November 2018 - Test - lists.nanog.org

L3 Network topology in YANG
by Yannis Mitsos 07 Dec '18

07 Dec '18

All, I was wondering if there is any network operator who exposes (dynamically?) its topology in YANG based on RFC8346 [1]. I understand that for commercial operators and purposes, may not be of any substantial value. We are assessing some available tools[2],[3],[4] on how to achieve this but we would like to know if there is any success story out there. Regards, Yannis [1] https://tools.ietf.org/html/rfc8346 [2] https://github.com/robshakir/pyangbind [3] https://github.com/YangModels/yang.git [4] https://developer.cisco.com/site/ydk

2 2

Security Track @ NANOG 75 Call for Participation
by John Kristoff 06 Dec '18

06 Dec '18

[ Apologies if you saw this elsewhere already - jtk ] Friends, colleagues, fellow operators, The network security track, formerly known as the ISP security BoF, has plans to return at NANOG 75 in San Francisco February 18-20. I will be your track facilitator. I have a small handful of topics I'm soliciting from some folks directly, but options are good, and I may be missing something important. If you haven't heard from me already, then I want to hear your ideas or proposals. This is a good, casual place to go with netsec related ideas, tools, or case studies. Here is an incomplete list of relevant topics to stir your thoughts: * IRRs, BGPSEC, and RPKI * DDoS attacks and mitigation * Botnet case studies * ISP incident response tools * Network censorship and privacy * Threat sharing frameworks * Network equipment configuration/default BCPs * Spoofing, amplification, reflection threats * ...insert your idea here John

2 1

Verizon: Extremely Strange CPE Routing in NYC/NJ Area
by Nick Zurku 04 Dec '18

04 Dec '18

Can anyone from Verizon take a look at this behavior for us? We’re having multiple Verizon FiOS users in the NYC/NJ area appear to teleport from their FiOS router to our IP in the Pittsburgh region. Users are seeing extreme slowness with TCP traffic, but ping times seem reasonable. User 1: 1 fios_quantum_gateway (192.168.1.1) 1.575 ms 2.426 ms 3.193 ms 2 204.16.244.8 (204.16.244.8) 2.269 ms 3.055 ms 2.727 ms User 2: 1 fios_quantum_gateway (192.168.1.1) 1.565 ms 1.048 ms 0.947 ms 2 204.16.244.8 (204.16.244.8) 2.162 ms 3.588 ms 3.048 ms I can provide end-user NYC/NJ IPs off-list if desirable. Here's a normal looking trace from an FiOS line locally in the Pittsburgh region: IP: 108.39.229.34 Tracing route to four.libsyn.com [204.16.244.8] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms 192.168.1.1 2 5 ms 2 ms 7 ms lo0-100.PITBPA-VFTTP-301.verizon-gni.net <http://lo0-100.pitbpa-vfttp-301.verizon-gni.net/> [108.39.229.1] 3 5 ms 6 ms 6 ms B3301.PITBPA-LCR-22.verizon-gni.net <http://b3301.pitbpa-lcr-22.verizon-gni.net/> [100.41.223.244] 4 * * * Request timed out. 5 * * * Request timed out. 6 13 ms 12 ms 13 ms 0.et-7-1-5.BR1.IAD8.ALTER.NET <http://0.et-7-1-5.br1.iad8.alter.net/> [140.222.226.17] 7 10 ms 10 ms 10 ms verizon.com.customer.alter.net [152.179.50.110] 8 12 ms 12 ms 13 ms be3084.ccr42.dca01.atlas.cogentco.com [154.54.30.65] 9 22 ms 22 ms 22 ms be2820.rcr21.pit02.atlas.cogentco.com [154.54.83.54] 10 22 ms 22 ms 21 ms 38.104.120.90 11 26 ms 21 ms 19 ms 204.16.241.133 12 * * * Request timed out. 13 21 ms 21 ms 21 ms 204.16.244.8 Is this a possible traffic engineering blip? I can’t say we’ve ever seen trace routes return such sparse results and actually make it to the destination. -- Nick Zurku Systems Engineer TeraSwitch, Inc. Cell: 412-953-0481 Office: 412-945-7048 nzurku(a)teraswitch.com

4 3

RE: [outages] facebook slow
by Keith Medcalf 02 Dec '18

02 Dec '18

> From what I'm aware of the US is currently experiencing issues >with FB, Instagram and LastPass. The latter is impacting business for >us. Coincidence? Maybe. The root cause will certainly be >interesting. Why don't you just write all your password on big sheets of construction paper and put them on the front of the building or in the nearest Starbucks? That way you won't have it "impacting business" and you passwords will be more secure ... --- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume. >-----Original Message----- >From: Outages [mailto:outages-bounces@outages.org] On Behalf Of Brian >Ladd via Outages >Sent: Friday, 30 November, 2018 08:21 >To: outages(a)outages.org >Subject: Re: [outages] facebook slow > >Wouldn't it be faster to create a mail filter to ignore outage >notifications with social media platforms in the subject line than it >would to write up an email complaining about it? Good grief. > >Brian Ladd >Customer Care Manager >Voiceopia Communications > > > > >On Fri, Nov 30, 2018 at 9:28 AM Andrew R. LaPour via Outages ><outages(a)outages.org> wrote: > > > Gentlemen, some of you complain more than help. To judge the >criticality of a service for other businesses is simply ignorant. An >issue with a service as vast as FB could certainly be related to >carrier services... As you all know, Cloud/SaaS services have >evolved to a degree in which outages have a larger impact on >businesses today than ever before and thus this list, like it or not, >has also evolved. > > From what I'm aware of the US is currently experiencing issues >with FB, Instagram and LastPass. The latter is impacting business for >us. Coincidence? Maybe. The root cause will certainly be >interesting. > > > Andrew LaPour > VP of Information Technology > > Sent from my phone. Forgive the brevity, the typos and the lack >of nuance. > <http://foresightfg.com> > Confidentiality Notice: > > The information transmitted is intended only for the person(s) >or entity to which it is addressed and may contain confidential and >/or privileged material. Any review, retransmission, dissemination or >other use of, or taking of any action in reliance upon, this >information by persons or entities other than the intended recipient >is prohibited. If you receive this in error, please contact the >sender and delete the material from any computer. > > This email has been scanned for viruses and malware, and may >have been automatically archived. > Think Green! Before printing this e-mail ask the question, is it >necessary? > > > > -------- Original Message -------- > From: Outages <outages-bounces(a)outages.org> on behalf of Nick >Pron via Outages <outages(a)outages.org> > Date: Tue, November 20, 2018 9:38 AM -0600 > To: outages(a)outages.org > Subject: Re: [outages] facebook slow > > >Caution: The e-mail below originated from an external source. Please >do not open attachments or click links from an unknown or suspicious >origin. > >Report suspicious e-mails here <http://forms/view.php?id=20485> . >PLEASE, DO NOT FORWARD POTENTIALLY SUSPICIOUS E-MAILS, DELETE THEM >INSTEAD. > > > Just saying that FB is integrated with a lot of applications >with their Connect platform... Knowing it could be down could be >useful for some folks… > > > > Just because you guys dislike/don’t use FB doesn’t mean it might >not be useful to some people > > > > > > Nick Pron | Senior Infrastructure Analyst, Computer Ops > > 1303 Yonge Street, Toronto, ON, M4T 2Y9, Canada > > P: 416-323-6610 ext. 6610 | Nick.Pron(a)cineplex.com > > Cineplex.com <http://www.cineplex.com/> > > http://mediafiles.cineplex.com/emailsignature/HomeOffice_Cineple >x_Waterstone_EmailSignature_EN.jpg > > > > > > From: Outages <outages-bounces(a)outages.org> On Behalf Of >Ferullo, Michael J. via Outages > Sent: Tuesday, November 20, 2018 10:25 AM > To: 'Steven McCrory' <steven(a)simplyip.net>; 'Mike Bolitho' ><mikebolitho(a)gmail.com>; outages(a)ics-il.net > Cc: 'outages(a)outages.org' <outages(a)outages.org> > Subject: Re: [outages] facebook slow > > > > Also much in agreement here. I signed up for this list for >exactly what Mike stated: meaningful business critical services. I’d >suggest someone spearhead the creation of another list for anything >“social media” related. > > > > > > > > Michael J. Ferullo <http://www.hinckleyallen.com> > Systems Administrator > > >________________________________ > > > Hinckley Allen <http://www.hinckleyallen.com/> > 28 State Street > Boston, MA 02109-1775 > p: 617-378-4226 | f: 617-345-9020 > mferullo(a)hinckleyallen.com <mailto:mferullo@hinckleyallen.com> > > > > From: Outages <outages-bounces(a)outages.org> On Behalf Of Steven >McCrory via Outages > Sent: Tuesday, November 20, 2018 10:23 AM > To: 'Mike Bolitho' <mikebolitho(a)gmail.com>; outages(a)ics-il.net; >outages(a)outages.org <mailto:outages@outages.org> > Subject: Re: [outages] facebook slow > > > > Wholeheartedly agree > > > > From: Outages <outages-bounces(a)outages.org> On Behalf Of Mike >Bolitho via Outages > Sent: 20 November 2018 15:18 > To: outages(a)ics-il.net > Cc: outages(a)outages.org > Subject: Re: [outages] facebook slow > > > > I would encourage everyone to revisit the info page for the >outages mailing list found here: >https://puck.nether.net/mailman/listinfo/outages > > > > "The purpose of this list is to have a central place to lookup >and report so that end users & network operators know why their >services (e-mail, phones, etc) went down eliminating the need to open >tons of trouble tickets during a major event. One master ticket - >such as fiber cut affect xxx OC48's would suffice. We hope this would >empower users and network operators to post such events so that >everyone could benefit from it. " > > > > The list is for reporting outages on carrier networks and has >grown to cloud services (AWS, Azure) as those have expanded. Facebook >is not a provider of any meaningful business critical services, and >therefore does not fit in this forum. > > > > - Mike Bolitho > > > > > > On Tue, Nov 20, 2018 at 7:57 AM Mike Hammett via Outages ><outages(a)outages.org> wrote: > > Facebook is a fairly commonly used service. > > Also, it's currently broken and has been so for about an >hour. > > > > ----- > Mike Hammett > Intelligent Computing Solutions <http://secure- >web.cisco.com/105opyZyNNLiLGlF1yoM0QSbPQe6gfXol140tqytrj_O9_I315Q9gSb >Bc6IkXVH0KC3dX0dYG24fw_k9pAxAM_75la4EK3fdJQnNzA- >CX7jitUzyNvVSsUAS5VjGe5ZMdCwUqoZgMV3ZtNhlyaiqmtxZY1- >Ohsq5peVy8bzzWe760lJB-HWUncs_P68XuXOUR0dOtK_nhy0Vk_qv57Poyz- >YdhwqcfEerMx4EBo- >3xB8baTgAzHz38b3T6MV5B9KSU4BdatFCaupPBL2qe9nzEg/http%3A%2F%2Fwww.ics- >il.com%2F> > <https://www.facebook.com/ICSIL> ><https://plus.google.com/+IntelligentComputingSolutionsDeKalb> ><https://www.linkedin.com/company/intelligent-computing-solutions> ><https://twitter.com/ICSIL> > Midwest Internet Exchange <http://www.midwest-ix.com/> > <https://www.facebook.com/mdwestix> ><https://www.linkedin.com/company/midwest-internet-exchange> ><https://twitter.com/mdwestix> > The Brothers WISP <http://secure- >web.cisco.com/1FwZkVeDpigayFgrMjyqfZim4gJXMZM_XZAU1XIftns_qGv2KUfrt2U >E4E6j3Jr1TbfoEujIthggmUEzqeyJaQ7Bgg_94KTAbHyrAZei1CbpTdqjgpB5mEGD_VVn >RYlJhBrPfnvs2EbnK2JlaXB0XVuhe9JUzbPo6VDtK9G3o8RDHR01WbnFpG5sCsU3M4geB >aZa6Sm0QJSXU3VnsxP2LNw25IvEd4jAHOQQSybDraVRloPPSFFO1kREXDwyWACbZzAsNU >4YVPEpwZiwBvwjWDA/http%3A%2F%2Fwww.thebrotherswisp.com%2F> > <https://www.facebook.com/thebrotherswisp> ><https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> > > >________________________________ > > > From: "Tanner Ryan via Outages" <outages(a)outages.org> > To: "jimmy keffer" <horsezip(a)earthlink.net> > Cc: outages(a)outages.org > Sent: Tuesday, November 20, 2018 8:50:40 AM > Subject: Re: [outages] facebook slow > > I don’t see the point of sending this in the outages >mailing list. > > > > > > Best, > > Tanner Ryan <https://secure- >web.cisco.com/1fu4ggC10rNErrmEU-eiRWzagI_-sDOnXaEYE-yYCufmkNEVyWpB- >2B3bayXrQSB7BeEsu2K4qOOYBgjPkgKsLUL- >lpZ0M40UaChX6Eolc8M8VNl7y4XdKHyLHjXjwdCXBxwrTAQPNrOSAoreVrnoEjEI0kX__ >LxATQuT6inaRDuT7SroUEAX8zVEOhHFQkl_eWD1trLCg7PLQqM5IGsN0xj_3kXb- >XsjmuDa4E59mj4- >RwCc5ZnjbubNfOENqoYEt7mhspR9XihsGh6U1T1Kxg/https%3A%2F%2FTannerRyan.c >a> > canadatechguy(a)gmail.com > > > _______________________________________________ > Outages mailing list > Outages(a)outages.org > https://puck.nether.net/mailman/listinfo/outages > > > > _______________________________________________ > Outages mailing list > Outages(a)outages.org > https://puck.nether.net/mailman/listinfo/outages > > > > > > _______________________________________________ > Outages mailing list > Outages(a)outages.org > https://puck.nether.net/mailman/listinfo/outages >

5 4

Re: China ’s Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom’ s BGP Hijacking
by Scott Weeks 02 Dec '18

02 Dec '18

China Telecom's response: "The content of these reports was lack of factual evidence. The conclusion was ungrounded. Also, it did not match with the current status and technical principles of global Internet operation." http://www.irasia.com/listco/hk/chinatelecom/press/p181122.htm scott

5 7

Research survey about cloud services operations
by Yan Zhai 30 Nov '18

30 Nov '18

Hi there, we are researchers from University of Wisconsin Madison. Our research is about cloud computing and system security. Currently we are surveying on a few facts about how cloud tenants operate their services. The purpose of the survey is to justify a few design questions so that our research can be practical for real world applications. I am wondering if you could kindly help us by filling out a few simple general questions hosted on Typeform: https://yanzhai.typeform.com/to/sZ0Yjm . The survey is fully anonymous. Any of your feedback would be greatly appreciated! Thank you very much! Yan

1 0

Weekly Routing Table Report
by cscora＠apnic.net 30 Nov '18

30 Nov '18

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 01 Dec, 2018 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 726637 Prefixes after maximum aggregation (per Origin AS): 280070 Deaggregation factor: 2.59 Unique aggregates announced (without unneeded subnets): 349897 Total ASes present in the Internet Routing Table: 62579 Prefixes per ASN: 11.61 Origin-only ASes present in the Internet Routing Table: 53999 Origin ASes announcing only one prefix: 23452 Transit ASes present in the Internet Routing Table: 8580 Transit-only ASes present in the Internet Routing Table: 256 Average AS path length visible in the Internet Routing Table: 4.0 Max AS path length visible: 43 Max AS path prepend of ASN ( 22394) 40 Prefixes from unregistered ASNs in the Routing Table: 36 Number of instances of unregistered ASNs: 36 Number of 32-bit ASNs allocated by the RIRs: 25055 Number of 32-bit ASNs visible in the Routing Table: 20291 Prefixes from 32-bit ASNs in the Routing Table: 87059 Number of bogon 32-bit ASNs visible in the Routing Table: 18 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 255 Number of addresses announced to Internet: 2854067617 Equivalent to 170 /8s, 29 /16s and 157 /24s Percentage of available address space announced: 77.1 Percentage of allocated address space announced: 77.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.1 Total number of prefixes smaller than registry allocations: 242499 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 198357 Total APNIC prefixes after maximum aggregation: 56634 APNIC Deaggregation factor: 3.50 Prefixes being announced from the APNIC address blocks: 195618 Unique aggregates announced from the APNIC address blocks: 80721 APNIC Region origin ASes present in the Internet Routing Table: 9250 APNIC Prefixes per ASN: 21.15 APNIC Region origin ASes announcing only one prefix: 2597 APNIC Region transit ASes present in the Internet Routing Table: 1385 Average APNIC Region AS path length visible: 4.0 Max APNIC Region AS path length visible: 29 Number of APNIC region 32-bit ASNs visible in the Routing Table: 4254 Number of APNIC addresses announced to Internet: 768787328 Equivalent to 45 /8s, 210 /16s and 195 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-139577 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 215529 Total ARIN prefixes after maximum aggregation: 102534 ARIN Deaggregation factor: 2.10 Prefixes being announced from the ARIN address blocks: 214899 Unique aggregates announced from the ARIN address blocks: 102746 ARIN Region origin ASes present in the Internet Routing Table: 18307 ARIN Prefixes per ASN: 11.74 ARIN Region origin ASes announcing only one prefix: 6802 ARIN Region transit ASes present in the Internet Routing Table: 1830 Average ARIN Region AS path length visible: 3.6 Max ARIN Region AS path length visible: 43 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2512 Number of ARIN addresses announced to Internet: 1093425568 Equivalent to 65 /8s, 44 /16s and 89 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 198658 Total RIPE prefixes after maximum aggregation: 94883 RIPE Deaggregation factor: 2.09 Prefixes being announced from the RIPE address blocks: 195035 Unique aggregates announced from the RIPE address blocks: 115624 RIPE Region origin ASes present in the Internet Routing Table: 25667 RIPE Prefixes per ASN: 7.60 RIPE Region origin ASes announcing only one prefix: 11478 RIPE Region transit ASes present in the Internet Routing Table: 3543 Average RIPE Region AS path length visible: 4.1 Max RIPE Region AS path length visible: 36 Number of RIPE region 32-bit ASNs visible in the Routing Table: 7636 Number of RIPE addresses announced to Internet: 715962752 Equivalent to 42 /8s, 172 /16s and 185 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 94374 Total LACNIC prefixes after maximum aggregation: 21796 LACNIC Deaggregation factor: 4.33 Prefixes being announced from the LACNIC address blocks: 95750 Unique aggregates announced from the LACNIC address blocks: 41854 LACNIC Region origin ASes present in the Internet Routing Table: 7850 LACNIC Prefixes per ASN: 12.20 LACNIC Region origin ASes announcing only one prefix: 2162 LACNIC Region transit ASes present in the Internet Routing Table: 1483 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 30 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 5392 Number of LACNIC addresses announced to Internet: 172999680 Equivalent to 10 /8s, 79 /16s and 196 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 19682 Total AfriNIC prefixes after maximum aggregation: 4193 AfriNIC Deaggregation factor: 4.69 Prefixes being announced from the AfriNIC address blocks: 25080 Unique aggregates announced from the AfriNIC address blocks: 8714 AfriNIC Region origin ASes present in the Internet Routing Table: 1226 AfriNIC Prefixes per ASN: 20.46 AfriNIC Region origin ASes announcing only one prefix: 413 AfriNIC Region transit ASes present in the Internet Routing Table: 241 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 19 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 497 Number of AfriNIC addresses announced to Internet: 102497536 Equivalent to 6 /8s, 27 /16s and 253 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 4620 515 518 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4256 4192 74 ERX-CERNET-BKB China Education and Rese 7552 2983 1150 88 VIETEL-AS-AP Viettel Group, VN 45899 2980 1705 113 VNPT-AS-VN VNPT Corp, VN 4766 2832 11131 767 KIXS-AS-KR Korea Telecom, KR 9829 2746 1496 551 BSNL-NIB National Internet Backbone, IN 9808 2449 8699 26 CMNET-GD Guangdong Mobile Communication 9394 2435 4907 30 CTTNET China TieTong Telecommunications 17974 2257 970 54 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4755 2135 421 171 TATACOMM-AS TATA Communications formerl Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6327 3501 1324 84 SHAW - Shaw Communications Inc., CA 11492 3471 224 617 CABLEONE - CABLE ONE, INC., US 22773 3293 2977 172 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 2609 5245 961 AMAZON-02 - Amazon.com, Inc., US 16625 2200 1212 1668 AKAMAI-AS - Akamai Technologies, Inc., 18566 2152 405 108 MEGAPATH5-US - MegaPath Corporation, US 20115 2145 2746 535 CHARTER-20115 - Charter Communications, 5650 2087 3074 1462 FRONTIER-FRTR - Frontier Communications 30036 2074 347 131 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 2053 5080 598 CENTURYLINK-US-LEGACY-QWEST - CenturyLi Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5175 1617 133 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 3035 378 43 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2587 563 1913 AKAMAI-ASN1, US 12389 2191 2195 613 ROSTELECOM-AS, RU 34984 2049 337 536 TELLCOM-AS, TR 9121 1811 1691 17 TTNET, TR 13188 1605 100 42 TRIOLAN, UA 8402 1297 544 17 CORBINA-AS OJSC "Vimpelcom", RU 6849 1218 355 21 UKRTELNET, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5444 3313 605 Uninet S.A. de C.V., MX 10620 3123 475 888 Telmex Colombia S.A., CO 11830 2676 371 71 Instituto Costarricense de Electricidad 6503 1661 449 54 Axtel, S.A.B. de C.V., MX 7303 1437 961 219 Telecom Argentina S.A., AR 28573 1182 2240 185 CLARO S.A., BR 6147 1117 377 29 Telefonica del Peru S.A.A., PE 3816 1023 511 115 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 943 145 69 Alestra, S. de R.L. de C.V., MX 13999 924 537 256 Mega Cable, S.A. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 37611 908 107 9 Afrihost, ZA 36903 796 400 142 MT-MPLS, MA 36992 787 1411 44 ETISALAT-MISR, EG 24863 739 393 22 LINKdotNET-AS, EG 24835 683 632 20 RAYA-AS, EG 8452 644 1728 15 TE-AS TE-AS, EG 29571 474 70 12 ORANGE-COTE-IVOIRE, CI 37492 458 470 57 ORANGE-, TN 37342 421 32 1 MOVITEL, MZ 15399 411 45 11 WANANCHI-, KE Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5444 3313 605 Uninet S.A. de C.V., MX 12479 5175 1617 133 UNI2-AS, ES 7545 4620 515 518 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4256 4192 74 ERX-CERNET-BKB China Education and Rese 39891 3778 203 20 ALJAWWALSTC-AS, SA 6327 3501 1324 84 SHAW - Shaw Communications Inc., CA 11492 3471 224 617 CABLEONE - CABLE ONE, INC., US 22773 3293 2977 172 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3123 475 888 Telmex Colombia S.A., CO 8551 3035 378 43 BEZEQ-INTERNATIONAL-AS Bezeqint Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 5175 5042 UNI2-AS, ES 4538 4256 4182 ERX-CERNET-BKB China Education and Research Net 7545 4620 4102 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 3758 ALJAWWALSTC-AS, SA 6327 3501 3417 SHAW - Shaw Communications Inc., CA 22773 3293 3121 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 3035 2992 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7552 2983 2895 VIETEL-AS-AP Viettel Group, VN 45899 2980 2867 VNPT-AS-VN VNPT Corp, VN 11492 3471 2854 CABLEONE - CABLE ONE, INC., US Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 64121 UNALLOCATED 98.159.9.0/24 19555 KMI-NETWORK - Kinder Morgan, I 64121 UNALLOCATED 98.159.12.0/24 19555 KMI-NETWORK - Kinder Morgan, I 64140 UNALLOCATED 98.159.14.0/24 64121 UNKNOWN 65599 UNALLOCATED 103.14.27.0/24 134813 CYBERCOMM-BD Cyber Communicati 65001 PRIVATE 109.161.56.0/24 13118 ASN-YARTELECOM PJSC Rostelecom 92937 UNALLOCATED 110.49.72.0/24 45458 SBN-AWN-AS-02-AP SBN-ISP/AWN-I 4230060012 PRIVATE 132.190.106.0/24 64673 -Private Use AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 198.18.1.19/32 7497 CSTNET-AS-AP Computer Network Information Cente Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.92.0/22 14988 BTC-GATE1, BW 41.78.180.0/23 37265 -Reserved AS-, ZZ 43.255.80.0/24 36351 SOFTLAYER - SoftLayer Technologies Inc., US 43.255.82.0/24 36351 SOFTLAYER - SoftLayer Technologies Inc., US 43.255.83.0/24 36351 SOFTLAYER - SoftLayer Technologies Inc., US 45.121.32.0/22 134356 UNKNOWN 45.124.164.0/22 38803 GTELECOM-AUSTRALIA Gtelecom-AUSTRALIA, AU Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:13 /9:11 /10:36 /11:99 /12:291 /13:568 /14:1123 /15:1909 /16:13325 /17:7892 /18:13873 /19:25494 /20:39471 /21:46106 /22:90181 /23:73931 /24:410046 /25:827 /26:660 /27:643 /28:39 /29:20 /30:21 /31:4 /32:54 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 3995 5175 UNI2-AS, ES 6327 3271 3501 SHAW - Shaw Communications Inc., CA 39891 2946 3778 ALJAWWALSTC-AS, SA 11492 2759 3471 CABLEONE - CABLE ONE, INC., US 22773 2536 3293 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 2491 3035 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 18566 2047 2152 MEGAPATH5-US - MegaPath Corporation, US 11830 2021 2676 Instituto Costarricense de Electricidad y Telec 30036 1823 2074 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 5650 1761 2087 FRONTIER-FRTR - Frontier Communications of Amer Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1631 2:888 4:18 5:2736 6:43 7:1 8:1151 12:1869 13:296 14:1875 15:35 16:4 17:198 18:58 20:48 23:2529 24:2412 25:2 27:2530 31:2002 32:88 35:31 36:532 37:2972 38:1600 39:274 40:119 41:3144 42:730 43:1990 44:136 45:6239 46:3052 47:241 49:1320 50:1071 51:318 52:1109 54:362 55:1 56:6 57:41 58:1707 59:1075 60:462 61:2121 62:1904 63:1802 64:5059 65:2178 66:4782 67:2651 68:1154 69:3358 70:1150 71:601 72:2248 74:2714 75:399 76:526 77:1702 78:1744 79:2219 80:1588 81:1411 82:1056 83:825 84:1062 85:2132 86:558 87:1492 88:923 89:2399 90:211 91:6469 92:1277 93:2394 94:2458 95:3082 96:910 97:348 98:941 99:166 100:87 101:1159 102:293 103:19308 104:3579 105:227 106:903 107:1832 108:706 109:3434 110:1627 111:1830 112:1408 113:1333 114:1142 115:1707 116:1599 117:1871 118:2216 119:1671 120:1121 121:1033 122:2364 123:1675 124:1444 125:1930 128:1209 129:690 130:517 131:1644 132:717 133:193 134:1042 135:224 136:535 137:672 138:1949 139:757 140:564 141:757 142:802 143:1009 144:852 145:497 146:1240 147:761 148:1684 149:728 150:768 151:996 152:919 153:327 154:2199 155:971 156:1631 157:848 158:670 159:1888 160:1473 161:886 162:2648 163:763 164:1118 165:1589 166:462 167:1346 168:3168 169:866 170:4009 171:500 172:1058 173:2106 174:989 175:871 176:2234 177:3996 178:2522 179:1307 180:2108 181:2357 182:2607 183:1332 184:1145 185:14407 186:3639 187:2497 188:2936 189:2055 190:8293 191:1363 192:9926 193:6404 194:5265 195:4049 196:2995 197:1761 198:5683 199:5977 200:7444 201:5014 202:10193 203:10212 204:4566 205:3019 206:3224 207:3195 208:3955 209:4139 210:3876 211:2025 212:3067 213:2800 214:1059 215:55 216:6029 217:2177 218:871 219:506 220:1833 221:997 222:955 223:1406 End of report

1 0

progress report: modernizing OpenBGPD
by Job Snijders 29 Nov '18

29 Nov '18

Dear fellow BGP aficionados, Over the last few months we've spend considerable time modernizing the OpenBSD's BGP-4 implementation "OpenBGPD", with the explicit goal to offer more diversity in the IXP Route Server space. OpenBGPD now is faster, has RFC 8212 support, RFC 6811 Origin Validation support, and a bunch of other cool features that make life easier! Read the full report here: https://labs.ripe.net/Members/claudio_jeker/openbgpd-adding-diversity-to-ro… Kind regards, Job

1 0

netflix OCA in a CG-NAT world
by Tom Ammon 29 Nov '18

29 Nov '18

I'm looking to understand the impact of CG-NAT on a set of netflix OCAs, in an ISP environment. I see in Netflix's FAQ on the subject that traffic sourced from RFC 1918/6598 endpoints can't be delivered to the OCA. Is this simply a matter of deploying the OCA on the outside of the CGN layer? What are the other consequences of CGN upon the OCA? Tom -- ----------------------------------------------------------------------------- Tom Ammon M: (801) 784-2628 thomasammon(a)gmail.com -----------------------------------------------------------------------------

12 20

Bulk IP abuse reporting
by micah anderson 28 Nov '18

28 Nov '18

Hi all, It seems that outdated CLDAP servers on the internet are being used again for DDoS amplification attacks. I've got about 16k IPs that have participated in several of these over the last several weeks and I'd like to report these to the relevant abuse departments so they can be properly handled. However, I am not finding a simple, or standardized way to look up the abuse contacts for a specific IP. Does someone have a suggestion? thanks! -- micah

3 2