 760850308 Equivalent to 45 /8s, 89 /16s and 167 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 194786 Total ARIN prefixes after maximum aggregation: 93195 ARIN Deaggregation factor: 2.09 Prefixes being announced from the ARIN address blocks: 197227 Unique aggregates announced from the ARIN address blocks: 90282 ARIN Region origin ASes present in the Internet Routing Table: 17817 ARIN Prefixes per ASN: 11.07 ARIN Region origin ASes announcing only one prefix: 6647 ARIN Region transit ASes present in the Internet Routing Table: 1771 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 42 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1813 Number of ARIN addresses announced to Internet: 1106472928 Equivalent to 65 /8s, 243 /16s and 111 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 170475 Total RIPE prefixes after maximum aggregation: 84124 RIPE Deaggregation factor: 2.03 Prefixes being announced from the RIPE address blocks: 165696 Unique aggregates announced from the RIPE address blocks: 100287 RIPE Region origin ASes present in the Internet Routing Table: 23765 RIPE Prefixes per ASN: 6.97 RIPE Region origin ASes announcing only one prefix: 10985 RIPE Region transit ASes present in the Internet Routing Table: 3355 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 28 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5601 Number of RIPE addresses announced to Internet: 710371200 Equivalent to 42 /8s, 87 /16s and 103 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 82580 Total LACNIC prefixes after maximum aggregation: 17633 LACNIC Deaggregation factor: 4.68 Prefixes being announced from the LACNIC address blocks: 83764 Unique aggregates announced from the LACNIC address blocks: 38289 LACNIC Region origin ASes present in the Internet Routing Table: 5677 LACNIC Prefixes per ASN: 14.75 LACNIC Region origin ASes announcing only one prefix: 1546 LACNIC Region transit ASes present in the Internet Routing Table: 1028 Average LACNIC Region AS path length visible: 5.3 Max LACNIC Region AS path length visible: 36 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 3200 Number of LACNIC addresses announced to Internet: 171328672 Equivalent to 10 /8s, 54 /16s and 68 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 16532 Total AfriNIC prefixes after maximum aggregation: 3700 AfriNIC Deaggregation factor: 4.47 Prefixes being announced from the AfriNIC address blocks: 18055 Unique aggregates announced from the AfriNIC address blocks: 6840 AfriNIC Region origin ASes present in the Internet Routing Table: 1024 AfriNIC Prefixes per ASN: 17.63 AfriNIC Region origin ASes announcing only one prefix: 326 AfriNIC Region transit ASes present in the Internet Routing Table: 198 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 22 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 293 Number of AfriNIC addresses announced to Internet: 87054848 Equivalent to 5 /8s, 48 /16s and 90 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5556 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3735 391 256 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2985 905 72 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2743 11133 744 KIXS-AS-KR Korea Telecom, KR 9829 2722 1501 541 BSNL-NIB National Internet Backbone, IN 9808 2295 8698 33 CMNET-GD Guangdong Mobile Communication 4755 2067 421 219 TATACOMM-AS TATA Communications formerl 45899 1875 1307 103 VNPT-AS-VN VNPT Corp, VN 4808 1658 1786 448 CHINA169-BJ China Unicom Beijing Provin 24560 1562 580 254 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3660 2968 148 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3300 1333 83 SHAW - Shaw Communications Inc., CA 18566 2187 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2063 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 1976 2050 405 CHARTER-NET-HKY-NC - Charter Communicat 209 1727 5067 640 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 30036 1705 318 426 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 16509 1704 3321 559 AMAZON-02 - Amazon.com, Inc., US 6983 1683 852 227 ITCDELTA - Earthlink, Inc., US 701 1581 10599 653 UUNET - MCI Communications Services, In Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3334 171 18 ALJAWWALSTC-AS , SA 20940 3009 1124 2140 AKAMAI-ASN1 , US 9121 2644 1691 18 TTNET , TR 34984 1994 328 383 TELLCOM-AS , TR 13188 1654 99 58 TRIOLAN , UA 8551 1633 377 40 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12479 1498 1033 49 UNI2-AS , ES 12389 1274 1216 495 ROSTELECOM-AS , RU 9198 1270 352 22 KAZTELECOM-AS , KZ 6849 1268 355 22 UKRTELNET , UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3541 545 164 Telmex Colombia S.A., CO 26615 3018 2330 44 Tim Celular S.A., BR 8151 2500 3379 543 Uninet S.A. de C.V., MX 11830 1800 368 66 Instituto Costarricense de Electricidad 6503 1556 437 53 Axtel, S.A.B. de C.V., MX 7303 1552 999 251 Telecom Argentina S.A., AR 6147 1166 377 27 Telefonica del Peru S.A.A., PE 28573 1086 2285 180 CLARO S.A., BR 3816 1004 479 186 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11664 978 280 35 Techtel LMDS Comunicaciones Interactiva Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1299 399 42 LINKdotNET-AS, EG 36903 718 361 122 MT-MPLS, MA 37611 693 67 6 Afrihost, ZA 36992 600 1375 26 ETISALAT-MISR, EG 24835 491 722 14 RAYA-AS, EG 8452 417 1474 16 TE-AS TE-AS, EG 37492 393 316 74 ORANGE-TN, TN 29571 368 36 10 CITelecom-AS, CI 15399 334 35 7 WANANCHI-KE, KE 2018 272 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5556 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3735 391 256 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3660 2968 148 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3541 545 164 Telmex Colombia S.A., CO 39891 3334 171 18 ALJAWWALSTC-AS , SA 6327 3300 1333 83 SHAW - Shaw Communications Inc., CA 26615 3018 2330 44 Tim Celular S.A., BR 20940 3009 1124 2140 AKAMAI-ASN1 , US 17974 2985 905 72 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2743 11133 744 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3660 3512 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7545 3735 3479 TPG-INTERNET-AP TPG Telecom Limited, AU 10620 3541 3377 Telmex Colombia S.A., CO 39891 3334 3316 ALJAWWALSTC-AS , SA 6327 3300 3217 SHAW - Shaw Communications Inc., CA 26615 3018 2974 Tim Celular S.A., BR 17974 2985 2913 TELKOMNET-AS2-AP PT Telekomunikasi Indonesia, I 9121 2644 2626 TTNET , TR 9808 2295 2262 CMNET-GD Guangdong Mobile Communication Co.Ltd. 9829 2722 2181 BSNL-NIB National Internet Backbone, IN Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65602 UNALLOCATED 8.225.192.0/24 30372 SUNESYS2 - Sunesys, LLC, US 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65555 UNALLOCATED 37.142.172.0/24 21450 MIRS-AS , IL Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.157.128.0/17 393899 -Reserved AS-, ZZ 23.161.128.0/17 393899 -Reserved AS-, ZZ 27.100.7.0/24 56096 UNKNOWN 41.73.16.0/24 37004 Suburban-Broadband-AS, NG 41.73.17.0/24 37004 Suburban-Broadband-AS, NG 41.73.18.0/24 37004 Suburban-Broadband-AS, NG 41.73.19.0/24 37004 Suburban-Broadband-AS, NG 41.73.20.0/24 37004 Suburban-Broadband-AS, NG 41.73.21.0/24 37004 Suburban-Broadband-AS, NG 41.73.22.0/24 37004 Suburban-Broadband-AS, NG Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:103 /12:278 /13:537 /14:1046 /15:1794 /16:13200 /17:7788 /18:13239 /19:24772 /20:38244 /21:41013 /22:74772 /23:63160 /24:357847 /25:554 /26:415 /27:293 /28:34 /29:18 /30:26 /31:1 /32:26 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3096 3300 SHAW - Shaw Communications Inc., CA 39891 2896 3334 ALJAWWALSTC-AS , SA 22773 2839 3660 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 26615 2534 3018 Tim Celular S.A., BR 18566 2080 2187 MEGAPATH5-US - MegaPath Corporation, US 9121 1856 2644 TTNET , TR 30036 1516 1705 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 10620 1457 3541 Telmex Colombia S.A., CO 13188 1378 1654 TRIOLAN , UA 6389 1372 2063 BELLSOUTH-NET-BLK - BellSouth.net Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1609 2:837 4:25 5:2454 6:34 8:1051 12:1812 13:85 14:1779 15:22 16:2 17:109 18:129 19:1 20:53 23:2375 24:1857 25:2 27:2373 31:1856 32:89 33:5 34:1 35:3 36:375 37:2560 38:1345 39:44 40:99 41:2811 42:463 43:1895 44:62 45:2389 46:2626 47:112 49:1224 50:965 51:18 52:746 54:356 55:5 56:4 57:41 58:1622 59:990 60:387 61:1935 62:1510 63:1921 64:4568 65:2182 66:4479 67:2263 68:1191 69:3339 70:1303 71:574 72:2141 74:2622 75:396 76:413 77:1429 78:1668 79:1311 80:1358 81:1403 82:964 83:727 84:861 85:1737 86:483 87:1137 88:804 89:2055 90:205 91:6130 92:994 93:2367 94:2369 95:2824 96:565 97:358 98:938 99:83 100:153 101:1243 103:13830 104:2776 105:165 106:484 107:1545 108:829 109:2594 110:1290 111:1722 112:1158 113:1309 114:1042 115:1733 116:1753 117:1660 118:2073 119:1604 120:946 121:1095 122:2335 123:2113 124:1538 125:1820 128:707 129:620 130:409 131:1383 132:522 133:190 134:528 135:215 136:512 137:420 138:1858 139:500 140:372 141:524 142:790 143:906 144:764 145:168 146:1036 147:710 148:1380 149:569 150:695 151:945 152:729 153:302 154:760 155:970 156:552 157:616 158:454 159:1424 160:564 161:737 162:2478 163:535 164:787 165:1156 166:385 167:1225 168:2577 169:749 170:2899 171:281 172:1012 173:1838 174:801 175:725 176:1775 177:4256 178:2476 179:1603 180:2184 181:2018 182:2218 183:1055 184:833 185:8884 186:3181 187:2664 188:2421 189:1814 190:8102 191:1885 192:9287 193:5768 194:4650 195:3836 196:1955 197:1283 198:5566 199:5838 200:7396 201:4096 202:10206 203:9813 204:4460 205:2773 206:2998 207:3130 208:3975 209:3971 210:3945 211:2116 212:2811 213:2477 214:864 215:65 216:5878 217:2008 218:839 219:615 220:1693 221:893 222:723 223:1152 End of report

1 0

Qwest/CenturyLink BGP contact?
by Bryan Holloway 03 Mar '17

03 Mar '17

Hello all, If someone from Qwest/Centurylink is lurking, could you contact me off-list? You are advertising a /24 out of a recently acquired /16, and I've been unsuccessful reaching anyone. Thanks! - bryan

1 1

Fwd: Serious Cloudflare bug exposed a potpourri of secret customer data
by Rich Kulawiec 02 Mar '17

02 Mar '17

(h/t to Richard Forno) After you're done reading the Ars Technica article excerpted and linked below, you may also want to read: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory https://news.ycombinator.com/item?id=13718752 and, as background: CloudFlare, We Have A Problem http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-have-a-problem/ and then perhaps consider this comment from the Ycombinator thread: Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? ---rsk ----- Forwarded message from Richard Forno <rforno(a)infowarrior.org> ----- > From: Richard Forno <rforno(a)infowarrior.org> > Date: Fri, 24 Feb 2017 07:30:21 -0500 > To: Infowarrior List <infowarrior(a)attrition.org> > Subject: [Infowarrior] - Serious Cloudflare bug exposed a potpourri of > secret customer data > > Serious Cloudflare bug exposed a potpourri of secret customer data > > Service used by 5.5 million websites may have leaked passwords and authentication tokens. > > Dan Goodin - 2/23/2017, 8:35 PM > > Cloudflare, a service that helps optimize the security and performance of > more than 5.5 million websites, warned customers today that a recently > fixed software bug exposed a range of sensitive information that could > have included passwords, and cookies and tokens used to authenticate > users. > > A combination of factors made the bug particularly severe. First, the > leakage may have been active since September 22, nearly five months > before it was discovered, although the greatest period of impact was > from February 13 and February 18. Second, some of the highly sensitive > data that was leaked was cached by Google and other search engines. The > result was that for the entire time the bug was active, hackers had > the ability to access the data in real-time, by making Web requests > to affected websites, and to access some of the leaked data later by > crafting queries on search engines. > > "The bug was serious because the leaked memory could contain private > information and because it had been cached by search engines," Cloudflare > CTO John Graham-Cumming wrote in a blog post published Thursday. "We > are disclosing this problem now as we are satisfied that search engine > caches have now been cleared of sensitive information. We have also > not discovered any evidence of malicious exploits of the bug or other > reports of its existence." > > The leakage was the result of a bug in an HTML parser chain Cloudflare > uses to modify Web pages as they pass through the service's edge > servers. The parser performs a variety of tasks, such as inserting Google > Analytics tags, converting HTTP links to the more secure HTTPS variety, > obfuscating email addresses, and excluding parts of a page from malicious > Web bots. When the parser was used in combination with three Cloudflare > features???e-mail obfuscation, server-side Cusexcludes, and Automatic > HTTPS Rewrites???it caused Cloudflare edge servers to leak pseudo random > memory contents into certain HTTP responses. > < - > > > https://arstechnica.com/security/2017/02/serious-cloudflare-bug-exposed-a-p… >

4 3

SHA1 collisions proven possisble
by Grant Ridder 02 Mar '17

02 Mar '17

Coworker passed this on to me. Looks like SHA1 hash collisions are now achievable in a reasonable time period https://shattered.io/ -Grant

25 51

Re: Consumer networking head scratcher
by Oliver O'Boyle 02 Mar '17

02 Mar '17

Next --> On March 1, 2017, at 9:31 PM, Ryan Pugatch <rpug(a)lp0.org> wrote: On Wed, Mar 1, 2017, at 09:29 PM, Oliver O'Boyle wrote: Each device associated with the AP consumes memory. Small low-end routers don't typically come with much memory. If you've got a lot of devices associated with the AP you will run out of memory. I'm not sure how many devices you're connecting, though. Three will not cause this problem. 30 might. O. Currently, I have 3 devices connected. :)

5 4

Call for Presentations - CHI-NOG 07 (May 18th)
by Tom Kacprzynski 02 Mar '17

02 Mar '17

CHI-NOG 07 – (Chicago Network Operators Group) May 18th 2017, Chicago, IL The Chicago Network Operators Group (CHI-NOG) is a vendor neutral organization. Our goal is to create a regional community of network professionals by presenting the latest technology trends, enabling collaboration and providing networking opportunities. CHI-NOG will be hosting its seventh annual conference on May 18th, 2017 in downtown Chicago. For more information on the conference please see event’s page (http://chinog.org/meetings/chi-nog-07/) The CHI-NOG Program Committee is seeking proposals for presentations on relevant networking technologies with a focus on the following topics: * Network Automation/ DevOps * Interconnection/Peering * Low Latency Networks/Financial Networks * Network Security * Academic Research in Networking and Related Infrastructure Fields. * Internet Monitoring * Advanced BGP/MPLS Technologies * Optical Networking/Data Center Interconnect * Content Delivery Networks (CDNs) * Software Defined Networking * Cloud Networking Technologies * Network Traffic Engineering * Open Source Networking Tools * Data Center Fabric * Wireless * IPv6 Session Format Each presentation is 30 minutes, which includes a question and answer time. The duration can be extended per individual request to 60 minutes and will be considered by the program committee. Presentations should not contain any marketing material and should avoid discussion of commercial products but rather focus on the underlying technology. Key Dates 3/24/2017 - Presentation Abstract Submission Deadline 3/31/2017 - Abstract Selection 4/15/2017 - Full Presentation Slides Submission Deadline 5/18/2017 - Conference Submission Please submit presentation’s abstract proposal by filling out the submission form at http://chinog.org/meetings/chi-nog-07/abstract-submission/ . Once your presentation is selected please provide the program committee with your photo and a short bio for web publication. All accepted speakers will receive complimentary tickets to the conference. For past presentation please see the archives at http://chinog.org/presentation-archive/. The program committee is looking forward to your submission and attendance.

1 0

Re: Consumer networking head scratcher
by Ryan Pugatch 02 Mar '17

02 Mar '17

On Thu, Mar 2, 2017, at 10:32 AM, Dann Schuler wrote: > Just a quick sanity check here since I know we can occasionally overlook > the simple things. You have updated the firmware to the latest available > version correct? Have you checked for any odd services like QoS, > parental controls or an IDS? Have you tried wiping it to factory default > and reconfiguring it? > > What happens if you give the affected machine a new IP? Could it be some > service on the device affecting that specific IP? > Yes, I've done all of these. It was running the latest version of code and I even tried rolling back. Disabled SPI firewalls, ipv6, verified QoS and parental controls are off, etc. The issue impacts multiple device so doesn't appear specific to one IP. Thanks

1 0

Consumer networking head scratcher
by Ryan Pugatch 02 Mar '17

02 Mar '17

Hi everyone, I've got a real head scratcher that I have come across after replacing the router on my home network. I thought I'd share because it is a fascinating issue to me. At random times, my Windows machines (Win 7 and Win 10, attached to the network via WiFi, 5GHz) lose connectivity to the Internet. They can continue to access internal resources, such as the router's admin interface. Other devices including Macs, iPhones, Android phones, and Rokus never have this issue. I realized that on the Windows machines, when the connection drops, if I run a traceroute, it dies at a certain hop every time (out in Comcast's network, who is my ISP) even though a Mac sitting right next to it is able to go all the way through to the destination. The even stranger thing I discovered last night is that if I trace to the hop before the hop that it dies at, it then dies at the hop before that (and as I trace to closer and closer hops, it dies the hop before that!) This is illustrated in the traces I've captured here: http://pastebin.com/raw/R1UHLi0U For what it's worth, the router is a Linksys EA7300 that I just picked up. I can't even imagine what would cause this issue at this point. If anyone has any thoughts, I'd love to hear them! I'm going to start studying some packet captures to see if I can spot an issue. Best, Ryan

9 13

Re: Consumer networking head scratcher
by Ryan Pugatch 01 Mar '17

01 Mar '17

On Wed, Mar 1, 2017, at 06:35 PM, Jean-Francois Mezei wrote: > On 2017-03-01 11:28, Ryan Pugatch wrote: > > > At random times, my Windows machines (Win 7 and Win 10, attached to the > > network via WiFi, 5GHz) lose connectivity to the Internet. > > > For what it's worth, the router is a Linksys EA7300 that I just picked > > up. > > > Way back when, I have a netgear router. It ended having a limit on its > NAT translation table, and when I had too many connections going at same > time (or not yet timed out), I would lose connection. There was an > unofficial patch to the firmware (litterally a patch in code that > defined table size) to increase that table to 1000- as I recall. > > Does the Linksys have a means to display the NAT translation table and > see if maybe connections are lost when that table is full and lots of > connections have not yet timed out ? > It doesn't seem to provide visibility into the NAT tables. However, I'm starting to think you might be on to something. The issue actually happened to my Mac tonight, and sure enough the traceroute dies at the same time. So, it isn't just the Windows machines impacted. I did a packet capture on my end, and on a server somewhere that I control and sent pings from my laptop to the server. The server received my ICMP packets and responded, but those responses never made it back to my laptop. Meanwhile, my Roku is actively streaming from the Internet, so it's not like the Internet was down.

2 2

Re: Consumer networking head scratcher
by Ryan Pugatch 01 Mar '17

01 Mar '17

On Wed, Mar 1, 2017, at 03:58 PM, iamzam(a)gmail.com wrote: > On many non-windows OS (Mac OSX, Linux, FreeBSD etc.) you can specify > ICMP > traceroute using -I: > > traceroute -I google.com > > I wonder if this would replicate your experience with Windows tracert Definitely on my list to test. Thanks.

1 0