August 2017 - Test - lists.nanog.org

ATT Support
by Dennis Burgess 07 Aug '17

07 Aug '17

I am looking to talk to ATT MIS support, someone that can actually look at stuff. :( Please e-mail me off-list. Going in circles with their normal support .... Dennis Burgess - Network Solution Engineer - Consultant MikroTik Certified Trainer/Consultant<http://www.linktechs.net/productcart/pc/viewcontent.asp?idpage=5> - MTCNA, MTCRE, MTCWE, MTCTCE, MTCINE For Wireless Hardware/Routers visit www.linktechs.net<http://www.linktechs.net/> Radio Frequency Coverages: www.towercoverage.com<http://www.towercoverage.com/> Office: 314-735-0270 E-Mail: dmburgess(a)linktechs.net<mailto:dmburgess@linktechs.net>

1 0

Transparent Waves
by Rod Beck 05 Aug '17

05 Aug '17

Can someone refer me to the ITU SPEC on transparent 10 gig wave service. I have a client is looking to lease two 10 gig waves but they do not want an Ethernet format. Just transparent. I want to make sure the carrier gets it right when they configure the service. Regards, Roderick. Roderick Beck Director of Global Sales United Cable Company DRG Undersea Consulting Affiliate Member www.unitedcablecompany.com<http://www.unitedcablecompany.com> 85 Király utca, 1077 Budapest rod.beck(a)unitedcablecompany.com 36-30-859-5144 [1467221477350_image005.png]

3 2

Bell outage
by Krunal Shah 04 Aug '17

04 Aug '17

Does anyone know what is happening with Bell network at East Canada? http://canadianoutages.com/status/bell/map/ Krunal ________________________________ This electronic message contains information from Primus Management ULC ("PRIMUS") , which may be legally privileged and confidential. The information is intended to be for the use of the individual(s) or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by telephone or e-mail (to the number or address above) immediately. Any views, opinions or advice expressed in this electronic message are not necessarily the views, opinions or advice of PRIMUS. It is the responsibility of the recipient to ensure that any attachments are virus free and PRIMUS bears no responsibility for any loss or damage arising in any way from the use thereof.The term "PRIMUS" includes its affiliates. ________________________________ Pour la version en français de ce message, veuillez voir http://www.primustel.ca/fr/legal/cs.htm

13 15

Weekly Routing Table Report
by cscora＠apnic.net 04 Aug '17

04 Aug '17

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG MENOG, CaribNOG, BJNOG, SDNOG, CMNOG, IRNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 05 Aug, 2017 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 656011 Prefixes after maximum aggregation (per Origin AS): 255861 Deaggregation factor: 2.56 Unique aggregates announced (without unneeded subnets): 317134 Total ASes present in the Internet Routing Table: 57975 Prefixes per ASN: 11.32 Origin-only ASes present in the Internet Routing Table: 50148 Origin ASes announcing only one prefix: 22171 Transit ASes present in the Internet Routing Table: 7827 Transit-only ASes present in the Internet Routing Table: 216 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 56 Max AS path prepend of ASN ( 55644) 51 Prefixes from unregistered ASNs in the Routing Table: 116 Numnber of instances of unregistered ASNs: 120 Number of 32-bit ASNs allocated by the RIRs: 19624 Number of 32-bit ASNs visible in the Routing Table: 15352 Prefixes from 32-bit ASNs in the Routing Table: 62584 Number of bogon 32-bit ASNs visible in the Routing Table: 70 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 364 Number of addresses announced to Internet: 2851265636 Equivalent to 169 /8s, 242 /16s and 220 /24s Percentage of available address space announced: 77.0 Percentage of allocated address space announced: 77.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.7 Total number of prefixes smaller than registry allocations: 218313 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 178729 Total APNIC prefixes after maximum aggregation: 51643 APNIC Deaggregation factor: 3.46 Prefixes being announced from the APNIC address blocks: 177767 Unique aggregates announced from the APNIC address blocks: 73944 APNIC Region origin ASes present in the Internet Routing Table: 8257 APNIC Prefixes per ASN: 21.53 APNIC Region origin ASes announcing only one prefix: 2297 APNIC Region transit ASes present in the Internet Routing Table: 1174 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 56 Number of APNIC region 32-bit ASNs visible in the Routing Table: 3108 Number of APNIC addresses announced to Internet: 763858788 Equivalent to 45 /8s, 135 /16s and 143 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 200256 Total ARIN prefixes after maximum aggregation: 95322 ARIN Deaggregation factor: 2.10 Prefixes being announced from the ARIN address blocks: 202116 Unique aggregates announced from the ARIN address blocks: 93094 ARIN Region origin ASes present in the Internet Routing Table: 17944 ARIN Prefixes per ASN: 11.26 ARIN Region origin ASes announcing only one prefix: 6657 ARIN Region transit ASes present in the Internet Routing Table: 1776 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2124 Number of ARIN addresses announced to Internet: 1110239392 Equivalent to 66 /8s, 44 /16s and 232 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 175789 Total RIPE prefixes after maximum aggregation: 86316 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 171639 Unique aggregates announced from the RIPE address blocks: 103612 RIPE Region origin ASes present in the Internet Routing Table: 24244 RIPE Prefixes per ASN: 7.08 RIPE Region origin ASes announcing only one prefix: 11144 RIPE Region transit ASes present in the Internet Routing Table: 3428 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 32 Number of RIPE region 32-bit ASNs visible in the Routing Table: 6052 Number of RIPE addresses announced to Internet: 713016704 Equivalent to 42 /8s, 127 /16s and 197 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 83955 Total LACNIC prefixes after maximum aggregation: 18720 LACNIC Deaggregation factor: 4.48 Prefixes being announced from the LACNIC address blocks: 85179 Unique aggregates announced from the LACNIC address blocks: 39225 LACNIC Region origin ASes present in the Internet Routing Table: 6216 LACNIC Prefixes per ASN: 13.70 LACNIC Region origin ASes announcing only one prefix: 1738 LACNIC Region transit ASes present in the Internet Routing Table: 1147 Average LACNIC Region AS path length visible: 5.4 Max LACNIC Region AS path length visible: 37 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 3733 Number of LACNIC addresses announced to Internet: 170914016 Equivalent to 10 /8s, 47 /16s and 240 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 17164 Total AfriNIC prefixes after maximum aggregation: 3799 AfriNIC Deaggregation factor: 4.52 Prefixes being announced from the AfriNIC address blocks: 18946 Unique aggregates announced from the AfriNIC address blocks: 6951 AfriNIC Region origin ASes present in the Internet Routing Table: 1064 AfriNIC Prefixes per ASN: 17.81 AfriNIC Region origin ASes announcing only one prefix: 334 AfriNIC Region transit ASes present in the Internet Routing Table: 207 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 335 Number of AfriNIC addresses announced to Internet: 92816128 Equivalent to 5 /8s, 136 /16s and 67 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5459 4192 87 ERX-CERNET-BKB China Education and Rese 7545 4003 407 389 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2967 902 73 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2799 11124 745 KIXS-AS-KR Korea Telecom, KR 9829 2754 1498 549 BSNL-NIB National Internet Backbone, IN 9808 2353 8699 32 CMNET-GD Guangdong Mobile Communication 45899 2282 1449 106 VNPT-AS-VN VNPT Corp, VN 4755 2096 423 221 TATACOMM-AS TATA Communications formerl 7552 1663 1104 73 VIETEL-AS-AP Viettel Corporation, VN 9498 1614 361 144 BBIL-AP BHARTI Airtel Ltd., IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3828 2953 159 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3450 1341 88 SHAW - Shaw Communications Inc., CA 18566 2209 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2043 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 2020 2201 441 CHARTER-NET-HKY-NC - Charter Communicat 209 1858 5065 636 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 16509 1843 3861 590 AMAZON-02 - Amazon.com, Inc., US 30036 1819 328 290 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 6983 1697 854 231 ITCDELTA - Earthlink, Inc., US 701 1560 10559 629 UUNET - MCI Communications Services, In Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3387 186 23 ALJAWWALSTC-AS, SA 20940 2960 969 2131 AKAMAI-ASN1, US 8551 2558 377 40 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 34984 2052 332 425 TELLCOM-AS, TR 9121 1924 1691 17 TTNET, TR 12479 1642 1048 59 UNI2-AS, ES 13188 1602 100 55 TRIOLAN, UA 12389 1523 1422 640 ROSTELECOM-AS, RU 6849 1225 355 21 UKRTELNET, UA 8402 1100 544 15 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3549 543 203 Telmex Colombia S.A., CO 8151 2657 3402 578 Uninet S.A. de C.V., MX 11830 2103 370 65 Instituto Costarricense de Electricidad 6503 1557 437 53 Axtel, S.A.B. de C.V., MX 7303 1556 1015 244 Telecom Argentina S.A., AR 6147 1236 377 27 Telefonica del Peru S.A.A., PE 3816 1024 501 93 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 28573 955 2277 194 CLARO S.A., BR 11172 916 126 86 Alestra, S. de R.L. de C.V., MX 18881 898 1052 23 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1216 398 48 LINKdotNET-AS, EG 37611 745 91 8 Afrihost, ZA 36903 711 357 130 MT-MPLS, MA 36992 654 1377 27 ETISALAT-MISR, EG 24835 501 850 15 RAYA-AS, EG 29571 421 36 10 CITelecom-AS, CI 37492 406 320 75 ORANGE-, TN 15399 357 35 7 WANANCHI-, KE 8452 318 1730 17 TE-AS TE-AS, EG 2018 303 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5459 4192 87 ERX-CERNET-BKB China Education and Rese 7545 4003 407 389 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3828 2953 159 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3549 543 203 Telmex Colombia S.A., CO 6327 3450 1341 88 SHAW - Shaw Communications Inc., CA 39891 3387 186 23 ALJAWWALSTC-AS, SA 17974 2967 902 73 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2960 969 2131 AKAMAI-ASN1, US 4766 2799 11124 745 KIXS-AS-KR Korea Telecom, KR 9829 2754 1498 549 BSNL-NIB National Internet Backbone, IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3828 3669 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7545 4003 3614 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3387 3364 ALJAWWALSTC-AS, SA 6327 3450 3362 SHAW - Shaw Communications Inc., CA 10620 3549 3346 Telmex Colombia S.A., CO 17974 2967 2894 TELKOMNET-AS2-AP PT Telekomunikasi Indonesia, I 8551 2558 2518 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 9808 2353 2321 CMNET-GD Guangdong Mobile Communication Co.Ltd. 9829 2754 2205 BSNL-NIB National Internet Backbone, IN 45899 2282 2176 VNPT-AS-VN VNPT Corp, VN Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65602 UNALLOCATED 8.225.192.0/24 30372 SUNESYS2 - Sunesys, LLC, US 65532 PRIVATE 14.192.19.0/24 132717 NDCTPL-IN NxtGen Datacenter & 64525 PRIVATE 45.119.143.0/24 133275 GIGANTIC-AS Gigantic Infotel P 64525 PRIVATE 45.125.62.0/24 133275 GIGANTIC-AS Gigantic Infotel P 65530 PRIVATE 45.249.40.0/24 133720 SOFTCALLCOC-AS SOFT CALL CUST- 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 65534 PRIVATE 58.68.109.0/24 10201 DWL-AS-IN Dishnet Wireless Lim 4294901876 PRIVATE 59.101.19.0/24 2764 AAPT AAPT Limited, AU 4294902000 PRIVATE 59.101.45.0/24 2764 AAPT AAPT Limited, AU 4294901905 PRIVATE 59.101.49.0/24 2764 AAPT AAPT Limited, AU Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.192.48.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.49.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.50.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.51.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 27.100.7.0/24 56096 UNKNOWN 41.76.232.0/21 62878 XLITT - Xlitt, US 41.77.248.0/21 62878 XLITT - Xlitt, US 41.78.12.0/23 62878 XLITT - Xlitt, US 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.79.12.0/22 37306 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:15 /9:13 /10:36 /11:105 /12:284 /13:553 /14:1050 /15:1852 /16:13458 /17:7646 /18:13427 /19:24665 /20:38988 /21:41551 /22:78192 /23:64918 /24:366995 /25:878 /26:631 /27:644 /28:37 /29:25 /30:18 /31:2 /32:28 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3246 3450 SHAW - Shaw Communications Inc., CA 22773 2996 3828 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 39891 2946 3387 ALJAWWALSTC-AS, SA 18566 2093 2209 MEGAPATH5-US - MegaPath Corporation, US 8551 2023 2558 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 30036 1603 1819 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 11830 1493 2103 Instituto Costarricense de Electricidad y Telec 10620 1489 3549 Telmex Colombia S.A., CO 11492 1395 1560 CABLEONE - CABLE ONE, INC., US 6389 1355 2043 BELLSOUTH-NET-BLK - BellSouth.net Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1582 2:810 4:18 5:2436 6:34 7:1 8:1054 12:1837 13:146 14:1715 15:27 16:2 17:161 18:90 20:61 23:2457 24:1911 25:2 27:2354 29:1 31:1913 32:84 33:18 35:21 36:386 37:2363 38:1329 39:65 40:97 41:2970 42:460 43:1963 44:77 45:2995 46:2821 47:157 49:1231 50:992 51:19 52:824 54:362 55:6 56:4 57:44 58:1557 59:1015 60:324 61:1932 62:1696 63:1912 64:4642 65:2219 66:4572 67:2286 68:1229 69:3360 70:1135 71:586 72:2211 74:2705 75:390 76:427 77:1517 78:1422 79:1952 80:1414 81:1386 82:997 83:720 84:958 85:1786 86:460 87:1184 88:751 89:2136 90:165 91:6202 92:991 93:2372 94:2406 95:2660 96:638 97:353 98:1049 99:93 100:153 101:1216 103:15519 104:3009 105:187 106:556 107:1784 108:824 109:2894 110:1471 111:1734 112:1234 113:1249 114:1042 115:1547 116:1633 117:1737 118:2151 119:1644 120:721 121:1081 122:2326 123:1822 124:1484 125:1802 128:854 129:649 130:436 131:1432 132:555 133:200 134:674 135:226 136:427 137:456 138:1916 139:499 140:399 141:604 142:774 143:867 144:813 145:183 146:1096 147:696 148:1488 149:588 150:707 151:973 152:704 153:300 154:856 155:753 156:641 157:657 158:471 159:1531 160:707 161:747 162:2518 163:534 164:928 165:1383 166:381 167:1254 168:2986 169:836 170:3467 171:332 172:1035 173:1989 174:813 175:746 176:1900 177:3982 178:2552 179:1146 180:2211 181:1904 182:2373 183:776 184:873 185:10328 186:3261 187:2216 188:2621 189:1789 190:8355 191:1334 192:9527 193:5793 194:4677 195:3909 196:2103 197:1336 198:5527 199:5904 200:7541 201:4304 202:10340 203:9974 204:4492 205:2830 206:3054 207:3145 208:3958 209:3984 210:3943 211:2097 212:2876 213:2503 214:857 215:66 216:5883 217:2124 218:889 219:597 220:1702 221:893 222:744 223:1191 End of report

1 0

Multicom Hijacks: Do you peer with these turkeys (AS35916)?
by Ronald F. Guilmette 04 Aug '17

04 Aug '17

Well, it took less than a day for my last missive here to get the hijacks associated with AS202746 (Nexus Webhosting) taken down. I guess that somebody must have smacked Telia upside the head with a clue-by-four at long last. So, with that out of the way, let's see what else I can accomplish this week. As I understand it, the theory is that the thing that keeps the entire Internet from descending into the final stages of a totally broken "tragedy of the commons" is peer pressure. As everyone knows, there is no "Internet Police", so the whole system relies on the ability and willingness of networks to de-peer from other networks when those other networks are demonstratably behaving badly. Let's find out if that actually works, in practice, shall we? According to bgp.he.net, the top three peers of AS35916 (Multacom) are as follows: AS2914 NTT America, Inc. AS3223 Voxility S.R.L. AS209 Qwest Communications Company, LLC I'd like help from any and all subscribers to this mailing list who might have contacts in these companies. I'd like you to call their attention to Multacom's routing of the following block specifically: 163.198.0.0/16 This is a long-abandoned Afrinic block belonging to a semi-defunct company called "Agrihold". In fact, this block was a part of the massive number of hijacked legacy Afrinic /16 blocks that I pointed out, right here on this maling list, way back last November: https://mailman.nanog.org/pipermail/nanog/2016-November/089164.html After that posting, whoever was responsible for all those blatant hijackings got cold feet, apparently, and stopped passing all of those bogus route announcements out through their pals at AS260, Xconnect24 Inc. And so, for a brief time at least, the wanton pillaging of legacy Afrinic /16 blocks, and the reselling of those stolen blocks to various snowshoe spammers stopped... for awhile. But it appears that on or about January 6th of this year, Mulutacom lept into the breach and re-hijacked both the 163.198.0.0/16 block and also the additional Afrinic legacy block, 160.115.0.0/16. (They apparently stopped routing this latter block some time ago, for reasons unknown. But that fact that Multacom was indeed routing this second purloined legacy Afrinic /16 block also is in the historical records now, and cannot be denied. Multicom's routing of both blocks began around January 6th or so of this year, 2017.) Just as a courtesy, I sent the block absconders at Multacom a short email, earlier today, asking them if they had an LOA which demonstrates that they have rights/permission to be routing the 163.198.0.0/16 block. Of course, the mystery person (noc@) who emailed me back claimed that they did, but unfortunately, he was not under oath at the time. I asked if he could show me a copy of this purported LOA, and I haven't heard back from anybody at Mulatcom ever since. I don't really think there is any big mystery here, nor do I think that Multacom has or had, at any time, any rights to be routing these two legacy Afrinic /16 blocks. But they have done so, and continue to do so, in the case of the 163.198.0.0/16 block at least, quite obviously because -somebody- is paying them to do it, even in the total absence of a legitimate LOA. And as it turns out, it is quite easy to figure out who Multacom has been routing these two hijacked legacy Afrinic /16 blocks both for and to. It's trivially easy to run a traceroute to any arbitrary IP address within the 163.198.0.0/16 block. No matter which one you pick, the traceroute always passes through a particular IP address, 178.250.191.162, before the remainder of the traceroute gets deliberately blocked. That IP address is registered *not* to some long lost African concern, but rather to a Romanian networking company called Architecture Iq Data S.R.L. That company itself is apparently owned by a fellow by the name of Alexandru ("Andrei") Stanciu who hails from the city of Suceava, Romania. (Note that this is apparently *not* the same Alexandru Stanciu who the FBI arrested on bank and wire fraud charges in 2014. That one apparently hailed from Bucharest.) Anyway, "networking" seems to be only one of our Mr. Stanciu's many and varied business interest. His networking company, Architecture Iq Data S.R.L. has a web site (http://architekiq.ro/) but it is "shallow" to say the least. Many, and perhaps evenmost of the links on the home page of that company's web site seem to lead nowhere. In cotrast, Mr. Stanciu has the following other well-developed web sites and companies: ads.com.ro promoart.ro largeformatprinting.ro Promoart S.R.L. Advertising Distribution Supplies S.R.L. Mostly, he seems to be in the advertising business, as evidenced by the above web sites, and also by his membership in the "Email Marketing Gurus" special interest group over on LinkedIn: https://ro.linkedin.com/in/alexandru-stanciu-8846aa12a Given Mr. Stanciu's apparent professonal interests, it is not really all that surprising that the two hijacked legacy Afrinic /16 blocks that Multacom has been kind enough to route... both for him and to him... do in fact seem to be associated with numerous domain names that obviously consist of just two random dictionary words smashed together, followed by either .com or .net. This exact motif is quite commonly used by and among many of the Internet's most prolific snowshoe spammers. And of course, Mr. Stanciu's snowshoe spamming domains would not be maximally productive unless they each had SPF TXT records attached... ones that would pass muster with the recipients of Mr. Stanciu's spams. Those SPF TXT records are listed here, along the relevant domain names: https://pastebin.com/raw/BbK2YGe6 (Whenever possible snowshoe spammers also like to be able to send out their spams from from IP addresses where they have already set up nicely mattching reverse DNS, because a lot of recipient mail servers these days just won't accept inbound email anymore from no-reverse-dns IP addreses. But unfortunately for Mr. Stanciu, and for Multacom, the fact that they both just sort of walked off with the 163.198.0.0/16 block means that although they can -route- that space, they can't get the authority to control the reverse DNS for this block delegated to them. In order to do that, they'd have to get permission to do reverse DNS for the block FROM THE REAL AND LEGITIMATE BLOCK OWNER. And since that ain't them, nor even anybody who even knows what these clever fellows are up to, they can't. So Mr. Stanciu is stuck sending out his spams in a sub-optimal way, without either matching reverse DNS or even *any* reverse DNS for the entire /16 block he's stolen. Sorry Mr. Stanciu! Sorry Multacom!) As anybody who understand this stuff will by now be utterly convinced, the legacy Afrinic address block, 163.198.0.0/16, has been hijacked, stolen, or whatever you prefer to call it, by Mr. Alexandru ("Andrei") Stanciu of Suceava, Romania, specifically for "snowshode" spamming purposes, and with the significant help and assistance of AS35916, aka Multacom Corporation of 16654 Soledad Canyon Rd #150, Canyon Country, Calfornia, 91387, which is actually the entity announcing the routes to this clearly illicitly "liberated" IP block. So now, would one or more of you kind folks on this list who are more fortunate than me, and who have connections please be so kind as to let the following entities know about what Multacom is acctually up to here? AS2914 NTT America, Inc. AS3223 Voxility S.R.L. AS209 Qwest Communications Company, LLC Maybe they won't care, but they should. Maybe we can find out if the notion of peer pressure... or perhaps even de-peer pressure... works as well in practice as it allegedly does in theory. Thanks for listening. Regards, rfg

6 6

Contact at Orange?
by Anne P. Mitchell Esq. 03 Aug '17

03 Aug '17

Does anybody here have a contact at Orange? Asking for a colleague. Thank you! Anne Anne P. Mitchell, Attorney at Law Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law) Legislative Consultant CEO/President, Institute for Social Internet Public Policy Member, Cal. Bar Cyberspace Law Committee Member, Colorado Cyber Committee Member, Elevations Credit Union Member Council Member, Board of Directors, Asilomar Microcomputer Workshop Member, Board of Directors, Greenwood Wildlife Rehabilitation Ret. Professor of Law, Lincoln Law School of San Jose Ret. Chair, Asilomar Microcomputer Workshop

5 4

vFlow v0.4.1 :: IPFIX, sFlow and Netflow collector (open source)
by Mehrdad Arshad Rad 02 Aug '17

02 Aug '17

Hi All, Sorry for spamming, I just wanted to update you for vFlow v0.4.1 (High-performance, scalable and reliable IPFIX, sFlow and Netflow collector.) Now you can install it very easily through RPM or Debian package also the MS Windows binary is available (or you can compile it through a command) It's written with pure Golang and it works in production under heavy load! New features: Netflow v9 protocol, support NATS (message bus, nats.io), MS Windows support! You can download it at https://github.com/VerizonDigital/vflow/releases/tag/v0.4.1 All features: - IPFIX RFC7011 collector - sFLow v5 raw header packet collector - Netflow v9 collector - Decoding sFlow raw header L2/L3/L4 - Produce to Apache Kafka, NSQ, NATS - Replicate IPFIX to 3rd party collector - Supports IPv4 and IPv6 There are two quick start docs : - vFlow with NSQ: https://github.com/VerizonDigital/vflow/blob/master/docs/quick_start_nsq.md - vFlow with Kafka: https://github.com/VerizonDigital/vflow/blob/master/docs/quick_start_kafka.… All docs: https://github.com/VerizonDigital/vflow/tree/master/docs Please let me know if you have any questions/suggestions or open an issue at GitHub. https://github.com/verizonDigital/vflow Thanks, Mehrdad -- *M*ehrdad Arshad Rad *P*rincipal Software Engineer https://www.linkedin.com/in/mehrdadrad

1 0

SAFNOG-3: Program Agenda
by Mark Tinka 02 Aug '17

02 Aug '17

Hello all. It gives me great pleasure to inform you that the SAFNOG-3 program agenda has taken shape, and is already 70% full. You can view the program agenda at the URL below: http://safnog.org/#section-agenda If you are interested in presenting a paper at this year's SAFNOG meeting, please send your submission to the SAFNOG-3 Program Committee as soon as possible, at the URL below: https://papers.safnog.org/user/login.php?event=62 We expect to have a 100%-filled program by this time next week. We look forward to seeing you in Durban. Cheers, Mark Tinka On Behalf of the SAFNOG Management Committee

1 0