February 2021 - Test - lists.nanog.org

Problems with newish IP block assignment issues from ARIN
by Justin Wilson (Lists) 09 Feb '21

09 Feb '21

Folks, Have a gremlin we have been chasing around for several months now and it’s becoming a major issue as we are getting tighter on IPV4 and needing to give some provider assigned space back. In June we received a /22 from ARIN. As is my workflow I started announcing it but waited a month while I checked out the geolocation databases for correct info, did testing ,etc. All this time our test accounts could browse web-sites, etc. We put one of the pools into production and things ran good for awhile. Then we started getting the occasional web-site was not working. After several of these we started assigning the customer an IP out of one of our other ARIN blocks and the web-site would be fine and reachable. The issue seems to reside just on this /22. We have other blocks from ARIN and they are just fine. We can assign an IP out of this new block and can’t reach certain web-sites. We turn around and assign out of another block and web-site works just fine. We have two upstreams and an IX on this network. We have tried withdrawing the route on this particular /22 and isolating to one upstream alone and the problems still persist. Many of the web-sites in question are government (both state and local), online universities, and the occasional local news station. They are diverse enough to not be traced down to a common point, except the IP block. We announce the IP block via BGP the same exact way we announce the other blocks. Traceroutes show the path going the same way no matter what IP block the customer has. It acts like the IP block was blacklisted at some point and got on some bad lists but I don’t want ti limit myself to that theory. I have opened up a ticket with ARIN asking for any guidance. Has anyone ran into this with new space assigned? Any tools, sites, etc. I can use to do further troubleshooting. The IP block does not appear to have any blacklisted IPs according to MX toolbox, and some others. The block in question is 134.195.44.0/22. It has been RPKI certified and has IRR entries. Thanks in advance Justin Wilson j2sw(a)mtin.net — https://j2sw.com - All things jsw (AS209109) https://blog.j2sw.com - Podcast and Blog

8 9

Retalitory DDoS
by Mike Hammett 08 Feb '21

08 Feb '21

Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

5 10

Internet Routing Registry folks - Important - (Fwd: [arin-announce] Consultation Now Open on the Future of ARIN’s IRR)
by John Curran 08 Feb '21

08 Feb '21

NANOGers - If you make use of ARIN’s unauthenticated IRR service or the NONAUTH data stream in your route filtering, please take note of the following ARIN consultation. Thanks! /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] Consultation Now Open on the Future of ARIN’s IRR Date: 8 February 2021 at 10:46:18 AM EST To: "arin-announce(a)arin.net<mailto:arin-announce@arin.net>" <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> ARIN has been engaged in a multi-year project to create and deploy a new and improved Internet Routing Registry (IRR). On 10 June 2020 (https://www.arin.net/announcements/20200610-irr/) we launched IRR-online, an authenticated and web-based service designed to make it simple for users to publish routing information via ARIN’s website. At that time, the existing IRR-email system was temporarily left in place to allow organizations to continue using email-based updates to publish routing information (in the ARIN-NONAUTH data stream). On 1 February 2021 (https://www.arin.net/announcements/20210201-rn/) we deployed a RESTful API to provide a way to securely automate updates to objects in ARIN’s authenticated IRR service. With the availability of automation for ARIN’s new IRR system, we intend to retire ARIN’s previous non-authenticated, email-based IRR service at the end of September 2021. We are providing advance notice of this plan so that organizations using the non-authenticated and email-based IRR will have time to switch publication of their routing registry information to a more current solution. Similarly, by establishing a firm end date for the non-authenticated and email-based IRR, organizations making use of the outdated and non-authenticated IRR data stream can be ready for when ARIN ceases publishing the ARIN-NONAUTH data stream. The authenticated IRR is available to all ARIN resource holders that have resources covered by a signed Registration Services Agreement (RSA) or Legacy Registration Services Agreement (LRSA). Organizations with resources not currently under an RSA/LRSA that wish to use the authenticated IRR may contact ARIN’s Registration Services Department for assistance with bringing those registrations under an RSA/LRSA. We recognize that this change will have significant impacts on our customers and, as always, we’re interested in your feedback regarding this proposed transition. In particular, we would appreciate hearing from the ARIN community regarding these aspects of the proposed transition: 1. For those using ARIN’s email-based and non-authenticated IRR system, does the proposed shutdown date of 30 September 2021 provide sufficient time for migration to another IRR system? 2. For those making use of the ARIN-NONAUTH data stream, is there any reason to provide this information beyond the system shutdown date? The community feedback provided during this consultation will help inform how we move forward. Please provide comments to arin-consult(a)arin.net<mailto:arin-consult@arin.net>. You can subscribe to this mailing list at: http://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on Monday, 8 March. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN)

2 4

Re: [EXTERNAL] Re: Retalitory DDoS
by Compton, Rich A 08 Feb '21

08 Feb '21

FYI, that looks like a Web Services Dynamic Discovery UDP amplification DDoS attack. https://blogs.akamai.com/sitr/2019/09/new-ddos-vector-observed-in-the-wild-… Very easily executed by a booter service. You may want to have your hosting provider block all inbound traffic from reaching your server IP except TCP port 443 (or 80 or whatever port you actually use) somewhere upstream. This can help reduce the impact of DDoS attacks on your server. -Rich From: NANOG <nanog-bounces+rich.compton=charter.com(a)nanog.org> on behalf of Mike Hammett <nanog(a)ics-il.net> Date: Monday, February 8, 2021 at 10:58 AM To: Jean St-Laurent <jean(a)ddostest.me> Cc: NANOG list <nanog(a)nanog.org> Subject: [EXTERNAL] Re: Retalitory DDoS CAUTION: The e-mail below is from an external source. Please exercise caution before opening attachments, clicking links, or following guidance. I don't have RTBH, no. It's just a web server. Now how my hosting provider handled it, I'm not sure. I don't know if they just dropped me internally, or if they used RTBH with their upstreams and peers. Only being 2.5 gigs, that should be well within their ability to handle internally, but I guess why would you if you didn't have to? ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Jean St-Laurent" <jean(a)ddostest.me> To: "Mike Hammett" <nanog(a)ics-il.net> Cc: "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 11:53:43 AM Subject: RE: Retalitory DDoS You got RTBH? From: Mike Hammett <nanog(a)ics-il.net> Sent: February 8, 2021 12:50 PM To: Jean St-Laurent <jean(a)ddostest.me> Cc: NANOG list <nanog(a)nanog.org> Subject: Re: Retalitory DDoS In my case, it was against a server not on my own network, so my impact was a blackhole for an hour at 4 AM local time. I likely wouldn't have even noticed it, had I not received the threat email, nor the ticket my web host's NOC opened. ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Jean St-Laurent" <jean(a)ddostest.me> To: "Mike Hammett" <nanog(a)ics-il.net>, "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 11:42:12 AM Subject: RE: Retalitory DDoS Nice report, If you would have to pick up just one vector out of this “multi-vector” attack, which one seems to be the one that had the bigger effect on your network or service? Was it degraded or total service interruption? Jean From: NANOG <nanog-bounces+jean=ddostest.me(a)nanog.org> On Behalf Of Mike Hammett Sent: February 8, 2021 8:43 AM To: NANOG list <nanog(a)nanog.org> Subject: Re: Retalitory DDoS Mike, I've attached the full information we got from our DDOS protection system below. We had a large number of ping loss and data loss tickets begin opening up for devices sharing the cabinet chi18-313. The high traffic and interference was determined to be caused by incoming traffic to the ip address [Not hard to find, but redacted anyway]. Our network engineers will be back in after 9am until 5pm CST. They have greater access to the network and may be able to give you more details. Location : Chicago Event Time : 2021-02-08 04:17:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 2520 Mbps 382880 pps Fragmentation : 11% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 100% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 61% Port # 3702 . 38% Port # 0 Top Destination Port: . 38% Port # 0 . 14% Port # 45934 . 9% Port # 23680 . 8% Port # 35023 . 7% Port # 25966 Top Source IP: . 0% 112.164.127.17 Number of unique IP: 7110 Total Bytes : 1259961437<callto:1259961437> Total Packets : 1531559 Duration : 4s Report Run Time : 151.3ms The 30 day null route count is: 0 Number of hours to null route : 1 Location : Chicago Event Time : 2021-02-08 04:02:38 CST (-0600) Destination IP: [Not hard to find, but redacted anyway] Traffic : 1817 Mbps 275483 pps Fragmentation : 13% Top Transport Protocol: . 99% Protocol # 17 (UDP) TCP Flag: SYN: 99% ACK: 0% RST: 0% FIN: 0% Top Source Port: . 56% Port # 3702 . 43% Port # 0 Top Destination Port: . 43% Port # 0 . 19% Port # 25966 . 19% Port # 35023 . 17% Port # 23680 Top Source IP: . 0% 90.49.167.239 Number of unique IP: 3577 Total Bytes : 953894831 Total Packets : 1157017 Duration : 4.199s Report Run Time : 306.8ms The 30 day null route count is: 0 Number of hours to null route : 1 Liam Doring Systems Administrator ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Mike Hammett" <nanog(a)ics-il.net> To: "NANOG list" <nanog(a)nanog.org> Sent: Monday, February 8, 2021 5:46:26 AM Subject: Retalitory DDoS Is there a club for people that have been DDoSed? If so, count me in. This one was directed at me (as opposed to one of my customers) because I got an e-mail explaining why I was getting DDoSed. Is that aspect common? There were also some racial and sexual accusations that were made that clearly aren't true and just speak to the intelligence of people like this. Is it safe to assume that they completely anonymized the email they sent to me? Is there anyone I should be reporting this to? I thought my site was running in Cloudflare, but my individual server was still attacked, so I gotta figure out where I screwed that up. https://www.dropbox.com/s/rrrx90jvy09h26s/ICS%20DDoS.png?dl=0 ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [Image removed by sender.]<https://www.facebook.com/ICSIL>[Image removed by sender.]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[Image removed by sender.]<https://www.linkedin.com/company/intelligent-computing-solutions>[Image removed by sender.]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [Image removed by sender.]<https://www.facebook.com/mdwestix>[Image removed by sender.]<https://www.linkedin.com/company/midwest-internet-exchange>[Image removed by sender.]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [Image removed by sender.]<https://www.facebook.com/thebrotherswisp>[Image removed by sender.]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

3 2

Spoofer Report for NANOG for Jan 2021
by CAIDA Spoofer Project 08 Feb '21

08 Feb '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Jan 2021: ASN Name Fixed-By 54825 PACKET 2021-01-12 7859 PAIR-NETWORKS 2021-01-31 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jan 2021: ASN Name First-Spoofed Last-Spoofed 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2021-01-25 7459 GRANDECOM-AS1 2016-09-26 2021-01-28 20412 CLARITY-TELECOM 2016-09-30 2021-01-31 6181 FUSE-NET 2016-10-10 2021-01-31 14971 PINETEL 2016-10-21 2021-01-30 11427 TWC-11427-TEXAS 2016-10-21 2021-01-27 30036 MEDIACOM-ENTERPRISE-BUSINESS 2016-11-16 2021-01-29 63296 AWBROADBAND 2017-09-01 2021-01-27 12222 AKAMAI 2018-02-14 2021-01-14 393564 SPOKANE 2018-06-05 2021-01-26 33452 RW 2018-09-19 2021-01-30 20448 VPNTRANET-LLC 2018-09-20 2021-01-28 8047 GCI 2019-04-11 2021-01-29 6391 URBAN-15 2020-05-29 2021-01-09 11814 DISTRIBUTEL-AS11814 2020-11-22 2021-01-16 208188 PUGET-SOUND-NETWORKS 2020-12-04 2021-01-30 13886 CLOUD-SOUTH 2021-01-05 2021-01-05 33749 ATMC 2021-01-05 2021-01-05 7885 YUKONCOLLEGE 2021-01-14 2021-01-22 53703 KWIKOM 2021-01-17 2021-01-26 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Merhaba
by M. Omer GOLGELI 06 Feb '21

06 Feb '21

Selamlar M. Omer GOLGELI --- AS202365 https://as202365.peeringdb.com https://bgp.he.net/AS202365 NOC: Phone: +90-533-2600533 Email: omer(a)chronos.com.tr

1 0

Suspicious IP reporting
by JoeSox 05 Feb '21

05 Feb '21

This IP is hitting devices on cellular networks for the past day or so. https://www.abuseipdb.com/whois/79.124.62.86 I think this is the info to report it to the ISP. Any help or if everyone can report it, I would be a happy camper. abuse(a)4cloud.mobi; abuse(a)fiberinternet.bg https://en.asytech.cn/check-ip/79.124.62.25#gsc.tab=0 -- Thank You, Joe

8 17

Comcast routine maintenance.
by Andrey Khomyakov 05 Feb '21

05 Feb '21

Who thought that doing a routine maintenance that covers a whole business day during a pandemic stay at home order was a better option than doing it, say, I don’t know, at midnight on Sunday for example? This is the message right now on Comcast status webpage “Internet unavailable We're currently performing routine system maintenance. This may cause an interruption to your service. We began work on 02/05/2021 09:42 AM (Pacific), and this is expected to end on 02/05/2021 03:30 PM (Pacific). We appreciate your patience.”

2 1

Paris Dark Fiber Providers
by Rod Beck 05 Feb '21

05 Feb '21

Please contact off list. Looking to understand the competitive landscape. I used to live there, but it was over ten years ago. Particularly in commercial flexible and nimble players with unique physical assets like rights of way diverse to the usual suspects. Best, Roderick. Roderick Beck Global Network Capacity Sourcing United Cable Company https://unitedcablecompany.com/video/ www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com Budapest: 36-70-605-5144 NJ: 908-452-8183 [1467221477350_image005.png]

1 0

Weekly Routing Table Report
by cscora＠apnic.net 05 Feb '21

05 Feb '21

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 06 Feb, 2021 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 844686 Prefixes after maximum aggregation (per Origin AS): 322012 Deaggregation factor: 2.62 Unique aggregates announced (without unneeded subnets): 401655 Total ASes present in the Internet Routing Table: 70445 Prefixes per ASN: 11.99 Origin-only ASes present in the Internet Routing Table: 60620 Origin ASes announcing only one prefix: 25030 Transit ASes present in the Internet Routing Table: 9825 Transit-only ASes present in the Internet Routing Table: 301 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 62 Max AS path prepend of ASN (266299) 59 Prefixes from unregistered ASNs in the Routing Table: 881 Number of instances of unregistered ASNs: 887 Number of 32-bit ASNs allocated by the RIRs: 34957 Number of 32-bit ASNs visible in the Routing Table: 29011 Prefixes from 32-bit ASNs in the Routing Table: 135484 Number of bogon 32-bit ASNs visible in the Routing Table: 27 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 619 Number of addresses announced to Internet: 2910601856 Equivalent to 173 /8s, 124 /16s and 66 /24s Percentage of available address space announced: 78.6 Percentage of allocated address space announced: 78.6 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 288192 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 221527 Total APNIC prefixes after maximum aggregation: 65515 APNIC Deaggregation factor: 3.38 Prefixes being announced from the APNIC address blocks: 217308 Unique aggregates announced from the APNIC address blocks: 88038 APNIC Region origin ASes present in the Internet Routing Table: 11245 APNIC Prefixes per ASN: 19.32 APNIC Region origin ASes announcing only one prefix: 3214 APNIC Region transit ASes present in the Internet Routing Table: 1588 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 30 Number of APNIC region 32-bit ASNs visible in the Routing Table: 6395 Number of APNIC addresses announced to Internet: 770416128 Equivalent to 45 /8s, 235 /16s and 158 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-143673 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 243213 Total ARIN prefixes after maximum aggregation: 112211 ARIN Deaggregation factor: 2.17 Prefixes being announced from the ARIN address blocks: 243808 Unique aggregates announced from the ARIN address blocks: 116192 ARIN Region origin ASes present in the Internet Routing Table: 18713 ARIN Prefixes per ASN: 13.03 ARIN Region origin ASes announcing only one prefix: 6810 ARIN Region transit ASes present in the Internet Routing Table: 1906 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 25 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3697 Number of ARIN addresses announced to Internet: 1147742464 Equivalent to 68 /8s, 105 /16s and 41 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 241543 Total RIPE prefixes after maximum aggregation: 112276 RIPE Deaggregation factor: 2.15 Prefixes being announced from the RIPE address blocks: 237513 Unique aggregates announced from the RIPE address blocks: 138684 RIPE Region origin ASes present in the Internet Routing Table: 27688 RIPE Prefixes per ASN: 8.58 RIPE Region origin ASes announcing only one prefix: 11891 RIPE Region transit ASes present in the Internet Routing Table: 3886 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 9900 Number of RIPE addresses announced to Internet: 710007936 Equivalent to 42 /8s, 81 /16s and 220 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 112379 Total LACNIC prefixes after maximum aggregation: 26364 LACNIC Deaggregation factor: 4.26 Prefixes being announced from the LACNIC address blocks: 113519 Unique aggregates announced from the LACNIC address blocks: 48246 LACNIC Region origin ASes present in the Internet Routing Table: 10652 LACNIC Prefixes per ASN: 10.66 LACNIC Region origin ASes announcing only one prefix: 2616 LACNIC Region transit ASes present in the Internet Routing Table: 2001 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 62 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8251 Number of LACNIC addresses announced to Internet: 174110208 Equivalent to 10 /8s, 96 /16s and 182 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-272796 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 25141 Total AfriNIC prefixes after maximum aggregation: 4928 AfriNIC Deaggregation factor: 5.10 Prefixes being announced from the AfriNIC address blocks: 31919 Unique aggregates announced from the AfriNIC address blocks: 9922 AfriNIC Region origin ASes present in the Internet Routing Table: 1445 AfriNIC Prefixes per ASN: 22.09 AfriNIC Region origin ASes announcing only one prefix: 498 AfriNIC Region transit ASes present in the Internet Routing Table: 288 Average AfriNIC Region AS path length visible: 5.2 Max AfriNIC Region AS path length visible: 31 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 768 Number of AfriNIC addresses announced to Internet: 107872512 Equivalent to 6 /8s, 110 /16s and 1 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 5702 777 662 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4749 4192 74 ERX-CERNET-BKB China Education and Rese 7552 3533 1330 19 VIETEL-AS-AP Viettel Group, VN 7713 3222 935 524 TELKOMNET-AS-AP PT Telekomunikasi Indon 9808 3176 9045 60 CMNET-GD Guangdong Mobile Communication 45899 2886 1896 55 VNPT-AS-VN VNPT Corp, VN 4766 2450 11105 570 KIXS-AS-KR Korea Telecom, KR 9498 2306 482 231 BBIL-AP BHARTI Airtel Ltd., IN 4755 2137 441 190 TATACOMM-AS TATA Communications formerl 45090 2080 1045 63 CNNIC-TENCENT-NET-AP Shenzhen Tencent C Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 4807 9092 2163 AMAZON-02, US 11492 4681 311 843 CABLEONE, US 7155 4036 264 32 VIASAT-SP-BACKBONE, US 22773 3833 2995 231 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3331 1317 72 SHAW, CA 16625 3262 1706 2327 AKAMAI-AS, US 209 2522 5058 506 CENTURYLINK-US-LEGACY-QWEST, US 30036 2506 370 134 MEDIACOM-ENTERPRISE-BUSINESS, US 5650 2355 3000 1642 FRONTIER-FRTR, US 5972 2180 437 776 DNIC-ASBLK-05800-06055, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 47331 8060 1085 3249 TTNET, TR 12479 6282 1700 146 UNI2-AS, ES 39891 3459 195 22 ALJAWWALSTC-AS, SA 20940 3403 3347 207 AKAMAI-ASN1, NL 8551 3216 379 41 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2875 2282 890 ROSTELECOM-AS, RU 9009 2323 234 1254 M247, GB 34984 2175 354 581 TELLCOM-AS, TR 13188 1611 100 23 TRIOLAN, UA 58224 1508 870 551 TCI, IR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8200 3405 593 Uninet S.A. de C.V., MX 10620 3398 526 617 Telmex Colombia S.A., CO 11830 2562 369 63 Instituto Costarricense de Electricidad 13999 1625 432 422 Mega Cable, S.A. de C.V., MX 7303 1439 913 262 Telecom Argentina S.A., AR 6503 1437 311 475 Axtel, S.A.B. de C.V., MX 28573 1374 2259 219 CLARO S.A., BR 6147 1158 379 39 Telefonica del Peru S.A.A., PE 3816 1144 563 143 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11664 996 211 414 Techtel LMDS Comunicaciones Interactiva Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1579 393 21 LINKdotNET-AS, EG 24835 1293 484 28 RAYA-AS, EG 36992 1185 1537 169 ETISALAT-MISR, EG 36903 978 510 101 MT-MPLS, MA 29571 702 68 11 ORANGE-COTE-IVOIRE, CI 6713 533 1863 34 IAM-AS, MA 36935 487 522 40 Vodafone-, EG 37342 486 32 1 MOVITEL, MZ 15399 483 46 18 WANANCHI-, KE 23889 454 232 16 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8200 3405 593 Uninet S.A. de C.V., MX 47331 8060 1085 3249 TTNET, TR 12479 6282 1700 146 UNI2-AS, ES 7545 5702 777 662 TPG-INTERNET-AP TPG Telecom Limited, AU 16509 4807 9092 2163 AMAZON-02, US 4538 4749 4192 74 ERX-CERNET-BKB China Education and Rese 11492 4681 311 843 CABLEONE, US 7155 4036 264 32 VIASAT-SP-BACKBONE, US 22773 3833 2995 231 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3533 1330 19 VIETEL-AS-AP Viettel Group, VN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 6282 6136 UNI2-AS, ES 7545 5702 5040 TPG-INTERNET-AP TPG Telecom Limited, AU 47331 8060 4811 TTNET, TR 4538 4749 4675 ERX-CERNET-BKB China Education and Research Net 7155 4036 4004 VIASAT-SP-BACKBONE, US 11492 4681 3838 CABLEONE, US 22773 3833 3602 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3533 3514 VIETEL-AS-AP Viettel Group, VN 39891 3459 3437 ALJAWWALSTC-AS, SA 6327 3331 3259 SHAW, CA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 174 COGENT-174, US 18604 UNALLOCATED 8.25.204.0/24 3356 LEVEL3, US 32985 UNALLOCATED 8.28.31.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 46766 UNALLOCATED 8.44.208.0/24 3356 LEVEL3, US 40544 UNALLOCATED 12.0.33.0/24 6461 ZAYO-6461, US 393489 UNALLOCATED 12.7.109.0/24 7018 ATT-INTERNET4, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.141.0.0/24 Origin: 395350 UNASSIGNED Transit: 11426 TWC-11426-CAROLINAS, US 23.142.80.0/24 Origin: 397881 STINGERS, US Transit: 398481 REDMERCURY, US 23.226.240.0/20 Origin: 40430 UNASSIGNED Transit: 174 COGENT-174, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:11 /9:12 /10:40 /11:102 /12:293 /13:580 /14:1183 /15:1934 /16:13481 /17:8299 /18:13816 /19:25675 /20:41641 /21:50911 /22:105018 /23:89450 /24:490778 /25:1462 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 47331 7202 8060 TTNET, TR 12479 5245 6282 UNI2-AS, ES 11492 3765 4681 CABLEONE, US 6327 3136 3331 SHAW, CA 7155 3124 4036 VIASAT-SP-BACKBONE, US 22773 2911 3833 ASN-CXA-ALL-CCI-22773-RDC, US 8151 2805 8200 Uninet S.A. de C.V., MX 39891 2801 3459 ALJAWWALSTC-AS, SA 8551 2681 3216 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 30036 2228 2506 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1877 2:1194 3:88 4:25 5:3585 6:64 7:5 8:1490 9:1 11:36 12:1754 13:355 14:2438 15:74 16:15 17:313 18:94 20:115 22:188 23:4315 24:2373 25:3 27:2380 31:2194 32:112 34:2 35:39 36:1139 37:3629 38:2040 39:482 40:150 41:3901 42:895 43:2094 44:231 45:14850 46:3631 47:320 49:1612 50:1699 51:104 52:1203 54:218 55:779 56:6 57:57 58:1690 59:1163 60:820 61:2365 62:2224 63:1989 64:5233 65:2401 66:5135 67:2926 68:1169 69:4074 70:1399 71:687 72:3236 74:2576 75:1473 76:694 77:2015 78:3704 79:2464 80:1781 81:1641 82:1305 83:1116 84:1255 85:3280 86:647 87:1795 88:2825 89:3062 90:393 91:7251 92:1626 93:2524 94:2951 95:4444 96:1213 97:343 98:977 99:978 100:91 101:1041 102:1283 103:25260 104:3651 105:417 106:723 107:2199 108:675 109:3835 110:1998 111:2378 112:1760 113:1687 114:1427 115:1869 116:1893 117:2198 118:2303 119:1932 120:945 121:1082 122:2306 123:2173 124:1642 125:2158 128:1307 129:1177 130:797 131:2028 132:758 133:320 134:1557 135:288 136:716 137:891 138:2280 139:1163 140:742 141:1163 142:1060 143:1249 144:1217 145:327 146:1388 147:1221 148:2210 149:1256 150:748 151:1202 152:1552 153:455 154:2148 155:1276 156:1423 157:1165 158:925 159:2025 160:2048 161:1096 162:3238 163:987 164:1433 165:1302 166:597 167:1774 168:3557 169:645 170:4366 171:757 172:2059 173:2937 174:974 175:1065 176:2954 177:4395 178:2861 179:1868 180:2275 181:2612 182:3166 183:1668 184:2456 185:17812 186:4122 187:3051 188:3279 189:2745 190:9074 191:1374 192:10650 193:7921 194:6471 195:4628 196:3024 197:2342 198:6005 199:5969 200:7401 201:5293 202:10508 203:10114 204:4641 205:3264 206:3438 207:3317 208:3999 209:4599 210:4228 211:2172 212:3600 213:3284 214:1199 215:62 216:6162 217:2522 218:1019 219:681 220:2072 221:944 222:983 223:1746 End of report

1 0