April 2021 - Test - lists.nanog.org

Submitting Fake Geolocation for blocks to Data Brokers and RIRs
by nanoguser100 23 Apr '21

23 Apr '21

I wanted to get the communities' opinion on this. I am an admin for a quasi-ISP providing cloud hosted desktop solutions for end users. We have POPs all around the world, own our own ASN, and advertise /24s or /23s at each of our POPs fro our large aggregate. As an ISP we submit our blocks to popular geolocation vendors such as Google, Maxmind, IP2, etc and put the proper geolocations in our RIR records (RADB, ARIN, etc). Increasingly I have run into 'niche needs' where a client has a few users in a country we don't have a POP, say Estonia. This is 'mainly' for localization but also in some cases for compliance (some sites REQUIRE an Estonian IP). With that being said is it common practice to 'fake' Geolocations? In this case the user legitimately lives in Estonia, they just happen to be using our cloud service in Germany. I do want to operate in compliance with all the ToS as I don't want to risk our ranges getting blacklisted or the geo vendors stop accepting our data. I would think it's pretty easy to tell given a traceroute would end in Germany even though you're claiming the IP is in Estonia. How common of a practice is it to 'fake' the geos? Is it an acceptable practice? Sent with [ProtonMail](https://protonmail.com) Secure Email.

12 16

Weekly Routing Table Report
by cscora＠apnic.net 23 Apr '21

23 Apr '21

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 24 Apr, 2021 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 857293 Prefixes after maximum aggregation (per Origin AS): 324456 Deaggregation factor: 2.64 Unique aggregates announced (without unneeded subnets): 406443 Total ASes present in the Internet Routing Table: 71149 Prefixes per ASN: 12.05 Origin-only ASes present in the Internet Routing Table: 61197 Origin ASes announcing only one prefix: 25304 Transit ASes present in the Internet Routing Table: 9952 Transit-only ASes present in the Internet Routing Table: 318 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 38 Max AS path prepend of ASN ( 37385) 33 Prefixes from unregistered ASNs in the Routing Table: 1013 Number of instances of unregistered ASNs: 1024 Number of 32-bit ASNs allocated by the RIRs: 35805 Number of 32-bit ASNs visible in the Routing Table: 29816 Prefixes from 32-bit ASNs in the Routing Table: 138622 Number of bogon 32-bit ASNs visible in the Routing Table: 26 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 497 Number of addresses announced to Internet: 3031282560 Equivalent to 180 /8s, 173 /16s and 179 /24s Percentage of available address space announced: 81.9 Percentage of allocated address space announced: 81.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 291090 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 226990 Total APNIC prefixes after maximum aggregation: 65614 APNIC Deaggregation factor: 3.46 Prefixes being announced from the APNIC address blocks: 223063 Unique aggregates announced from the APNIC address blocks: 89596 APNIC Region origin ASes present in the Internet Routing Table: 11532 APNIC Prefixes per ASN: 19.34 APNIC Region origin ASes announcing only one prefix: 3302 APNIC Region transit ASes present in the Internet Routing Table: 1622 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 30 Number of APNIC region 32-bit ASNs visible in the Routing Table: 6680 Number of APNIC addresses announced to Internet: 771997952 Equivalent to 46 /8s, 3 /16s and 193 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-143673 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 246095 Total ARIN prefixes after maximum aggregation: 113015 ARIN Deaggregation factor: 2.18 Prefixes being announced from the ARIN address blocks: 246524 Unique aggregates announced from the ARIN address blocks: 117903 ARIN Region origin ASes present in the Internet Routing Table: 18782 ARIN Prefixes per ASN: 13.13 ARIN Region origin ASes announcing only one prefix: 6813 ARIN Region transit ASes present in the Internet Routing Table: 1950 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 29 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3832 Number of ARIN addresses announced to Internet: 1264127744 Equivalent to 75 /8s, 89 /16s and 15 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 244552 Total RIPE prefixes after maximum aggregation: 113812 RIPE Deaggregation factor: 2.15 Prefixes being announced from the RIPE address blocks: 240539 Unique aggregates announced from the RIPE address blocks: 141455 RIPE Region origin ASes present in the Internet Routing Table: 27905 RIPE Prefixes per ASN: 8.62 RIPE Region origin ASes announcing only one prefix: 11992 RIPE Region transit ASes present in the Internet Routing Table: 3888 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 38 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10142 Number of RIPE addresses announced to Internet: 711050880 Equivalent to 42 /8s, 97 /16s and 198 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 112705 Total LACNIC prefixes after maximum aggregation: 26332 LACNIC Deaggregation factor: 4.28 Prefixes being announced from the LACNIC address blocks: 113867 Unique aggregates announced from the LACNIC address blocks: 46980 LACNIC Region origin ASes present in the Internet Routing Table: 10738 LACNIC Prefixes per ASN: 10.60 LACNIC Region origin ASes announcing only one prefix: 2702 LACNIC Region transit ASes present in the Internet Routing Table: 2025 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 33 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8361 Number of LACNIC addresses announced to Internet: 176082944 Equivalent to 10 /8s, 126 /16s and 208 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-272796 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 25937 Total AfriNIC prefixes after maximum aggregation: 4937 AfriNIC Deaggregation factor: 5.25 Prefixes being announced from the AfriNIC address blocks: 32803 Unique aggregates announced from the AfriNIC address blocks: 10059 AfriNIC Region origin ASes present in the Internet Routing Table: 1457 AfriNIC Prefixes per ASN: 22.51 AfriNIC Region origin ASes announcing only one prefix: 495 AfriNIC Region transit ASes present in the Internet Routing Table: 297 Average AfriNIC Region AS path length visible: 5.2 Max AfriNIC Region AS path length visible: 38 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 801 Number of AfriNIC addresses announced to Internet: 107602432 Equivalent to 6 /8s, 105 /16s and 226 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 6346 8996 55 CMNET-GD Guangdong Mobile Communication 7545 5732 783 669 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4754 4192 74 ERX-CERNET-BKB China Education and Rese 7713 3523 1023 56 TELKOMNET-AS-AP PT Telekomunikasi Indon 7552 3482 1330 20 VIETEL-AS-AP Viettel Group, VN 45899 2901 1896 54 VNPT-AS-VN VNPT Corp, VN 4766 2434 11104 565 KIXS-AS-KR Korea Telecom, KR 9498 2336 481 236 BBIL-AP BHARTI Airtel Ltd., IN 4755 2119 441 191 TATACOMM-AS TATA Communications formerl 45090 2098 1197 72 CNNIC-TENCENT-NET-AP Shenzhen Tencent C Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 5030 9345 2242 AMAZON-02, US 11492 4752 315 712 CABLEONE, US 7155 4030 264 32 VIASAT-SP-BACKBONE, US 22773 3935 3005 249 ASN-CXA-ALL-CCI-22773-RDC, US 16625 3430 1767 2427 AKAMAI-AS, US 6327 3360 1317 69 SHAW, CA 30036 2559 373 127 MEDIACOM-ENTERPRISE-BUSINESS, US 209 2531 5037 484 CENTURYLINK-US-LEGACY-QWEST, US 5650 2345 2997 1640 FRONTIER-FRTR, US 5972 2231 451 784 DNIC-ASBLK-05800-06055, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 47331 7796 1045 3498 TTNET, TR 12479 6489 1725 144 UNI2-AS, ES 20940 3579 3347 204 AKAMAI-ASN1, NL 8551 3351 379 41 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 39891 3266 187 22 ALJAWWALSTC-AS, SA 12389 2908 2284 898 ROSTELECOM-AS, RU 9009 2413 247 1290 M247, GB 34984 2216 357 586 TELLCOM-AS, TR 13188 1610 100 31 TRIOLAN, UA 58224 1580 883 574 TCI, IR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8518 3474 575 Uninet S.A. de C.V., MX 10620 3412 526 615 Telmex Colombia S.A., CO 11830 2494 369 62 Instituto Costarricense de Electricidad 7303 1899 2063 72 Telecom Argentina S.A., AR 13999 1672 447 424 Mega Cable, S.A. de C.V., MX 6503 1443 311 475 Axtel, S.A.B. de C.V., MX 28573 1386 2276 224 CLARO S.A., BR 3816 1229 644 147 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1130 377 39 Telefonica del Peru S.A.A., PE 11664 1002 212 400 Techtel LMDS Comunicaciones Interactiva Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1586 393 22 LINKdotNET-AS, EG 24835 1443 486 27 RAYA-AS, EG 36992 1202 1537 176 ETISALAT-MISR, EG 36903 1181 536 114 MT-MPLS, MA 29571 731 68 11 ORANGE-COTE-IVOIRE, CI 6713 549 1863 34 IAM-AS, MA 36935 517 522 40 Vodafone-, EG 37342 487 32 1 MOVITEL, MZ 15399 483 48 24 WANANCHI-, KE 23889 439 232 16 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8518 3474 575 Uninet S.A. de C.V., MX 47331 7796 1045 3498 TTNET, TR 12479 6489 1725 144 UNI2-AS, ES 9808 6346 8996 55 CMNET-GD Guangdong Mobile Communication 7545 5732 783 669 TPG-INTERNET-AP TPG Telecom Limited, AU 16509 5030 9345 2242 AMAZON-02, US 4538 4754 4192 74 ERX-CERNET-BKB China Education and Rese 11492 4752 315 712 CABLEONE, US 7155 4030 264 32 VIASAT-SP-BACKBONE, US 22773 3935 3005 249 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 6489 6345 UNI2-AS, ES 9808 6346 6291 CMNET-GD Guangdong Mobile Communication Co.Ltd. 7545 5732 5063 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4754 4680 ERX-CERNET-BKB China Education and Research Net 47331 7796 4298 TTNET, TR 11492 4752 4040 CABLEONE, US 7155 4030 3998 VIASAT-SP-BACKBONE, US 22773 3935 3686 ASN-CXA-ALL-CCI-22773-RDC, US 7713 3523 3467 TELKOMNET-AS-AP PT Telekomunikasi Indonesia, ID 7552 3482 3462 VIETEL-AS-AP Viettel Group, VN Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 18604 UNALLOCATED 8.25.204.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 46766 UNALLOCATED 8.44.208.0/24 3356 LEVEL3, US 40544 UNALLOCATED 12.0.33.0/24 6461 ZAYO-6461, US 46505 UNALLOCATED 12.7.131.0/24 7018 ATT-INTERNET4, US 15132 UNALLOCATED 12.9.150.0/24 1239 SPRINTLINK, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.141.0.0/24 Origin: 395350 UNASSIGNED Transit: 11426 TWC-11426-CAROLINAS, US 23.142.80.0/24 Origin: 398481 REDMERCURY, US Transit: 209319 IPV6ROUTING, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:41 /11:103 /12:297 /13:586 /14:1193 /15:1947 /16:13532 /17:8334 /18:13883 /19:25773 /20:42564 /21:51465 /22:106771 /23:91238 /24:498129 /25:1408 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 47331 6976 7796 TTNET, TR 12479 5442 6489 UNI2-AS, ES 11492 3803 4752 CABLEONE, US 6327 3168 3360 SHAW, CA 7155 3118 4030 VIASAT-SP-BACKBONE, US 8151 3084 8518 Uninet S.A. de C.V., MX 22773 2964 3935 ASN-CXA-ALL-CCI-22773-RDC, US 8551 2815 3351 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 39891 2801 3266 ALJAWWALSTC-AS, SA 30036 2234 2559 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1882 2:1107 3:111 4:19 5:3527 6:65 7:5 8:1502 9:1 11:36 12:1748 13:362 14:2303 15:76 16:15 17:320 18:93 20:128 22:188 23:4654 24:2386 25:2 27:2524 29:19 31:2326 32:113 34:2 35:40 36:1318 37:3762 38:2068 39:610 40:160 41:3863 42:926 43:2118 44:239 45:14968 46:3704 47:319 49:1615 50:1773 51:92 52:1236 54:223 55:755 56:8 57:58 58:1716 59:1206 60:889 61:2365 62:2224 63:1959 64:5286 65:2382 66:5159 67:2860 68:1154 69:4075 70:1399 71:690 72:3182 74:2587 75:1486 76:685 77:2031 78:3697 79:2490 80:1867 81:1651 82:1361 83:1122 84:1271 85:3381 86:708 87:1781 88:2698 89:3009 90:443 91:7316 92:1750 93:2539 94:3111 95:4438 96:1268 97:345 98:990 99:969 100:92 101:1052 102:1409 103:25991 104:3739 105:435 106:725 107:2256 108:707 109:4026 110:2007 111:2940 112:1970 113:1622 114:1468 115:1891 116:1901 117:2313 118:2331 119:1900 120:1103 121:1079 122:2266 123:2209 124:1571 125:2082 128:1365 129:965 130:848 131:2036 132:753 133:356 134:1595 135:290 136:746 137:923 138:2296 139:1175 140:735 141:1190 142:1154 143:1265 144:1261 145:331 146:1412 147:1308 148:2213 149:1411 150:806 151:1079 152:1548 153:394 154:2387 155:1318 156:1495 157:1178 158:916 159:2041 160:2117 161:1142 162:3291 163:983 164:1504 165:1389 166:594 167:1772 168:3567 169:681 170:4172 171:765 172:2140 173:2946 174:988 175:1084 176:3115 177:4335 178:2899 179:1969 180:2321 181:2591 182:3207 183:1857 184:2426 185:18182 186:4203 187:3188 188:3299 189:2847 190:8848 191:1370 192:10670 193:8021 194:6592 195:4724 196:2881 197:2380 198:6057 199:6026 200:7410 201:5334 202:10571 203:10089 204:4657 205:3335 206:3557 207:3348 208:4018 209:4662 210:4236 211:2190 212:3678 213:3339 214:1229 215:61 216:6185 217:2539 218:1161 219:709 220:2089 221:977 222:965 223:1863 End of report

1 0

Cloudflare OCTO RPKI Validator - LACNIC CAs issues
by Douglas Fischer 23 Apr '21

23 Apr '21

Does anybody else have problems with Cloudflare's RPKI Validator with prefixes from LACNIC? Customers were sending us some reports of issues with LACNIC's IPBlocks using Cloudflare RPKI as source of validation. A friend and I did some checks. And looks like that some issue is happening on the Lacnic Trust Anchor, specifically on OctoRPKI. We took the Registro.Br Prefix to do the tests -> 200.160.0.0/20 -> AS22548 -> On Cloudflare https://rpki.cloudflare.com/?view=validator&validateRoute=22548_200.160.0.0… AS22548_200.160.0.0/20 is Unknown at 19:30 20201-04-22 https://pasteboard.co/JYy8fjI.png -> On Ripe https://rpki-validator.ripe.net/bgp-preview AS22548_200.160.0.0/20 is Valid at 19:30 20201-04-22 https://pasteboard.co/JYycsd4.png An interesting thing is that on the graph of ROAs over Timer of the Lacnic Trust Anchor shows a big drop on 20201/04/19. https://rpki.cloudflare.com/?ohlcTa=LACNIC "Volume Removed: 14.761" "ROAs Removed: 13.392" https://pasteboard.co/JYyeSaw.png Any idea of possible causes? Any suggestions on how to solve it? -- Douglas Fernando Fischer Engº de Controle e Automação

2 2

RE: Cloudflare OCTO RPKI Validator - LACNIC CAs issues
by Colin McIntosh 23 Apr '21

23 Apr '21

> Does anybody else have problems with Cloudflare's RPKI Validator with prefixes from LACNIC? We (Netflix) briefly saw Cloudflare's public instance of OctoRPKI missing some ~13,000 ROAs on 2021-03-24 at ~12:30pm PT while our internal instance of OctoRPKI had a complete list. Upon comparing the two lists Cloudflare's instance seemed to be missing ROAs from only LACNIC so I'm thinking we saw the same issue that you did. I haven't had a chance to really look into it and AFAIK we haven't noticed the issue since but my guess for what's happening is that OctoRPKI hits an error while downloading the ROAs from LACNIC but then continues to collect ROAs from the other RIRs resulting in an incomplete list. This seems to be the case from a quick glance at the code: https://github.com/cloudflare/cfrpki/blob/master/cmd/octorpki/octorpki.go#L… This could probably be changed to instead break out of that loop and propagate the error up to the main loop to let it continue without building an incomplete ROA list, but that's just a quick guess... it's possible that it's built this way for a reason or there may be a better way to handle that failure mode. -Colin

1 0

Re: Submitting Fake Geolocation for blocks to Data Brokers and RIRs
by nanoguser100 22 Apr '21

22 Apr '21

William, The plan is to carve out a /24 for "Estonia" and have special servers on it. This would be the same /24 I'd have to use if I were to put a legitimate POP there. This also means I don't conflict with the real Germany. I am just worried about violating the 'rules' of these providers and getting myself blacklisted from submitting corrections. Afterall the traceroute will still show us hitting a router in Germany before it hits my network. Traceroutes aren't the end all be all but it's a tell-tale sign. I guess this is all ISP-reported info so it's not "illegal" or a violation in any way. -Nanoguser100 Sent with ProtonMail Secure Email. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Wednesday, April 21, 2021 4:31 PM, William Herrin <bill(a)herrin.us> wrote: > On Wed, Apr 21, 2021 at 12:35 PM nanoguser100 > nanoguser100(a)protonmail.com wrote: > > > providing cloud hosted desktop solutions for end users. > > I missed this on the first read. Virtual Desktop along the lines of > Azure Virtual Desktop, Google VDI or Amazon Workspaces. > > I would emphasize this; it'll help folks on the group offer better information. > > > We are not a VPN per-se, it's more of a cloud hosted remote desktop service. We do have a VPN service as well which provides security services. > > That's a really interesting question. Some uses of geolocation will > give suboptimal results if you pick Estonia since the packets need to > go to Germany. Others, like content restriction, won't work right > unless the IPs reflect the users' location. > > Generally, I think the geolocation is represented as the rough region > where the servers are, with services that care about geolocation for > content restriction intentionally disallowing them. That's the safe > answer. For the alternative, I expect the different consumers of > geolocation services will have different opinions about it. > > > With that being said is it proper for transit providers to advertise the IP of their end users? > > Yes. > > > Are we considered a true transit provider since we are not an ISP per-se? > > No. It's not whether you're an ISP, the IP packets are stopping at > your network; you're not transiting them onward. > > Regards, > Bill Herrin > > -------------------------------------------------------------------------------------------------------------------------------------------- > > William Herrin > bill(a)herrin.us > https://bill.herrin.us/

3 2

Geo location Contacts
by Brian 21 Apr '21

21 Apr '21

Good day all. I am trying to find contacts at ipdata.co and ipinfo.io. I recently acquired new ip space and most places have updated. But the above 2 have not and still show CA as the location for this ip space. Please feel free to email me off the list. Thank you Brian

4 3

BGP and The zero window edge
by Jean St-Laurent 21 Apr '21

21 Apr '21

Nice article explaining a specific BGP corner case not removing routes when TCP window reaches 0. https://blog.benjojo.co.uk/post/bgp-stuck-routes-tcp-zero-window The proposed solution is a new RFC for BGP with the suggestion to introduce a new timer. Fascinating! Jean St-Laurent /CISSP ddosTest me security inc site: https://ddostest.me

1 0

Malicious SS7 activity and why SMS should never by used for 2FA
by Eric Kuhnke 20 Apr '21

20 Apr '21

https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c413… https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-no… Anecdotal: With the prior consent of the DID holders, I have successfully ported peoples' numbers using nothing more than a JPG scan of a signature that looks like an illegible 150 dpi black and white blob, pasted in an image editor on top of a generic looking 'phone bill'.

15 47

Zayo or HE for IP transit
by James Lumby 20 Apr '21

20 Apr '21

What is the current experience with Zayo or HE? I'm looking at possibly adding one of them into a mix of cogent and a mix from my datacenter. Would be using BGP full routes. Any experiences would be appreciated. Sincerely, James

8 7

Carriers need to independently verify LOAs
by Sean Donelan 19 Apr '21

19 Apr '21

On Sat, 17 Apr 2021, Eric Kuhnke wrote: > Anecdotal: With the prior consent of the DID holders, I have successfully > ported peoples' numbers using nothing more than a JPG scan of a signature > that looks like an illegible 150 dpi black and white blob, pasted in an > image editor on top of a generic looking 'phone bill'. All carriers should independently verify any LOAs received for account changes. Documents received from third-parties, without independently verifying with the customer of record, using the carriers own records, are just junk papers. Almost no carriers verify LOAs by contacting the customer of record. Worse, they call the phone number on the letterhead provide by the scammer for "verification." The U.S. Postal Service used to let random people change mail forwarding orders, without verifying with the original and new addresses. As you can guess, there were lots of fake forwarding orders and criminal activity. After USPS begin verifying mail forwarding orders by sending a letter to the ORIGINAL address and NEW address, mail forwarding fraud declined. Not zero, but declined.

4 4