August 2019 - Test - lists.nanog.org

Weekly Routing Table Report
by cscora＠apnic.net 03 Sep '19

03 Sep '19

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 31 Aug, 2019 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 768323 Prefixes after maximum aggregation (per Origin AS): 295832 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 370810 Total ASes present in the Internet Routing Table: 65326 Prefixes per ASN: 11.76 Origin-only ASes present in the Internet Routing Table: 56226 Origin ASes announcing only one prefix: 24072 Transit ASes present in the Internet Routing Table: 9100 Transit-only ASes present in the Internet Routing Table: 269 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 45 Max AS path prepend of ASN ( 27978) 31 Prefixes from unregistered ASNs in the Routing Table: 27 Number of instances of unregistered ASNs: 27 Number of 32-bit ASNs allocated by the RIRs: 28444 Number of 32-bit ASNs visible in the Routing Table: 23268 Prefixes from 32-bit ASNs in the Routing Table: 105688 Number of bogon 32-bit ASNs visible in the Routing Table: 14 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 288 Number of addresses announced to Internet: 2834690304 Equivalent to 168 /8s, 245 /16s and 241 /24s Percentage of available address space announced: 76.6 Percentage of allocated address space announced: 76.6 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.3 Total number of prefixes smaller than registry allocations: 257215 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 206838 Total APNIC prefixes after maximum aggregation: 61926 APNIC Deaggregation factor: 3.34 Prefixes being announced from the APNIC address blocks: 201585 Unique aggregates announced from the APNIC address blocks: 84621 APNIC Region origin ASes present in the Internet Routing Table: 10000 APNIC Prefixes per ASN: 20.16 APNIC Region origin ASes announcing only one prefix: 2776 APNIC Region transit ASes present in the Internet Routing Table: 1483 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 29 Number of APNIC region 32-bit ASNs visible in the Routing Table: 5015 Number of APNIC addresses announced to Internet: 766769408 Equivalent to 45 /8s, 179 /16s and 249 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-141625 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 226731 Total ARIN prefixes after maximum aggregation: 106033 ARIN Deaggregation factor: 2.14 Prefixes being announced from the ARIN address blocks: 225420 Unique aggregates announced from the ARIN address blocks: 107479 ARIN Region origin ASes present in the Internet Routing Table: 18534 ARIN Prefixes per ASN: 12.16 ARIN Region origin ASes announcing only one prefix: 6858 ARIN Region transit ASes present in the Internet Routing Table: 1891 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 42 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2875 Number of ARIN addresses announced to Internet: 1067004160 Equivalent to 63 /8s, 153 /16s and 49 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 214997 Total RIPE prefixes after maximum aggregation: 100530 RIPE Deaggregation factor: 2.14 Prefixes being announced from the RIPE address blocks: 211061 Unique aggregates announced from the RIPE address blocks: 124404 RIPE Region origin ASes present in the Internet Routing Table: 26388 RIPE Prefixes per ASN: 8.00 RIPE Region origin ASes announcing only one prefix: 11647 RIPE Region transit ASes present in the Internet Routing Table: 3733 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 29 Number of RIPE region 32-bit ASNs visible in the Routing Table: 8422 Number of RIPE addresses announced to Internet: 721204480 Equivalent to 42 /8s, 252 /16s and 181 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 98760 Total LACNIC prefixes after maximum aggregation: 22976 LACNIC Deaggregation factor: 4.30 Prefixes being announced from the LACNIC address blocks: 100007 Unique aggregates announced from the LACNIC address blocks: 44406 LACNIC Region origin ASes present in the Internet Routing Table: 8802 LACNIC Prefixes per ASN: 11.36 LACNIC Region origin ASes announcing only one prefix: 2327 LACNIC Region transit ASes present in the Internet Routing Table: 1620 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 45 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 6356 Number of LACNIC addresses announced to Internet: 173565184 Equivalent to 10 /8s, 88 /16s and 101 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 20969 Total AfriNIC prefixes after maximum aggregation: 4345 AfriNIC Deaggregation factor: 4.83 Prefixes being announced from the AfriNIC address blocks: 29962 Unique aggregates announced from the AfriNIC address blocks: 9637 AfriNIC Region origin ASes present in the Internet Routing Table: 1317 AfriNIC Prefixes per ASN: 22.75 AfriNIC Region origin ASes announcing only one prefix: 464 AfriNIC Region transit ASes present in the Internet Routing Table: 257 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 27 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 600 Number of AfriNIC addresses announced to Internet: 105899264 Equivalent to 6 /8s, 79 /16s and 229 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 4947 599 579 TPG-INTERNET-AP TPG Telecom Limited, AU 7552 3248 1459 32 VIETEL-AS-AP Viettel Group, VN 45899 3065 1768 114 VNPT-AS-VN VNPT Corp, VN 9829 2736 1494 547 BSNL-NIB National Internet Backbone, IN 9808 2694 9043 63 CMNET-GD Guangdong Mobile Communication 4766 2546 11119 763 KIXS-AS-KR Korea Telecom, KR 7713 2240 680 596 TELKOMNET-AS-AP PT Telekomunikasi Indon 9498 2163 434 209 BBIL-AP BHARTI Airtel Ltd., IN 4755 2153 442 192 TATACOMM-AS TATA Communications formerl 9394 2076 4898 24 CTTNET China TieTong Telecommunications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7155 4065 280 25 VIASAT-SP-BACKBONE - ViaSat,Inc., US 11492 3652 238 680 CABLEONE - CABLE ONE, INC., US 6327 3477 1324 91 SHAW - Shaw Communications Inc., CA 22773 3454 2973 156 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 3078 6452 1466 AMAZON-02 - Amazon.com, Inc., US 16625 2736 1438 1973 AKAMAI-AS - Akamai Technologies, Inc., 30036 2187 349 175 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 20115 2145 2762 525 CHARTER-20115 - Charter Communications, 18566 2086 405 105 MEGAPATH5-US - MegaPath Corporation, US 5650 2074 3073 1453 FRONTIER-FRTR - Frontier Communications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5515 1613 143 UNI2-AS, ES 39891 3780 219 19 ALJAWWALSTC-AS, SA 8551 3311 379 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2726 497 1927 AKAMAI-ASN1, US 31334 2602 484 13 KABELDEUTSCHLAND-AS, DE 12389 2392 2233 691 ROSTELECOM-AS, RU 34984 2127 346 541 TELLCOM-AS, TR 9121 2019 1692 18 TTNET, TR 9009 1736 187 936 M247, GB 13188 1604 100 47 TRIOLAN, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6254 3360 597 Uninet S.A. de C.V., MX 10620 3365 534 450 Telmex Colombia S.A., CO 11830 2692 370 54 Instituto Costarricense de Electricidad 6503 1611 378 415 Axtel, S.A.B. de C.V., MX 7303 1480 1024 274 Telecom Argentina S.A., AR 28573 1164 2228 203 CLARO S.A., BR 6147 1105 380 35 Telefonica del Peru S.A.A., PE 3816 1051 534 121 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 13999 1000 482 248 Mega Cable, S.A. de C.V., MX 11172 936 110 60 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1120 393 23 LINKdotNET-AS, EG 36992 956 1535 73 ETISALAT-MISR, EG 24835 888 590 21 RAYA-AS, EG 36903 843 424 112 MT-MPLS, MA 8452 672 1859 20 TE-AS TE-AS, EG 29571 527 68 11 ORANGE-COTE-IVOIRE, CI 15399 414 45 11 WANANCHI-, KE 37492 372 470 57 ORANGE-, TN 37342 370 32 1 MOVITEL, MZ 15706 362 32 6 Sudatel, SD Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6254 3360 597 Uninet S.A. de C.V., MX 12479 5515 1613 143 UNI2-AS, ES 7545 4947 599 579 TPG-INTERNET-AP TPG Telecom Limited, AU 7155 4065 280 25 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 3780 219 19 ALJAWWALSTC-AS, SA 11492 3652 238 680 CABLEONE - CABLE ONE, INC., US 6327 3477 1324 91 SHAW - Shaw Communications Inc., CA 22773 3454 2973 156 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3365 534 450 Telmex Colombia S.A., CO 8551 3311 379 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 5515 5372 UNI2-AS, ES 7545 4947 4368 TPG-INTERNET-AP TPG Telecom Limited, AU 7155 4065 4040 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 3780 3761 ALJAWWALSTC-AS, SA 6327 3477 3386 SHAW - Shaw Communications Inc., CA 22773 3454 3298 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 3311 3265 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7552 3248 3216 VIETEL-AS-AP Viettel Group, VN 11492 3652 2972 CABLEONE - CABLE ONE, INC., US 45899 3065 2951 VNPT-AS-VN VNPT Corp, VN Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 260984 UNALLOCATED 45.175.186.0/23 16735 ALGAR TELECOM S/A, BR 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 64511 DOCUMENT 66.154.208.0/21 32522 MULTNOMAH-ESD - Multnomah Educ 64511 DOCUMENT 66.154.216.0/23 32522 MULTNOMAH-ESD - Multnomah Educ 64511 DOCUMENT 66.154.218.0/24 32522 MULTNOMAH-ESD - Multnomah Educ 65550 DOCUMENT 81.8.34.0/24 15924 BORUSANTELEKOM-AS, TR 65550 DOCUMENT 81.8.35.0/24 15924 BORUSANTELEKOM-AS, TR 65549 DOCUMENT 117.239.163.0/24 65544 UNKNOWN 64339 UNALLOCATED 143.0.108.0/22 18747 IFX18747 - IFX Corporation, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 27.126.156.0/22 55827 UNKNOWN 27.126.156.0/23 55827 UNKNOWN 27.126.158.0/23 55827 UNKNOWN 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.220.48.0/20 36900 -Reserved AS-, ZZ 41.242.92.0/24 37643 -Reserved AS-, ZZ 41.242.93.0/24 37643 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:10 /9:11 /10:37 /11:98 /12:288 /13:573 /14:1142 /15:1915 /16:13259 /17:7983 /18:13735 /19:25575 /20:40168 /21:47329 /22:95972 /23:77628 /24:441773 /25:827 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4475 5515 UNI2-AS, ES 6327 3265 3477 SHAW - Shaw Communications Inc., CA 7155 3156 4065 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 2946 3780 ALJAWWALSTC-AS, SA 11492 2865 3652 CABLEONE - CABLE ONE, INC., US 8551 2764 3311 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2684 3454 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 31334 2490 2602 KABELDEUTSCHLAND-AS, DE 11830 2040 2692 Instituto Costarricense de Electricidad y Telec 18566 1981 2086 MEGAPATH5-US - MegaPath Corporation, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1744 2:1092 3:6 4:22 5:3026 6:49 7:1 8:1359 9:1 12:1796 13:398 14:2112 15:42 16:7 17:269 18:81 20:56 23:2895 24:2589 25:2 27:2461 31:2711 32:106 35:37 36:906 37:3123 38:1808 39:302 40:121 41:3390 42:820 43:2071 44:173 45:10156 46:3359 47:271 49:1442 50:1103 51:341 52:1041 54:263 55:684 56:6 57:47 58:2054 59:1109 60:580 61:2181 62:1989 63:1848 64:5011 65:2234 66:4816 67:2738 68:1196 69:3573 70:1386 71:670 72:2666 74:2700 75:1291 76:596 77:2524 78:1963 79:2365 80:1816 81:1501 82:1137 83:961 84:1164 85:2356 86:562 87:1562 88:1060 89:2544 90:231 91:6597 92:1444 93:2485 94:2571 95:3639 96:954 97:340 98:951 99:829 100:88 101:944 102:639 103:21930 104:3635 105:281 106:816 107:1790 108:689 109:3751 110:1763 111:2021 112:1536 113:1408 114:1251 115:1722 116:1743 117:1962 118:2214 119:1642 120:1056 121:1039 122:2296 123:1838 124:1529 125:2020 128:1301 129:849 130:536 131:1819 132:747 133:226 134:1079 135:255 136:598 137:794 138:2073 139:939 140:567 141:879 142:773 143:1071 144:893 145:277 146:1334 147:857 148:1785 149:1021 150:820 151:1026 152:1370 153:362 154:4413 155:889 156:2254 157:1050 158:693 159:1934 160:1577 161:950 162:2990 163:827 164:1246 165:1188 166:515 167:1416 168:3467 169:474 170:4186 171:651 172:1711 173:2226 174:1039 175:989 176:2436 177:4043 178:2729 179:1473 180:2146 181:2385 182:2772 183:1115 184:2276 185:15447 186:3720 187:2572 188:3465 189:2068 190:8241 191:1438 192:10105 193:6717 194:5511 195:4193 196:3094 197:1728 198:5938 199:5957 200:7151 201:5173 202:10268 203:10241 204:4532 205:3058 206:3171 207:3231 208:3945 209:4292 210:3893 211:2019 212:3249 213:2955 214:1135 215:54 216:5890 217:2212 218:868 219:599 220:1929 221:972 222:981 223:1364 End of report

16 38

The Curious Case of 143.95.0.0/16
by Ronald F. Guilmette 02 Sep '19

02 Sep '19

Fair Warning: Those of you not enamored of my long-winded exposés of various remarkable oddities of the IPv4 address space may wish to click on the tiny little wastebasket icons on your mail clients at this point. For the rest of you, please read on. I think you may find the following story intriguing. It contains at least a few surprising twists. +_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_ Our story today consists of three acts. Act 1 - It is Born ------------------ In mid-February of 1990 a new venture-capital backed company was formed in Sunnyvale, California. In some ways it was no different than the hundreds or thousands of hopeful high-tech startups that had been formed in Silicon Valley, both before and since. It started with a hopeful dream that, in the end, just didn't work out. The founders of this company settled initially on a temporary placeholder company name, XYZ Corporation: https://drive.google.com/file/d/1CkDNKq4M1DQKuTxBBhlYxUNAjU2cvDnY/view The mission of the company was to design and manufacture so-called X-Windows terminals. These would be diskless workstations, complete with CPUs, color (CRT) displays, graphics, memory, and an ethernet interface. The basic idea what that such a diskless workstation could run the free X-Windows client software, and that the system would be cheaper than ordinary PeeCees due to it not having any hard drives or optical drives. By some odd twist of fate, I myself was working in the same geographic area as a software engineer at around the same time, but I worked for a different Silicon Valley startup, just down the road from XYZ Corporation. And by a rather remarkable coincidence, the company I worked for had exactly the same goal and mission as the XYZ Corporation. The name of this other X-Windows workstation startup was Network Computing Devices, or just "NCD" for short. Quite obviously, both companies were inherently "network-centric" and thus, both requested and were granted blocks of IPv4 addresses. That wasn't at all within my area of responsibility at NCD, so I don't know who actually issued those blocks. My guess, based on published historical accounts, was that it was most probably Dr. Jon Postel who assigned the blocks. I'm sure that someone will correct me if I'm wrong. Months passed, and eventually the founders of XYZ Corporation settled on something they would use as a permanent replacement for their temporary placeholder corporate name. They decided to call the thing Athenix, Inc. Once they had settled on that name, they filed papers to update their records with the California Secretary of State's office: https://drive.google.com/file/d/1dUjsvSkzzdzUsIbIZCS7RF0afsI3uU0l/view At some point, they also and likewise updated the ARIN WHOIS record for the /16 block which had been assigned to them, on or about 1990-09-06, as was appropriate to reflect their new permanent corporate identity: https://pastebin.com/raw/YbH6zYrR More time passed and eventually it became clear that the entire world was not in fact breathlessly waiting for -two- companies to bring to market diskless X-Windows workstations. In fact, as history now shows, market demand would not support even one such company over the long term. Thus it came to pass in the year 1993 that an all-too-familiar end-of-life ritual played out once again in Silicon Valley. At Athenix, Inc. HQ in Sunnyvale, the people were all let go, including the founders. The desks, the chairs, the phones, the computers, and the tools were all sold at auction, with the proceeds going to the preferred shareholders, i.e. the poor fools who had put up all of the money for this now-failed venture in the first place, the venture capitalists. Foremost among those in this instance, was the venerable Menlo Park venture capital firm Kleiner Perkins. I've confirmed this historical account of the rise and fall of the original 1990-vintage Athenix, Inc. in multiple phone and email exchanges with both the original CEO of the original Athenix, Mr. Robert ("Bob") Garrow. lately of Los Altos, California, and also the original CTO of the company, Mr. John Garman, lately of Reno, Nevada. Act 2 - Rebirth - The Athenix Phoenix ------------------------------------- Fast forward fifteen years. On April 22, 2008 a pair of gentlemen in the Commonwealth of Massachusetts elected to establish a new corporate entity within the commonwealth. It's name would be Athenic, Inc.[1] https://drive.google.com/file/d/1jYUqtgYprI4iyJkTT91-yRBYJt0c2ufF/view https://drive.google.com/file/d/1mlVML8z7vzp7aeGmOK-3cWBBJeNBuThn/view As you can see in the documents above, a certain Mr. Ofer Inbar and a certain Mr. Robert Anita, both of the greater Boston area, formed this new corporate entity in Massachusetts. At its formation, the younger Mr. Inbar was the President, while the more senior Mr. Antia served as the corporate secretary and treasurer. Various other records, which I shall not include here, suggest that both Mr. Inbar and Mr. Anita were at some point in the distant past affiliated, in at least some tangential way, with the well-regarded white-hat Boston area hacking collective known as L0pht, aka L0pht Heavy Industries. I cannot say much about this apparent connection, other than to say that the details I have ferreted out about this connection are sketchy at best. I do however have it on reasonably good authority that Mr. Inbar has of late relocated to the greater Seattle metropolitan area, and that he is or was working as a network administrator for Google, Inc. in that area. Mr. Antia, in contrast, is still, when I last checked, a resident of the greater Boston area, and is a well regarded "graybeard" in the computing community in and around Boston, having been in the business, one way or another, for decades. Mr. Anita currently serves as President of the Boston area chapter of the public/private critical infrastructure cybersecurity defense partnership known as InfraGuard. https://infragard-boston.org/ The evidence currently available to me suggests that not long after the creation of Mr. Inbar's and Mr. Antia's Massachusetts Athenix, Inc., ARIN elected to delegate responsibility for the reverse DNS for the 143.95.0.0/16 IPv4 block to a pair of name servers called dns1.athenixinc.com and dns2.athenixinc.com. That delegation was already in place by 2010-06-24, which is about the time that Farsight Security Inc., my data source, first began passively collecting its historical archives of DNS response records. Historical records made available to me by Domaintools, LLC indicate that the athenixinc.com domain name was, at least initially, registered to Mr. Anita in Lincoln, Massachusetts. https://pastebin.com/raw/GNhbFDFz Subsequent historical WHOIS data collected by Domaintools in relation to the athenixinc.com domain name shows that after Mr. Anita, the domain name registration passed into the hands of at least one other individual, and eventually, to an entirely different corporate entity. We will come to that shortly. Almost a year ago now, when I was first investigating the 143.95.0.0/16 block, I attempted to interview Mr. Inbar by phone regarding his and Mr. Anita's Athenix, Inc. and the unusual history of the 143.95.0.0/16 block. It did not go well. Mr. Inbar was apparently reluctant to engage with me by phone on these or any other topics. He and I did have a few brief and truncated email exchanges after that however, but apparently my questions regarding how Mr. Inbar and Mr. Anita came to exercise effective day-to-day control over the 143.95.0.0/16 ARIN legacy block were not ones that Mr. Inbar felt in any way obliged to answer, and at some point he simply ceased answering my emails. In contrast, Mr. Antia was a veritable fount of information and he and I had multiple phone conversations as well as multiple email exchanges. From these exchanges I quickly deduced that Mr. Antia saw absolutely nothing wrong with, much less anything at all to be shy about with respect to the history of the 143.95.0.0/16 block -or- his formation, along with Mr. Inbar, of a new Athenix, Inc. in Massachusetts back in in 2008. Quite the contrary! Mr. Anita was kind enough for forward me a copy of the following really rather remarkable lease agreement, in which Mr. Inbar and Mr. Anita together undertook to lease the 143.95.0.0/16 IPv4 block to a certain Nevada- incorporated and Colorado-resident limited liability company known as Media Breakaway, LLC: https://drive.google.com/file/d/1ASXrUsiNAIq1IIZO5Lw1BqjD1qucqFmI/view As you can see, the term of the lease is 20 years, beginning from the 28th day of May, 2008. The compensation to be paid to Mr. Inbar's and Mr. Anita's Massachusetts Athenic, Inc. in return for this 20 year leasehold was to be $100,000 USD As Mr. Anita related to me, this sum was in fact paid, and Mr. Inbar and Mr. Anita split it evenly. (But of course, I have no way to independently verify that.) For those unaware, I pause here just long enough to note that the CEO of Media Breakaway, LLC is none other than Mr. Scott Richter, one-time "Spam King" and a man who both Wikipedia and the KrebsOnSecurity blog have asserted is a convicted felon. And of couurse, this is the very same Scott Richter who figured so prominently in Brian Krebs' report about pilfered legacy ARIN /16 blocks, published on the Washington Post, way back in April, 2008. Of course, in my phone conversations with Mr. Anita, I acquainted him with these relevant historical allegations. He confessed at the time that he had not personally done much at all in the way of due diligence with respect to either Mr. Richter or his company -- a lapse which I personally found (and find) quite unfortunate, to say the least, and not least because of Mr. Anita's position as the President of the Boston Chapter of Infraguard, the public/private partnership whose mission is the protection of the nation's critical infrastructure assets from cyber-threats. I would have hoped that a person in such a position would have been in the general habit of exercising at least some due diligence with respect to the people he does business with and, in this specific instance, preferably at some moment *before* Mr. Anita cashed his $50,000 check. Act 3 - Final Dispensation -------------------------- Now we come to the final remarkable chapter in the already remarkable history of the 143.95.0.0/16 legacy IPv4 ARIN address block. Some months after the formation of the Massachusetts "Athenix, Inc.", on Sepetember 2nd, 2008 a new corporate entity calling itself "Athenix Corporation" was incorporated in the State of California. Curiously, this third Athenix gave both its actual address and its mailing address as 10 Corporate Drive, Burlington, MA 01813. https://drive.google.com/file/d/1GHhwuPGPKdx5n46cYQ2UhTGiMSdxonFu/view https://drive.google.com/file/d/1ZLtcY2HWoi5vmNFAJleHep8DxIS3igVR/view As it happens, that street address is also the headquarters address of the publicly-traded Endurance International Group, Inc. (EIGI). There is substantial evidence indicating that EIGI is effectively in complete functional control of the 143.95.0.0/16 address block at the present moment. The company's primary ASN, AS29873 and also, an AS number belonging to one of the company's many acquired subsidiaries, A Small Orange LLC, AS62729 are each routing significant portions of the 143.95.0.0/16 block at the present time. https://bgp.he.net/AS29873#_prefixes https://bgp.he.net/AS62729#_prefixes Additionally, on or about 2017-05-22, EIGI became the registrant of the athenixinc.com domain, whose associated name servers (dns1 dns2) had provided revserse DNS service for the entire 143.95.0.0/16 block during 2011 and 2012. Delegation of the reverse DNS responsibility for the entire 143.95.0.0/16 block changed on or about 2013-11-28 so that the new name servers were ones associated with the domain name asonoc.com, at least according to the relevant historical data provided to me by Farsight Security, Inc. https://pastebin.com/raw/MVmzhirc Historically, and as recently as 2018-04-20, the domain name asonoc.com was and has been registered to the EIGI subsidiary A Small Orange LLC. https://pastebin.com/raw/Xy8UHZNw Responsibility for the reverse DNS for the entire 143.95.0.0/16 block remains delegated to the rdns1.asonoc.com and rdns2.asonoc.com name servers at the present moment. EIGI is primarily a web hosting company. It has, over time. exhibited a tendency to acquire other and smaller web hosting companies which it has then absorbed into and under its corporate unbrella. Unlike most other corporate acquirers however, EIGI is somewhat unique in its notable tendency to not rebrand its acqusitions so that they would be additive to its main corporate brand, generally electing instead to maintain the pre-acqusition brand names for its newly acquired web hosting businesses. One such EIGI- acquired propery that has retained its pre-acqusition brand name is the aforementioned Texas-based web hosting company called A Small Orange LLC, aka AS62729. (Those who may be interested in more backgound regarding EIGI and past controversies, specifically with relating to the company's accounting practices as well as the online activities of its clientele, are encouraged to consult the footnotes below.[2]) The available evidence suggests the clear possibility that EIGI and its subsidiary, A Small Orange LLC. may be controling and using the 143.95.0.0/16 block in a manner inconsistant with ordinary business rules of fair dealing and/or in a manner inconsistant with current ARIN policy, and further, that the company and/or its various C-suite officers may have arrived at this current situation not by happentance but rather by some very carefully considered premeditation. I mention specifically EIGI's C-suite officers, because the available evidence suggests that EIGI's apparent takeover of the 143.95.0.0/16 block was not purely or only the product of some unsanctioned rogue activity on the part of lower-level company functionaries. Multiple publicly available records obtained from the web site of the California Secretary of State implicate multiple current and former EIGI C-suite officers as having been, at the very least, directly aware of the formation of the third "Athenix", even if perhaps not directly or personally responsible for that rather suspicious company formation. https://drive.google.com/file/d/12gm41jG9iFIC9KvIJmfWNjUqCmRtTfxN/view https://drive.google.com/file/d/1zdhru_hpYVIJfVKi-s5X1MW0znrErJzQ/view https://drive.google.com/file/d/1dVHDSPKD4Qvur9rzCK9YZDEtOkFA2raS/view Plese note that Mr. Hari Ravichandran is the now-former CEO of EIGI. Mr. David Bryson was and remains EIGI's Chief Legal Officer. Mr. Marc Montagner was and remains EIGI's Chief Financial Officer. Mr. Jeffrey Fox is EIGI's current CEO, having succeded Mr. Ravichandran in that post. https://www.endurance.com/our-company/our-team https://exechange.com/7850/endurance-ceo-hari-ravichandran-leaves-2/7850 https://www.linkedin.com/in/hari-ravichandran-9b949b8 https://jumpv.com/meet-the-team/ https://www.linkedin.com/in/davidbryson https://www1.salary.com/David-C-Bryson-Salary-Bonus-Stock-Options-for-ENDUR… https://www.linkedin.com/in/marc-montagner-b112a1b1 https://wallmine.com/people/6106/marc-montagner https://www.linkedin.com/in/jeff-fox-820a0413 https://wallmine.com/people/2962/jeffrey-h-fox Given that EIGI's rights in and/or legal title to the 143.95.0.0/16 block appear to be, at best, on somewhat shaky ground, and given that the new 2008-vintage Athenix Corporation does not obviously possess any other obvious or apparent assets to speak of, it appears, to this writer at least, more than a little incongruous to see that EIGI apparently listed Athenix Corporation as a collateral asset on what, to a layman such as myself, appears to be a bank collateral statement which was filed, apparently in 2013, with the United States Securities and Exchange Comission. https://www.sec.gov/Archives/edgar/data/1237746/000119312514077774/d635170d… All I can say about that is that I personally was turned down for a bank loan, some years ago, when I attempted to use the monthly -liability- of my recurring water bills as collateral for the loan. But then I have never been anywhere near as accomplished at high finance as any of the gentlemen mentioned above surely are. Responses --------- More than 24 hours prior to posting this message, I reached out to the press contact email address listed on EIGI's web site, press (at) endurance.com, for comment about the facts elaborated above. No response was received from the company by press time. Prior to posting, I also reached out to John Curran @ ARIN for his response to the facts set forth above. John was kind enough to provide the following official on-the-record ARIN response: ARIN does not comment on specific registry changes (as number resource change requests are made in confidence), but we do take matters of potential number resource fraud quite seriously. I would recommend that you report potential incidents of registry fraud (if you have not done so already) via our Internet Number Resource Fraud Reporting process at https://www.arin.net/resources/fraud/, and we will promptly investigate. – John Curran, CEO, ARIN +_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_ FULL DISCLOSURE: I hold no postions, either short or long in EIGI or in any related company. +_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_ Acknowledgements ---------------- My thanks to Farsight Security, Inc. and to Domaintools, LLC for their kind support of this research. Footnotes: ======================================================================= [1] Rather remarkably, the Massachusetts Athenix, Inc. was incorporated a mere six days before my friend, journalist Brian Krebs, put up a story on the Washington Post web site, detailing how a pair of legacy ARIN IPv4 /16 blocks had somewhat inexplicably ended up in the hands of one of the world's most notorious spammers, Scott Richter. That story, as some of you will already know, alleged that a rather simple and yet elaborate fraud had been perpetrated against ARIN, a fraud which amounted to nothing less than corporate identity theft, with the one and only apparent goal being the effective take-over of two quite valuable legacy ARIN IPv4 /16 blocks, a goal which was, it appeared, successfully achieved with only a relatively minor investment of effort and expense. [2] In recent years, all has not gone well for EIGI. In the year 2015, a somewhat mysterious New York City short seller using the pen name Gotham City Research published a sequence of four reports detailing his beliefs that all was not as it should be at EIGI, both with respect to the company's financial statements and with respect to its clientele and their (allegedly) questionable online activities. 2015-04-28 - Endurance International Group - A Web of Deceit https://bit.ly/2KZXPLA 2015-04-29 - Initial Follow-up To: A Web of Deceit https://bit.ly/2L5Vv4o 2015-05-05 - EIGI’s Adjusted EBITDA is a Meaningless Metric https://bit.ly/342x4xE 2015-08-03 - Endurance International Group: Malicious Activities https://bit.ly/30Gk4vr The value of EIGI stock dropped rather precepitously following the publication of the Gotham City Research reports and has yet to recover to its earlier highs. https://drive.google.com/file/d/1BaGzFglnrbAca9DsRIqt2eD0m_jnrCMw/view The SEC's investigation of EIGI, and the SEC's subsequent enforcement actions against the company and its officers in 2018 also didn't help matters much with respect to EIGI and its stock price: https://www.sec.gov/enforce/33-10504-s https://www.bizjournals.com/boston/news/2018/08/22/former-endurance-group-e…

3 2

44/8
by Majdi S. Abbas 01 Sep '19

01 Sep '19

Apparently isn't 44/8 anymore: NetRange: 44.192.0.0 - 44.255.255.255 CIDR: 44.192.0.0/10 NetName: AT-88-Z NetHandle: NET-44-192-0-0-1 Parent: NET44 (NET-44-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Amazon Technologies Inc. (AT-88-Z) RegDate: 2019-07-18 Updated: 2019-07-18 Ref: https://rdap.arin.net/registry/ip/44.192.0.0 Some additional color is available at: https://www.ampr.org/amprnet/ What's interesting about this is it was not an ARIN allocation, and the ARDC folks are not the original registrant. This IANA /8 was initially delegated to a community, not an organization. So, to the individuals listed in the blog, that I've excerpted below, what do you have to say about this? Brian Kantor kc claffy Phil Karn Paul Vixie [I've omitted those I don't know to be NANOG familiar.] ARIN also appears to have a role here. Any comment, ARIN folks? --msa P.S. I've been licensed as a ham since prior to the organization of ARDC in 1992 -- where's my check?

54 133

Re: Weekly Routing Table Report
by Scott Weeks 31 Aug '19

31 Aug '19

From: Masataka Ohta <mohta(a)necom830.hpcl.titech.ac.jp> If you can't accept the following principle of the End to End argument: The function in question can completely and correctly be implemented only with the knowledge and help of the application standing at the end points of the communication system. ------------------------------------------------------- I have been reading your posts on IETF and here regarding the above and I'm curious as to your thoughts on John Day's RINA. It tosses all this on its head. scott

2 1

Re: Weekly Routing Table Report
by Scott Weeks 31 Aug '19

31 Aug '19

--- web(a)typo.org wrote: "WTF, PEOPLE??? CAN'T ANYONE AGGREGATE ANYMORE???" --------------------------------------- Is that like the NANOG version of "get off my lawn"? :) scott bgp since ~50k

5 4

The Curious Case of 143.95.0.0/16
by Ronald F. Guilmette 28 Aug '19

28 Aug '19

Mel Beckman mel at beckman.org wrote: >I have one question, “of late”, regarding your post: Is it “Antia” or “Anita”? Yes. Sorry. There were multiple small typos in what I posted. Not surprising, since I am an utterly awful typist. The link I gave in my post provides enough redundant context to work out the correct answer in this case: https://infragard-boston.org/ The gentleman's name is Robert ("Bob") Antia. Unrelated to that small faux pas on my part, I also would just like to mention that I have only just now been pointed at an additional relevant online document that provides more clarity as regards to who, or what, ended up owning the original Athenix's intangible assets following its demise. https://patents.google.com/patent/US5119494 In the case of this patent, ownership seem to have untimately been assigned to: JACKSON, DAVID HOOK PARTNERS II C/O DAVID J. HOOK KLEINER PERKINS CAUFIELD & BYERS V C/O JAMES LALLY COMDISCO, INC. INSTITUTIONAL VENTURE MANAGEMENT V C/O PETER THOMAS GARROW, ROBERT A. INSTITUTIONAL VENTURE PARTNERS FUND V C/O PETER THOMAS SINGAPORE ECONOMIC DEVELOPMENT BOARD PACVEN INVESTMENT, LTD. C/O LIP-BU TAN Obviously, this is a more complete list of Athenix's heirs and assigns than I had included in my earlier post. Regards, rfg

1 0

Reflection DDoS last week (was: syn flood attacks from NL-based netblocks)
by Töma Gavrichenkov 28 Aug '19

28 Aug '19

Peace, Here's to confirm that the pattern reported before in NANOG was indeed a reflection DDoS attack. On Sunday, it also hit our customer, here's the report: https://www.prnewswire.com/news-releases/root-cause-analysis-and-incident-r… tl;dr: basically that was a rather massive reflected SYN/ACK carpet bombing against several datacenter prefixes (no particular target was identified). -- Töma On Sat, Aug 17, 2019, 1:06 AM Jim Shankland <nanog(a)shankland.org> wrote: > Greetings, > > I'm seeing slow-motion (a few per second, per IP/port pair) syn flood > attacks ostensibly originating from 3 NL-based IP blocks: 88.208.0.0/18 > , 5.11.80.0/21, and 78.140.128.0/18 ("ostensibly" because ... syn flood, > and BCP 38 not yet fully adopted). > > Why is this syn flood different from all other syn floods? Well ... > > 1. Rate seems too slow to do any actual damage (is anybody really > bothered by a few bad SYN packets per second per service, at this > point?); but > > 2. IPs/port combinations with actual open services are being targeted > (I'm seeing ports 22, 443, and 53, just at a glance, to specific IPs > with those services running), implying somebody checked for open > services first; > > 3. I'm seeing this in at least 2 locations, to addresses in different, > completely unrelated ASes, implying it may be pretty widespread. > > Is anybody else seeing the same thing? Any thoughts on what's going on? > Or should I just be ignoring this and getting on with the weekend? > > Jim >

4 6

Looking for a Google contact (peering frustrations)
by Jon Sands 28 Aug '19

28 Aug '19

AS397031 here, located in Telehouse (7 Teleport). We picked up a port on NYIIX specifically to peer with google and cloudflare. We were doing around 6gbps inbound from google over the NYIIX for some time then without warning google withdrew routes from us, I'm guessing because too much bandwidth over an IIX and they prefer a private interconnect at that point. So we requested to peer with them via a PNI and were denied, saying they can't do that either as they're not located in any Telehouse buildings. So I'm left with no Google peering A 10gb wave from where we are to the nearest google peering point is basically the same cost as 10gbps from HE, so trying to figure out my best options here. Open to suggestions! Ideally we would love to peer with google again over NYIIX if possible. -- Jon Sands MFI Labs https://fohdeesha.com/

2 3

Facebook launches alerts for local first responders
by Sean Donelan 27 Aug '19

27 Aug '19

Facebook announced its new Local Alerts feature. Potential uses include storm warnings and advisories for extreme temperatures, evacuations, road closures, active shooter situations, bomb threats, missing person reports, water main breaks and more. The aim is to keep its users “safe and in-the-know.” https://www.washingtonpost.com/weather/2019/08/27/facebook-launching-local-… The Facebook Local Alerts appears to be a closed, walled-garden system, requiring local emergency managers to setup and maintain Facebook accounts. Emergency managers have used multiple social media platforms for several years, but its always a bit hit&miss reaching the public using different platforms. Smart assistants like Alexia, Google Assistant, Apple Siri or streaming services like Netflix and Hulu don't don't proactively provide local emergency alerts like Cable, TV and radio broadcasters. If you need to ask Alexa if there is a tornado warning, you probably already know there is a tornado.

1 0

IP Route Hijacking Bad Actor: AS57129/RU-SERVERSGET-KRSK, RU/Optibit LLC
by Paul Ferguson 27 Aug '19

27 Aug '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Howdy, I'm soliciting any background information, anecdotes, shared experiences, previous evidence, etc. of bad behavior and/or IP route hijacking for this 'hijack factory', as I've heard it called privately. They are actively -- and illegitimately -- announcing prefixes which are (legitimately) allocated to other organizations, a couple of them are very large & well-known U.S. healthcare providers. I'd also be interesting in hearing suggestion on the course of action one of these organizations might take to make this stop.... Thanks in advance, - - ferg - -- Paul Ferguson Seattle, WA USA -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAl1i4CEACgkQKJasdVTchbJVHAEA0s7Ej73VPQth2Rho4xwTnv8e qQFJ6SB+qulM1HFHoUgA/RXAL1BFJC3wq9GsXYJ4sqLSrje/gPm1JzVMeEJMTGlQ =r3mY -----END PGP SIGNATURE-----

2 1