March 2022 - Test - lists.nanog.org

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 04 Mar '22

04 Mar '22

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 05 Mar, 2022 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 889936 Prefixes after maximum aggregation (per Origin AS): 335804 Deaggregation factor: 2.65 Unique aggregates announced (without unneeded subnets): 428204 Total ASes present in the Internet Routing Table: 72802 Prefixes per ASN: 12.22 Origin-only ASes present in the Internet Routing Table: 62438 Origin ASes announcing only one prefix: 25692 Transit ASes present in the Internet Routing Table: 10364 Transit-only ASes present in the Internet Routing Table: 381 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 53 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 922 Number of instances of unregistered ASNs: 925 Number of 32-bit ASNs allocated by the RIRs: 38710 Number of 32-bit ASNs visible in the Routing Table: 32223 Prefixes from 32-bit ASNs in the Routing Table: 150594 Number of bogon 32-bit ASNs visible in the Routing Table: 23 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 505 Number of addresses announced to Internet: 3067615488 Equivalent to 182 /8s, 216 /16s and 25 /24s Percentage of available address space announced: 82.9 Percentage of allocated address space announced: 82.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 301039 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 233294 Total APNIC prefixes after maximum aggregation: 66099 APNIC Deaggregation factor: 3.53 Prefixes being announced from the APNIC address blocks: 228289 Unique aggregates announced from the APNIC address blocks: 94492 APNIC Region origin ASes present in the Internet Routing Table: 12449 APNIC Prefixes per ASN: 18.34 APNIC Region origin ASes announcing only one prefix: 3551 APNIC Region transit ASes present in the Internet Routing Table: 1720 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 29 Number of APNIC region 32-bit ASNs visible in the Routing Table: 7647 Number of APNIC addresses announced to Internet: 773997952 Equivalent to 46 /8s, 34 /16s and 69 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-151865 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 259682 Total ARIN prefixes after maximum aggregation: 119358 ARIN Deaggregation factor: 2.18 Prefixes being announced from the ARIN address blocks: 259843 Unique aggregates announced from the ARIN address blocks: 123858 ARIN Region origin ASes present in the Internet Routing Table: 18981 ARIN Prefixes per ASN: 13.69 ARIN Region origin ASes announcing only one prefix: 6893 ARIN Region transit ASes present in the Internet Routing Table: 1966 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 35 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4386 Number of ARIN addresses announced to Internet: 1295510272 Equivalent to 77 /8s, 55 /16s and 235 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 254137 Total RIPE prefixes after maximum aggregation: 116902 RIPE Deaggregation factor: 2.17 Prefixes being announced from the RIPE address blocks: 251262 Unique aggregates announced from the RIPE address blocks: 149507 RIPE Region origin ASes present in the Internet Routing Table: 28082 RIPE Prefixes per ASN: 8.95 RIPE Region origin ASes announcing only one prefix: 12050 RIPE Region transit ASes present in the Internet Routing Table: 3981 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10638 Number of RIPE addresses announced to Internet: 713858176 Equivalent to 42 /8s, 140 /16s and 156 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 114295 Total LACNIC prefixes after maximum aggregation: 27388 LACNIC Deaggregation factor: 4.17 Prefixes being announced from the LACNIC address blocks: 114291 Unique aggregates announced from the LACNIC address blocks: 48146 LACNIC Region origin ASes present in the Internet Routing Table: 10933 LACNIC Prefixes per ASN: 10.45 LACNIC Region origin ASes announcing only one prefix: 2645 LACNIC Region transit ASes present in the Internet Routing Table: 2220 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 53 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8620 Number of LACNIC addresses announced to Internet: 176044544 Equivalent to 10 /8s, 126 /16s and 58 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 27606 Total AfriNIC prefixes after maximum aggregation: 5374 AfriNIC Deaggregation factor: 5.14 Prefixes being announced from the AfriNIC address blocks: 35746 Unique aggregates announced from the AfriNIC address blocks: 11765 AfriNIC Region origin ASes present in the Internet Routing Table: 1597 AfriNIC Prefixes per ASN: 22.38 AfriNIC Region origin ASes announcing only one prefix: 553 AfriNIC Region transit ASes present in the Internet Routing Table: 315 Average AfriNIC Region AS path length visible: 5.1 Max AfriNIC Region AS path length visible: 34 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 932 Number of AfriNIC addresses announced to Internet: 107865088 Equivalent to 6 /8s, 109 /16s and 228 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9104 8886 46 CHINAMOBILE-CN China Mobile Communicati 7545 5875 788 691 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4684 4192 74 ERX-CERNET-BKB China Education and Rese 7552 3607 1330 19 VIETEL-AS-AP Viettel Group, VN 7713 3491 1038 51 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3434 1880 57 VNPT-AS-VN VNPT Corp, VN 4766 2545 11122 623 KIXS-AS-KR Korea Telecom, KR 9498 2382 475 238 BBIL-AP BHARTI Airtel Ltd., IN 45090 2169 1438 79 TENCENT-NET-AP Shenzhen Tencent Compute 4755 2110 429 197 TATACOMM-AS TATA Communications formerl Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 6351 10200 2644 AMAZON-02, US 11492 4446 295 737 CABLEONE, US 22773 3955 3029 368 ASN-CXA-ALL-CCI-22773-RDC, US 7155 3895 263 26 VIASAT-SP-BACKBONE, US 16625 3659 1888 2572 AKAMAI-AS, US 6327 3395 1318 62 SHAW, CA 749 2885 50780 2141 DNIC-AS-00749, US 30036 2610 374 156 MEDIACOM-ENTERPRISE-BUSINESS, US 209 2521 4962 428 CENTURYLINK-US-LEGACY-QWEST, US 20115 2257 3042 499 CHARTER-20115, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 6811 1730 149 UNI2-AS, ES 9121 6687 1692 17 TTNET, TR 8551 4015 378 39 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 3930 3348 213 AKAMAI-ASN1, NL 39891 3546 204 29 ALJAWWALSTC-AS, SA 12389 2960 2274 910 ROSTELECOM-AS, RU 9009 2468 249 1285 M247, GB 34984 2240 359 611 TELLCOM-AS, TR 47331 2057 324 1572 TTNET, TR 58224 1798 931 597 TCI, IR Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10400 3421 562 Uninet S.A. de C.V., MX 10620 3476 520 695 Telmex Colombia S.A., CO 11830 2433 369 62 Instituto Costarricense de Electricidad 13999 1694 289 475 Mega Cable, S.A. de C.V., MX 6503 1441 354 524 Axtel, S.A.B. de C.V., MX 28573 1396 2332 248 CLARO S.A., BR 3816 1253 664 145 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 26615 1147 2350 139 TIM SA, BR 6147 1089 369 21 Telefonica del Peru S.A.A., PE 11664 1004 191 447 Techtel LMDS Comunicaciones Interactiva Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1591 393 21 LINKdotNET-AS, EG 24835 1545 523 32 RAYA-AS, EG 36992 1301 1518 262 ETISALAT-MISR, EG 36903 1199 545 114 MT-MPLS, MA 29571 907 64 62 ORANGE-COTE-IVOIRE, CI 36935 729 521 40 Vodafone-, EG 6713 612 1863 34 IAM-AS, MA 15399 519 51 34 WANANCHI-, KE 37342 469 32 1 MOVITEL, MZ 23889 422 232 16 MauritiusTelecom, MU Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10400 3421 562 Uninet S.A. de C.V., MX 9808 9104 8886 46 CHINAMOBILE-CN China Mobile Communicati 12479 6811 1730 149 UNI2-AS, ES 9121 6687 1692 17 TTNET, TR 16509 6351 10200 2644 AMAZON-02, US 7545 5875 788 691 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4684 4192 74 ERX-CERNET-BKB China Education and Rese 11492 4446 295 737 CABLEONE, US 8551 4015 378 39 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 22773 3955 3029 368 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9104 9058 CHINAMOBILE-CN China Mobile Communications Grou 9121 6687 6670 TTNET, TR 12479 6811 6662 UNI2-AS, ES 7545 5875 5184 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4684 4610 ERX-CERNET-BKB China Education and Research Net 8551 4015 3976 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7155 3895 3869 VIASAT-SP-BACKBONE, US 20940 3930 3717 AKAMAI-ASN1, NL 11492 4446 3709 CABLEONE, US 16509 6351 3707 AMAZON-02, US Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 46990 UNALLOCATED 8.5.242.0/23 3356 LEVEL3, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 18604 UNALLOCATED 8.25.204.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 6461 ZAYO-6461, US 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 395056 UNALLOCATED 8.45.133.0/24 3356 LEVEL3, US 32306 UNALLOCATED 8.46.80.0/24 33652 CMCS, US 17033 UNALLOCATED 8.48.225.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.141.0.0/24 Origin: 395350 UNASSIGNED 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 27.100.7.0/24 Origin: 56096 UNASSIGNED 27.100.7.0/24 Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 41.57.124.0/22 Origin: 37442 UNASSIGNED 41.57.124.0/22 Transit: 37204 TELONE, ZW 41.57.124.0/23 Origin: 37442 UNASSIGNED 41.57.124.0/23 Transit: 37204 TELONE, ZW 41.57.124.0/24 Origin: 37442 UNASSIGNED 41.57.124.0/24 Transit: 37204 TELONE, ZW Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:40 /11:102 /12:305 /13:590 /14:1206 /15:2029 /16:13579 /17:8340 /18:13898 /19:25176 /20:43176 /21:52412 /22:108351 /23:95511 /24:524399 /25:793 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 9121 5843 6687 TTNET, TR 12479 5788 6811 UNI2-AS, ES 8151 4061 10400 Uninet S.A. de C.V., MX 8551 3480 4015 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 11492 3359 4446 CABLEONE, US 6327 3207 3395 SHAW, CA 7155 2988 3895 VIASAT-SP-BACKBONE, US 22773 2946 3955 ASN-CXA-ALL-CCI-22773-RDC, US 39891 2874 3546 ALJAWWALSTC-AS, SA 30036 2265 2610 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1721 2:1062 3:154 4:7 5:3759 6:103 7:5 8:1565 9:1 11:172 12:1712 13:412 14:2386 15:170 16:43 17:375 18:142 20:167 21:4 22:188 23:5510 24:2314 25:6 27:2604 29:19 31:2418 32:95 34:1 35:62 36:1752 37:3923 38:2601 39:695 40:151 41:3933 42:841 43:2104 44:293 45:16028 46:3893 47:348 49:1681 50:1909 51:107 52:1366 53:1 54:296 55:737 56:8 57:58 58:1775 59:1199 60:964 61:2270 62:2452 63:1941 64:5504 65:2301 66:4861 67:2954 68:1192 69:4147 70:1353 71:670 72:3076 74:2621 75:1517 76:720 77:2101 78:3870 79:3102 80:1959 81:1661 82:1454 83:1215 84:1339 85:3640 86:722 87:1949 88:2656 89:3242 90:509 91:7529 92:1891 93:2593 94:3294 95:4493 96:1309 97:347 98:990 99:863 100:75 101:1036 102:1981 103:28454 104:4262 105:460 106:851 107:2482 108:788 109:4154 110:2069 111:3270 112:2008 113:1495 114:1502 115:1959 116:1905 117:2515 118:2252 119:1855 120:1669 121:1059 122:2558 123:2120 124:1613 125:2105 128:1190 129:1190 130:922 131:2070 132:757 133:372 134:1930 135:289 136:875 137:866 138:2454 139:1236 140:888 141:1434 142:1268 143:1455 144:1235 145:344 146:1765 147:1494 148:2203 149:1704 150:855 151:1080 152:1847 153:457 154:3540 155:1427 156:1880 157:1234 158:1020 159:2062 160:2408 161:1300 162:3451 163:1220 164:1665 165:1594 166:659 167:1711 168:3719 169:688 170:4407 171:822 172:3010 173:3073 174:1019 175:1126 176:3504 177:4584 178:3057 179:1960 180:2276 181:2918 182:3225 183:1944 184:2387 185:19334 186:4313 187:3608 188:3841 189:3079 190:8841 191:1301 192:11041 193:8545 194:6949 195:4967 196:2932 197:2356 198:6010 199:6018 200:7504 201:5663 202:10453 203:9965 204:4556 205:3374 206:3785 207:3388 208:4045 209:4650 210:4251 211:2448 212:3987 213:3384 214:1158 215:64 216:6437 217:2633 218:1246 219:597 220:1948 221:987 222:856 223:2171 End of report

1 0

P.C Picks: Best of NANOG 84 👉WATCH NOW: N84 Full Webcast
by Nanog News 04 Mar '22

04 Mar '22

*VIDEO * *Do the Wrong Thing! w/ Keynote Radia Perlman * *Watch or rewatch: *brilliant Internet pioneer Radia Perlman lights up our NANOG 84 Keynote stage with her presentation: *Do the Wrong Thing! How Bad Industry Decisions Led to Good Technology Development.* *More info: *This presentation describes some technical decisions that the industry made that, although clearly “wrong”, wound up causing technologies to be invented that are quite wonderful. Radia presses the audience to not ask, “how can I use this thing?” But, instead “what problem am I solving, what are various ways of solving it, and which technical approach is the best?” *WATCH NOW <https://www.youtube.com/watch?v=5D1v42nw25E&list=PLO8DR5ZGla8iwcpODjNgf1faB…>* *PC Picks: Best of NANOG 84* *Programming Committee Picks Favorite Talks from our Last Meeting* Want to catch up on all the NANOG 84 talks, but don't know where to start? The NANOG Programming Committee (PC) has your back. Read the "Best of NANOG 84" curated by our own panel of experts, then tell us your favorites! *READ NOW * <https://www.nanog.org/stories/pc-picks-best-of-nanog-84/> *VIDEO | NANOG 84 Talks Available Online * *Watch Full Webcast on Youtube * The full webcast of our last meeting is available in the "NANOG 84 playlist" <https://www.youtube.com/watch?v=TeokK85-Usc&list=PLO8DR5ZGla8iwcpODjNgf1faB…> on our YouTube channel. <https://www.youtube.com/channel/UCIvcN8QNgRGNW9osYLGsjQQ> Please make sure you are subscribed to our channel to be notified when new content is released! Enjoy hours of insights from some of the brightest minds in network engineering, operations, + architecture. *THANK YOU* A huge thank you to host sponsor Quantum Loophole, <https://mail.google.com/mail/u/0/#inbox/FMfcgzGmvLQgtShZbDHdNJQXTTcmmgKn?co…> as well as, all sponsors, <https://www.nanog.org/events/nanog-84/our-sponsors/> attendees, Hackathon participants + speakers. We truly appreciate your time and energy in helping us build the Internet of tomorrow.

1 0

Ukraine request yikes
by George Herbert 04 Mar '22

04 Mar '22

Posted by Bill Woodcock on Twitter… https://twitter.com/woodyatpch/status/1498472865301098500?s=21 https://pastebin.com/DLbmYahS Ukraine (I think I read as) want ICANN to turn root nameservers off, revoke address delegations, and turn off TLDs for Russia. Seems… instability creating… -george Sent from my iPhone

24 34

Saw 40-45% packet loss on both Lumen and ATT MPLS backbones
by Shahid Shafi 04 Mar '22

04 Mar '22

Wondering anyone else noticed it and the loss lasted approx 10 mins. I am wondering if one of our routers misbehaved or was there an actual SP loss?

1 0

Starlink terminal visual camouflage tests vs improvised fabric materials
by Eric Kuhnke 03 Mar '22

03 Mar '22

I have just completed some very unscientific tests of DIY camouflage materials vs a starlink terminal. Obviously there is a lot of possible discussion that is possible about spectrum analyzers, direction finding, jammers, etc within the context of what's going on in Ukraine right now. All very valid concerns. That said, there's also some DIY possibilities for making a starlink terminal much less noticeable from the air or casual observation, such as if installed on top of a mid rise apartment building in any Ukrainian city. I would wager that the ratio of portable Ku/Ka-band spectrum analyzers with horn antennas to invasion foot soldiers/armored vehicle soldiers is rather low at present. Terminal is the same as the following RIPE atlas probe location: https://atlas.ripe.net/probes/1001821 Terminal is a v1 from Jan. 2021. Fabrics have been draped flat over the Starlink terminal. What effect this will have vs. suspended in the air a meter or so above it on some sort of improvised framework is a question I can't really answer right now (if we have any inflatable or fabric radome specialists here, please chime in). Average of multiple speedtest.net CLI runs to server ID 11329 in Seattle. In general any of the well-peered speedtest.net servers in Seattle have the same results, the bottleneck is the starlink last-mile performance at any given point in time, and not any terrestrial network factors. *Baseline terminal with no material above it. I do have a slight tree obstruction in 1/12th of its field of view to the northeast.* 152.48 Mbps down x 8.23 Mbps up, 3.17% loss (note this averages more like 0.43% loss over 3 to 10 hour periods to its gateway in Seattle, I believe the loss during the particular time period this data was gathered to be an aberration). *Tent rain fly, synthetic nylon material, dry* 162.02 Mbps down x 7.14 Mbps up, 1.43% loss *Two layers cotton bed sheet, doubled over on itself, thoroughly soaked in tap water* 55.79 Mbps down x 3.70 Mbps up, 0.77% loss *One layer cotton bed sheet, dry* 158.78 Mbps down x 7.16 Mbps up, 0.9% loss *Two layers thin polypropylene tarpaulin, doubled over on itself, approximately simulating the thickness of a single layer heavy duty tarp.* 152.77 Mbps down x 9.70 Mbps up, 1.41% loss

2 1

Anyone have contacts for Akamai GeoIP
by Christopher Munz-Michielin 03 Mar '22

03 Mar '22

Hey All, Hoping someone has a contact at Akamai who can assist. As part of my day job I run a DNS network and we've been having issues with Akamai mis-locating the geolocation of some of our revolvers. The most egregious example is our resolver in Frankfurt being classified as Australian, but there are some other instances as well. This is an issue because we run fully recursive revolvers, so when a customer queries our DNS server, we attempt to resolve the domain directly against the authoritative name servers (Akamai in this case). Because Akamai has mis-located our IPs, we get handed an IP in the wrong hemisphere and our customers experience 200+ ms latency to sites that should be regional. We've tried reaching out via a couple of channels but have not gotten anything back, wondering if anyone on the list knows a contact address for Akamai GeoIP we can submit corrections to. Cheers,

2 1

RIR IRR interfaces
by Jon Lewis 02 Mar '22

02 Mar '22

I wonder, do the RIR's "talk" to each other about UI? I'm in the middle of duplicating (moving) a bunch of route objects from 3rd party IRRdbs to the appropriate RIR ones, which, so far, has meant creating route objects in the RIRs run by APNIC, ARIN, and RIPE. User experience-wise, I'm sad to say RIPE rates last so far. I figured out how to talk to ARIN's API first so creating objects wouldn't have to be a whole bunch of point&click&paste. It "works" and accepts rpsl format text for objects. Next I did some APNIC route objects, and was amazed by their route object import tool. It looks at presumably a full view of the Internet and offers to auto-create route objects for your prefixes found in the table...including a checkbox for "would you like RPKI ROAs with that?" Finally I got to RIPE. No auto-import tool. There is an API, but it doesn't accept data in rpsl format, so if I want to explore it farther, I'll have to write something to convert rpsl route objects to either xml or json. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route StackPath, Sr. Neteng | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

Authoritative Resources for Public DNS Pinging
by Mike Hammett 01 Mar '22

01 Mar '22

Yes, pinging public DNS servers is bad. Googling didn't help me find anything. Are there any authoritative resources from said organizations saying you shouldn't use their servers for your persistent ping destinations? ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

33 85

Certificates for DoT and DoH?
by Bjørn Mork 01 Mar '22

01 Mar '22

Any recommendations for a CA with a published policy allowing an IP address SAN (Subject Alternative Name)? Preferably someone using ACME with a simple RFC 8738 reference. Let's Encrypt had this in their TODO list for a while, but it was removed and the project was put on hold: https://github.com/letsencrypt/boulder/pull/4920#issuecomment-832104881 https://community.letsencrypt.org/t/planned-rfc-8738-support-pulled/152057 And I've been unable to find any other CAs with RFC 8738 support either. Most of them don't even bother documenting it as unsupported. All I've found is this answer from Buypass: https://community.buypass.com/t/h7hm76w/buypass-support-for-rfc-8738 So what do people use for DoT and DoH? I see that Google got a certificate from their own CA. No surprise... Version: 3 (0x2) Serial Number: 9c:d9:a2:0f:fe:dd:2b:0a:12:00:00:00:00:03:6f:0b Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Google Trust Services LLC, CN = GTS CA 1C3 Validity Not Before: Feb 17 11:34:59 2022 GMT Not After : May 12 11:34:58 2022 GMT Subject: CN = dns.google Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:ec:43:69:7c:2b:7d:99:d5:f3:79:d7:b8:54:bd: 6e:61:7b:8d:50:c5:bb:86:6c:a3:60:27:3e:22:c6: 45:00:68:a2:d2:2e:c9:c2:8f:8e:58:0e:93:0a:a4: ff:2d:5c:71:d9:0a:5b:f3:1c:ce:79:d2:71:5c:20: 4a:34:21:c1:fa:c3:92:bd:e8:7e:bd:93:79:ef:ad: 0b:74:e0:21:f6:22:4e:9c:39:01:48:49:bc:a0:db: 98:0b:ab:4c:df:99:b1:30:92:09:0d:f8:ea:0f:7f: 85:65:55:e7:9f:ba:88:4a:ca:93:04:71:8d:13:f7: 3b:e3:36:ee:fc:b7:b9:fc:e5:5a:a8:7b:22:ce:0a: dd:4b:36:ee:d9:8f:09:d4:2e:3f:48:5e:f8:7c:71: 2d:65:26:29:67:b9:c7:b2:77:8a:60:20:4f:dd:74: 00:49:c5:6f:3b:19:d0:ea:f8:78:ef:86:02:37:be: 3d:2e:d1:14:18:22:22:e6:94:65:bb:9d:37:b8:61: 8b:2c:fc:85:bc:04:01:56:74:04:b9:86:dc:59:9a: 75:9d:de:d9:65:67:5d:9f:75:f3:6d:8a:4f:61:d2: c5:b5:e1:dd:2e:54:78:8a:a8:39:ab:d1:0c:97:4d: bc:7d:f2:64:cb:d3:21:5a:f0:70:03:08:a6:f4:21: 4c:63 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: A6:21:3C:08:17:99:1E:DE:2D:F5:EB:C8:90:C9:71:D2:E9:53:1D:EE X509v3 Authority Key Identifier: keyid:8A:74:7F:AF:85:CD:EE:95:CD:3D:9C:D0:E2:46:14:F3:71:35:1D:27 Authority Information Access: OCSP - URI:http://ocsp.pki.goog/gts1c3 CA Issuers - URI:http://pki.goog/repo/certs/gts1c3.der X509v3 Subject Alternative Name: DNS:dns.google, DNS:dns.google.com, DNS:*.dns.google.com, DNS:8888.google, DNS:dns64.dns.google, IP Address:8.8.8.8, IP Address:8.8.4.4, IP Address:2001:4860:4860:0:0:0:0:8888, IP Address:2001:4860:4860:0:0:0:0:8844, IP Address:2001:4860:4860:0:0:0:0:6464, IP Address:2001:4860:4860:0:0:0:0:64 X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 Policy: 1.3.6.1.4.1.11129.2.5.3 X509v3 CRL Distribution Points: Full Name: URI:http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl [cut] But this is not an option for anyone else according to https://pki.goog/faq/#faq-29 : How can I get a certificate from Google Trust Services? At this time, the only way to get a certificate from Google Trust Services is via an Alphabet or Google product. I guess it's easy to push for DoT and DoH when you can create rules like that. Both Quad9 and Cloudflare got their certificates from DigiCert: Version: 3 (0x2) Serial Number: 05:45:06:fe:17:98:52:bb:fa:c1:a7:3d:cd:80:39:7b Signature Algorithm: ecdsa-with-SHA384 Issuer: C = US, O = DigiCert Inc, CN = DigiCert TLS Hybrid ECC SHA384 2020 CA1 Validity Not Before: Jul 27 00:00:00 2021 GMT Not After : Aug 4 23:59:59 2022 GMT Subject: C = US, ST = California, L = Berkeley, O = Quad9, CN = *.quad9.net Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (256 bit) pub: 04:7d:8b:d7:1d:03:85:0d:18:25:b3:34:1c:29:a1: 27:d4:ac:01:25:48:8a:a0:f1:ea:02:b9:d8:51:2c: 08:6a:ac:72:56:ec:fa:3d:a6:a0:9f:49:09:55:8e: ac:fe:b9:73:17:5c:02:fb:78:cc:24:91:94:6f:43: 23:89:0e:1d:66 ASN1 OID: prime256v1 NIST CURVE: P-256 X509v3 extensions: X509v3 Authority Key Identifier: keyid:0A:BC:08:29:17:8C:A5:39:6D:7A:0E:CE:33:C7:2E:B3:ED:FB:C3:7A X509v3 Subject Key Identifier: 7F:A9:12:A5:D7:C6:8B:48:02:C7:3D:2A:45:6E:40:1E:40:60:F4:97 X509v3 Subject Alternative Name: DNS:*.quad9.net, DNS:quad9.net, IP Address:9.9.9.9, IP Address:9.9.9.10, IP Address:9.9.9.11, IP Address:9.9.9.12, IP Address:9.9.9.13, IP Address:9.9.9.14, IP Address:9.9.9.15, IP Address:149.112.112.9, IP Address:149.112.112.10, IP Address:149.112.112.11, IP Address:149.112.112.12, IP Address:149.112.112.13, IP Address:149.112.112.14, IP Address:149.112.112.15, IP Address:149.112.112.112, IP Address:2620:FE:0:0:0:0:0:9, IP Address:2620:FE:0:0:0:0:0:10, IP Address:2620:FE:0:0:0:0:0:11, IP Address:2620:FE:0:0:0:0:0:12, IP Address:2620:FE:0:0:0:0:0:13, IP Address:2620:FE:0:0:0:0:0:14, IP Address:2620:FE:0:0:0:0:0:15, IP Address:2620:FE:0:0:0:0:0:FE, IP Address:2620:FE:0:0:0:0:FE:9, IP Address:2620:FE:0:0:0:0:FE:10, IP Address:2620:FE:0:0:0:0:FE:11, IP Address:2620:FE:0:0:0:0:FE:12, IP Address:2620:FE:0:0:0:0:FE:13, IP Address:2620:FE:0:0:0:0:FE:14, IP Address:2620:FE:0:0:0:0:FE:15 X509v3 Key Usage: critical Digital Signature X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 CRL Distribution Points: Full Name: URI:http://crl3.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl Full Name: URI:http://crl4.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl X509v3 Certificate Policies: Policy: 2.23.140.1.2.2 CPS: http://www.digicert.com/CPS Authority Information Access: OCSP - URI:http://ocsp.digicert.com CA Issuers - URI:http://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt X509v3 Basic Constraints: critical CA:FALSE [cut] Version: 3 (0x2) Serial Number: 0f:75:a3:6d:32:c1:6b:03:c7:ca:5f:5f:71:4a:03:70 Signature Algorithm: ecdsa-with-SHA384 Issuer: C = US, O = DigiCert Inc, CN = DigiCert TLS Hybrid ECC SHA384 2020 CA1 Validity Not Before: Oct 25 00:00:00 2021 GMT Not After : Oct 25 23:59:59 2022 GMT Subject: C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = cloudflare-dns.com Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (256 bit) pub: 04:fb:29:44:f2:98:3f:d8:bd:82:56:d3:2c:bd:8e: 09:9f:31:2b:98:26:9e:22:96:8d:7b:4b:fc:da:c5: 7b:7b:29:aa:8e:35:6c:9c:0a:48:05:6c:89:73:ed: 20:0e:cd:46:21:f0:ec:4d:b3:a5:e9:af:1b:38:99: e5:f4:da:f1:84 ASN1 OID: prime256v1 NIST CURVE: P-256 X509v3 extensions: X509v3 Authority Key Identifier: keyid:0A:BC:08:29:17:8C:A5:39:6D:7A:0E:CE:33:C7:2E:B3:ED:FB:C3:7A X509v3 Subject Key Identifier: 19:45:1B:23:18:F8:74:DA:22:14:CB:46:6B:E2:13:B3:60:15:82:40 X509v3 Subject Alternative Name: DNS:cloudflare-dns.com, DNS:*.cloudflare-dns.com, DNS:one.one.one.one, IP Address:1.1.1.1, IP Address:1.0.0.1, IP Address:162.159.36.1, IP Address:162.159.46.1, IP Address:2606:4700:4700:0:0:0:0:1111, IP Address:2606:4700:4700:0:0:0:0:1001, IP Address:2606:4700:4700:0:0:0:0:64, IP Address:2606:4700:4700:0:0:0:0:6400 X509v3 Key Usage: critical Digital Signature X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 CRL Distribution Points: Full Name: URI:http://crl3.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl Full Name: URI:http://crl4.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl X509v3 Certificate Policies: Policy: 2.23.140.1.2.2 CPS: http://www.digicert.com/CPS Authority Information Access: OCSP - URI:http://ocsp.digicert.com CA Issuers - URI:http://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt X509v3 Basic Constraints: critical CA:FALSE CT Precertificate SCTs: [cut] Does this mean that DigiCert is the only alternative? And do they really have this offer for ordinary users, or is this also some special arrangement for big players only? I see that a CSR with a DNS name, an IPv4 address and an IPv6 address is accepted by https://www.digicert.com/ssltools/view-csr/ But when I test the same CSR on their order page, only the DNS name is extracted into the order form. Leaving me confused and worried about the addresses being ignored. And their documentation sucks. Like all CAs, I might add. There is no mention of how you are supposed to demonstraete IP address control on https://docs.digicert.com/manage-certificates/demonstrate-control-over-doma… Searchin for RFC 8738 on https://docs.digicert.com/search/?query=8738 returns "No results found for 8738". Even if they do have ACME support for automated certificate management. So I guess automated certificate management of certificates with IP address SANs is out of the question. That's a bummer. I really, really do not want to go back to semi-manual certificate management hell and the resulting periodical breakage. https://www.digicert.com/tls-ssl/multi-domain-ssl-certificates looks like a bad joke: The  Subject Alternative Name field lets you specify additional host names (sites, IP addresses, common names, etc.) to be protected by a single TLS/SSL certificate That does make me wonder how they verify that I'm the rightful owner of "sites, IP addresses, common names, etc.". In particular, "etc" :-) Or you could ask yourself if you trust a CA with such an offer... Yes, I'm frustrated. Why is a business that is mostly about selling policies so afraid of actually publishing those policies? Bjørn

4 7