April 2024 - Test - lists.nanog.org

Question about mutual transit and complex BGP peering
by Sriram, Kotikalapudi (Fed) 22 Apr '24

22 Apr '24

Requesting responses to the following questions. Would be helpful in some IETF work in progress. Q1: Consider an AS peering relationship that is complex (or hybrid) meaning, for example, provider-to-customer (P2C) for one set of prefixes and lateral peers (i.e., transit-free peer-to-peer (P2P)) for another set of prefixes. Are these diverse relationships usually segregated, i.e., P2C on one BGP session and P2P on another? How often they might co-exist within one single BGP session? Q2: Consider an AS peering relationship that is mutual transit (i.e., P2C relationship in each direction for all prefixes). Is this supported within one single BGP session? How often the ASes might setup two separate BGP sessions between them -- one for P2C in one direction (AS A to AS B) and the other for P2C in the opposite direction (AS B to AS A)? Thank you. Sriram Kotikalapudi Sriram, US NIST

2 1

Re: Help with removing DNS shinkhole FP from Charter/Spectrum
by Validin Axon 22 Apr '24

22 Apr '24

Hi Mel, I appreciate the suggestion. During my earlier research, I'd noticed that as well. However, the DNS block includes all validin.com subdomains, covering those on completely different ASNs. It also does NOT affect other domains that resolve to the exact same IP addresses (e.g., validin.net) So, I'm inclined to think it's not that simple, unfortunately. I'd considered switching domains, but that doesn't guarantee the problem wouldn't just reappear again, and it'd impact the search engine ranking we've built up. We rely 100% on inbound, so that'd be a big set back. Warm regards, Kenneth On Mon, Apr 22, 2024 at 10:29 AM Mel Beckman <mel(a)beckman.org> wrote: > > UCEPROTECTL3 137.184.54.107 was listed > > I notice from MXToolbox.com that your domain’s IP address is on the > UCEPROTECTL3 blacklist. > > This is a notoriously evil blacklist that charges people for removal. This > may be why Spectrum is blackholing your domain. Most respectable ISPs won’t > use it. But Spectrum… > > There is no delisting procedure without making a “donation” to the UCEPROTECT3 > black sparrow account. They’re famous for blacklisting large swaths of IP > addresses that catch up innocent parties that have never spammed a flea. > > -mel > > > On Apr 22, 2024, at 7:24 AM, Mel Beckman <mel(a)beckman.org> wrote: > > I notice you’re on the UCEPROTECT3 blacklist: > > <logo_square_1900.png> > Network Tools: DNS,IP,Email > <https://mxtoolbox.com/SuperTool.aspx?action=mx%3aValidin.com&run=toolpage> > mxtoolbox.com > <https://mxtoolbox.com/SuperTool.aspx?action=mx%3aValidin.com&run=toolpage> > <https://mxtoolbox.com/SuperTool.aspx?action=mx%3aValidin.com&run=toolpage> > > UCEPROTECTL3 137.184.54.107 was listed > This is a notoriously evil blacklist that charges people for removal. > This may be why Spectrum is blackholing your domain. Most respectable ISPs > won’t use it. But Spectrum… > > There is no delisting procedure without making a “donation” to the UCEPROTECT3 > black sparrow account. They’re famous for blacklisting large swaths of IP > addresses that catch up innocent parties that have never spammed a flea. > > -mel > > On Apr 22, 2024, at 4:51 AM, Validin Axon <axon(a)validin.com> wrote: > > > Looking for some help/advice. Spectrum is sinkholing my company's domain, > validin[.]com, to 127.0.0.54. The sinkhole responses come from their > recursive DNS servers, 209.18.47.61 and 209.18.47.62, which are defaults > for and in use by many of their customers and are only reachable from > within the Spectrum network. I've had 4 people over the last week (think: > customers, prospects, etc) who use Charter/Spectrum tell me that they have > difficulty accessing my website as a result of this sinkhole behavior. This > behavior is causing reputational harm to my company. > > I've personally confirmed this behavior from the Spectrum network (I am > also a customer) using dig to test their DNS servers: > ``` > $ dig +short @209.18.47.61 validin.com > 127.0.0.54 > $ dig +short @209.18.47.62 validin.com > 127.0.0.54 > ``` > Using Cloudflare/Google/etc works correctly: > ``` > $ dig +short @1.1.1.1 validin.com > 137.184.54.107 > 157.245.112.183 > $ dig +short @8.8.8.8 validin.com > 157.245.112.183 > 137.184.54.107 > ``` > > I suspect my domain was blocklisted last year when a threat researcher > included my domain name in a blog post about a threat they were > investigating and cited my company as the source for their data. Someone > scraped that post, and my company's domain was accidentally added to > two Alient Vault OTX pulses and at least one collection on Virus Total. I > removed the domain via false positive reporting from everything I could. > However, it appears that being added to Spectrum's DNS sinkhole list is > effectively permanent and there's no clear path for false positive > remediation. > > I've tried the official Spectrum support lines for months to no avail, and > recently tried reaching out on Twitter, but have had no success there > either. I'm clearly not able to find the right people through these routes, > as none of the people I reach understand the difference between a DNS > sinkhole and an IP block list and don't appear to be aware that DNS > blocklisting is a separate behavior from their opt-in content filtering via > Security Shield. > > So, if someone could please help me find the team or individual > responsible for Spectrum's DNS sinkhole behavior, I would be exceptionally > grateful. :-) > > As I mentioned, this is causing reputation harm, so switching my own DNS > servers is not sufficient. People who need to reach me, can't. So, I would > appreciate any other help or advice you have, > > Kenneth > >

1 0

Re: Help with removing DNS shinkhole FP from Charter/Spectrum
by Mel Beckman 22 Apr '24

22 Apr '24

I notice from MXToolbox.com that your domain’s IP address is on the UCEPROTECTL3 blacklist. This is a notoriously evil blacklist that charges people for removal. This may be why Spectrum is blackholing your domain. Most respectable ISPs won’t use it. But Spectrum… There is no delisting procedure without making a “donation” to the UCEPROTECT3 black sparrow account. They’re famous for blacklisting large swaths of IP addresses that catch up innocent parties that have never spammed a flea. -mel On Apr 22, 2024, at 4:51 AM, Validin Axon <axon(a)validin.com> wrote: Looking for some help/advice. Spectrum is sinkholing my company's domain, validin[.]com, to 127.0.0.54. The sinkhole responses come from their recursive DNS servers, 209.18.47.61 and 209.18.47.62, which are defaults for and in use by many of their customers and are only reachable from within the Spectrum network. I've had 4 people over the last week (think: customers, prospects, etc) who use Charter/Spectrum tell me that they have difficulty accessing my website as a result of this sinkhole behavior. This behavior is causing reputational harm to my company. I've personally confirmed this behavior from the Spectrum network (I am also a customer) using dig to test their DNS servers: ``` $ dig +short @209.18.47.61 validin.com<http://validin.com> 127.0.0.54 $ dig +short @209.18.47.62 validin.com<http://validin.com> 127.0.0.54 ``` Using Cloudflare/Google/etc works correctly: ``` $ dig +short @1.1.1.1<http://1.1.1.1> validin.com<http://validin.com> 137.184.54.107 157.245.112.183 $ dig +short @8.8.8.8<http://8.8.8.8> validin.com<http://validin.com> 157.245.112.183 137.184.54.107 ``` I suspect my domain was blocklisted last year when a threat researcher included my domain name in a blog post about a threat they were investigating and cited my company as the source for their data. Someone scraped that post, and my company's domain was accidentally added to two Alient Vault OTX pulses and at least one collection on Virus Total. I removed the domain via false positive reporting from everything I could. However, it appears that being added to Spectrum's DNS sinkhole list is effectively permanent and there's no clear path for false positive remediation. I've tried the official Spectrum support lines for months to no avail, and recently tried reaching out on Twitter, but have had no success there either. I'm clearly not able to find the right people through these routes, as none of the people I reach understand the difference between a DNS sinkhole and an IP block list and don't appear to be aware that DNS blocklisting is a separate behavior from their opt-in content filtering via Security Shield. So, if someone could please help me find the team or individual responsible for Spectrum's DNS sinkhole behavior, I would be exceptionally grateful. :-) As I mentioned, this is causing reputation harm, so switching my own DNS servers is not sufficient. People who need to reach me, can't. So, I would appreciate any other help or advice you have, Kenneth

1 0

Re: constant FEC errors juniper mpc10e 400g
by Saku Ytti 22 Apr '24

22 Apr '24

On Sat, 20 Apr 2024 at 14:35, Mark Tinka <mark(a)tinka.africa> wrote: > Even when our market seeks OTN from European backhaul providers to extend submarine access into Europe and Asia-Pac, it is often for structured capacity grooming, and not for OAM benefit. > > It would be interesting to learn whether other markets in the world still make a preference for OTN in lieu of Ethernet, for the OAM benefit, en masse. When I worked in Malaysia back in the day (2007 - 2012), WAN-PHY was generally asked for for 10G services, until about 2010; when folk started to choose LAN-PHY. The reason, back then, was to get that extra 1% of pipe bandwidth :-). Oh I don't think OTN or WAN-PHY have any large deployment future, the cheapest option is 'good enough' and whatever value you could extract from OTN or WAN-PHY, will be difficult to capitalise, people usually don't even capitalise the capabilities they already pay for in the cheaper technologies. Of course WAN-PHY is dead post 10GE, a big reason for it to exist was very old optical systems which simply could not regenerate ethernet framing, not any features or functional benefits. -- ++ytti

6 12

constant FEC errors juniper mpc10e 400g
by Aaron Gould 20 Apr '24

20 Apr '24

We recently added MPC10E-15C-MRATE cards to our MX960's to upgrade our core to 400g. During initial testing of the 400g interface (400GBASE-FR4), I see constant FEC errors. FEC is new to me. Anyone know why this is occurring? Shown below, is an interface with no traffic, but seeing constant FEC errors. This is (2) MX960's cabled directly, no dwdm or anything between them... just a fiber patch cable. {master} me@mx960> clear interfaces statistics et-7/1/4 {master} me@mx960> show interfaces et-7/1/4 | grep rror | refresh 2 ---(refreshed at 2024-04-17 14:18:53 CDT)--- Link-level type: Ethernet, MTU: 1514, MRU: 1522, Speed: 400Gbps, BPDU Error: None, Loop Detect PDU Error: None, Loopback: Disabled, Source filtering: Disabled, Bit errors 0 Errored blocks 0 Ethernet FEC statistics Errors FEC Corrected Errors 0 FEC Uncorrected Errors 0 FEC Corrected Errors Rate 0 FEC Uncorrected Errors Rate 0 ---(refreshed at 2024-04-17 14:18:55 CDT)--- Link-level type: Ethernet, MTU: 1514, MRU: 1522, Speed: 400Gbps, BPDU Error: None, Loop Detect PDU Error: None, Loopback: Disabled, Source filtering: Disabled, Bit errors 0 Errored blocks 0 Ethernet FEC statistics Errors FEC Corrected Errors 4302 FEC Uncorrected Errors 0 FEC Corrected Errors Rate 8 FEC Uncorrected Errors Rate 0 ---(refreshed at 2024-04-17 14:18:57 CDT)--- Link-level type: Ethernet, MTU: 1514, MRU: 1522, Speed: 400Gbps, BPDU Error: None, Loop Detect PDU Error: None, Loopback: Disabled, Source filtering: Disabled, Bit errors 0 Errored blocks 0 Ethernet FEC statistics Errors FEC Corrected Errors 8796 FEC Uncorrected Errors 0 FEC Corrected Errors Rate 146 FEC Uncorrected Errors Rate 0 ---(refreshed at 2024-04-17 14:18:59 CDT)--- Link-level type: Ethernet, MTU: 1514, MRU: 1522, Speed: 400Gbps, BPDU Error: None, Loop Detect PDU Error: None, Loopback: Disabled, Source filtering: Disabled, Bit errors 0 Errored blocks 0 Ethernet FEC statistics Errors FEC Corrected Errors 15582 FEC Uncorrected Errors 0 FEC Corrected Errors Rate 111 FEC Uncorrected Errors Rate 0 ---(refreshed at 2024-04-17 14:19:01 CDT)--- Link-level type: Ethernet, MTU: 1514, MRU: 1522, Speed: 400Gbps, BPDU Error: None, Loop Detect PDU Error: None, Loopback: Disabled, Source filtering: Disabled, Bit errors 0 Errored blocks 0 Ethernet FEC statistics Errors FEC Corrected Errors 20342 FEC Uncorrected Errors 0 FEC Corrected Errors Rate 256 FEC Uncorrected Errors Rate 0 {master} me@mx960> show interfaces et-7/1/4 | grep "put rate" Input rate : 0 bps (0 pps) Output rate : 0 bps (0 pps) {master} me@mx960> show interfaces et-7/1/4 Physical interface: et-7/1/4, Enabled, Physical link is Up Interface index: 226, SNMP ifIndex: 800 Link-level type: Ethernet, MTU: 1514, MRU: 1522, Speed: 400Gbps, BPDU Error: None, Loop Detect PDU Error: None, Loopback: Disabled, Source filtering: Disabled, Flow control: Enabled Pad to minimum frame size: Disabled Device flags : Present Running Interface flags: SNMP-Traps Internal: 0x4000 Link flags : None CoS queues : 8 supported, 8 maximum usable queues Schedulers : 0 Last flapped : 2024-04-17 13:55:28 CDT (00:36:19 ago) Input rate : 0 bps (0 pps) Output rate : 0 bps (0 pps) Active alarms : None Active defects : None PCS statistics Seconds Bit errors 0 Errored blocks 0 Ethernet FEC Mode : FEC119 Ethernet FEC statistics Errors FEC Corrected Errors 801787 FEC Uncorrected Errors 0 FEC Corrected Errors Rate 2054 FEC Uncorrected Errors Rate 0 Link Degrade : Link Monitoring : Disable Interface transmit statistics: Disabled Logical interface et-7/1/4.0 (Index 420) (SNMP ifIndex 815) Flags: Up SNMP-Traps 0x4004000 Encapsulation: ENET2 Input packets : 1 Output packets: 1 Protocol inet, MTU: 1500 Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 1, Curr new hold cnt: 0, NH drop cnt: 0 Flags: Sendbcast-pkt-to-re Addresses, Flags: Is-Preferred Is-Primary Destination: 10.10.10.76/30, Local: 10.10.10.77, Broadcast: 10.10.10.79 -- -Aaron

13 31

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 19 Apr '24

19 Apr '24

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 20 Apr, 2024 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 944392 Prefixes after maximum aggregation (per Origin AS): 360904 Deaggregation factor: 2.62 Unique aggregates announced (without unneeded subnets): 460300 Total ASes present in the Internet Routing Table: 75677 Prefixes per ASN: 12.48 Origin-only ASes present in the Internet Routing Table: 64892 Origin ASes announcing only one prefix: 26586 Transit ASes present in the Internet Routing Table: 10785 Transit-only ASes present in the Internet Routing Table: 517 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 121 Max AS path prepend of ASN (150315) 116 Prefixes from unregistered ASNs in the Routing Table: 1044 Number of instances of unregistered ASNs: 1046 Number of 32-bit ASNs allocated by the RIRs: 44204 Number of 32-bit ASNs visible in the Routing Table: 36243 Prefixes from 32-bit ASNs in the Routing Table: 185454 Number of bogon 32-bit ASNs visible in the Routing Table: 16 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 589 Number of addresses announced to Internet: 3028224640 Equivalent to 180 /8s, 127 /16s and 10 /24s Percentage of available address space announced: 81.8 Percentage of allocated address space announced: 81.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 311370 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 250540 Total APNIC prefixes after maximum aggregation: 73742 APNIC Deaggregation factor: 3.40 Prefixes being announced from the APNIC address blocks: 242704 Unique aggregates announced from the APNIC address blocks: 100466 APNIC Region origin ASes present in the Internet Routing Table: 14096 APNIC Prefixes per ASN: 17.22 APNIC Region origin ASes announcing only one prefix: 4271 APNIC Region transit ASes present in the Internet Routing Table: 1872 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 121 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9479 Number of APNIC addresses announced to Internet: 761931136 Equivalent to 45 /8s, 106 /16s and 37 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 275322 Total ARIN prefixes after maximum aggregation: 124663 ARIN Deaggregation factor: 2.21 Prefixes being announced from the ARIN address blocks: 280196 Unique aggregates announced from the ARIN address blocks: 133382 ARIN Region origin ASes present in the Internet Routing Table: 19136 ARIN Prefixes per ASN: 14.64 ARIN Region origin ASes announcing only one prefix: 6960 ARIN Region transit ASes present in the Internet Routing Table: 1985 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 25 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4877 Number of ARIN addresses announced to Internet: 1268923648 Equivalent to 75 /8s, 162 /16s and 61 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 264976 Total RIPE prefixes after maximum aggregation: 126706 RIPE Deaggregation factor: 2.09 Prefixes being announced from the RIPE address blocks: 259717 Unique aggregates announced from the RIPE address blocks: 163430 RIPE Region origin ASes present in the Internet Routing Table: 28606 RIPE Prefixes per ASN: 9.08 RIPE Region origin ASes announcing only one prefix: 12110 RIPE Region transit ASes present in the Internet Routing Table: 3975 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11737 Number of RIPE addresses announced to Internet: 714687488 Equivalent to 42 /8s, 153 /16s and 68 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 121535 Total LACNIC prefixes after maximum aggregation: 28949 LACNIC Deaggregation factor: 4.20 Prefixes being announced from the LACNIC address blocks: 119765 Unique aggregates announced from the LACNIC address blocks: 49448 LACNIC Region origin ASes present in the Internet Routing Table: 11081 LACNIC Prefixes per ASN: 10.81 LACNIC Region origin ASes announcing only one prefix: 2599 LACNIC Region transit ASes present in the Internet Routing Table: 2396 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8956 Number of LACNIC addresses announced to Internet: 177085440 Equivalent to 10 /8s, 142 /16s and 28 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 30975 Total AfriNIC prefixes after maximum aggregation: 6161 AfriNIC Deaggregation factor: 5.03 Prefixes being announced from the AfriNIC address blocks: 41421 Unique aggregates announced from the AfriNIC address blocks: 13111 AfriNIC Region origin ASes present in the Internet Routing Table: 1829 AfriNIC Prefixes per ASN: 22.65 AfriNIC Region origin ASes announcing only one prefix: 646 AfriNIC Region transit ASes present in the Internet Routing Table: 357 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1194 Number of AfriNIC addresses announced to Internet: 105283840 Equivalent to 6 /8s, 70 /16s and 129 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9882 8744 69 CHINAMOBILE-CN China Mobile Communicati 7545 5665 778 678 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4936 4192 76 ERX-CERNET-BKB China Education and Rese 7552 3879 1330 20 VIETEL-AS-AP Viettel Group, VN 7713 3618 1043 64 TELKOMNET-AS-AP PT Telekomunikasi Indon 9498 3595 499 257 BBIL-AP BHARTI Airtel Ltd., IN 45899 3290 1872 99 VNPT-AS-VN VNPT Corp, VN 24560 2782 864 374 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 4766 2313 11524 584 KIXS-AS-KR Korea Telecom, KR 4755 2199 434 196 TATACOMM-AS TATA Communications formerl Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 9846 11366 3476 AMAZON-02, US 11492 4603 305 604 CABLEONE, US 7155 4170 287 90 VIASAT-SP-BACKBONE, US 6327 3609 1320 75 SHAW, CA 22773 3512 3048 241 ASN-CXA-ALL-CCI-22773-RDC, US 174 3319 6629 838 COGENT-174, US 749 3202 54912 2454 DNIC-AS-00749, US 16625 3112 1323 2216 AKAMAI-AS, US 367 2828 3551 1347 DNIC-ASBLK-00306-00371, US 7018 2767 23647 1772 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7711 1709 144 UNI2-AS, ES 39891 4758 286 60 ALJAWWALSTC-AS, SA 20940 3879 3396 128 AKAMAI-ASN1, NL 9009 3284 285 1607 M247, RO 12389 2976 2303 899 ROSTELECOM-AS, RU 8551 2640 368 35 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 34984 2349 364 583 TELLCOM-AS, TR 13188 1607 100 26 TRIOLAN, UA 8452 1549 1852 14 TE-AS TE-AS, EG 44477 1536 100 727 STARK-INDUSTRIES, GB Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12393 3319 483 UNINET, MX 10620 3524 495 908 Telmex Colombia S.A., CO 13999 2530 350 660 Mega Cable, S.A. de C.V., MX 11830 2004 369 64 Instituto Costarricense de Electricidad 28573 1340 2313 251 Claro NXT Telecomunicacoes Ltda, BR 3816 1314 788 192 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11664 1156 175 429 Techtel LMDS Comunicaciones Interactiva 6503 1133 314 478 Axtel, S.A.B. de C.V., MX 6147 1102 369 22 Telefonica del Peru S.A.A., PE 22884 1068 114 390 TOTAL PLAY TELECOMUNICACIONES SA DE CV, Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1549 545 28 RAYA-AS, EG 24863 1501 389 20 LINKdotNET-AS, EG 36992 1368 1519 282 ETISALAT-MISR, EG 36903 1249 554 96 MT-MPLS, MA 29571 1206 76 63 ORANGE-COTE-IVOIRE, CI 36935 935 521 42 Vodafone-, EG 6713 557 1861 35 IAM-AS, MA 15399 531 56 54 WANANCHI-, KE 36914 483 82 3 KENET-AS, KE 24757 436 73 5 EthioNet-AS, ET Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12393 3319 483 UNINET, MX 9808 9882 8744 69 CHINAMOBILE-CN China Mobile Communicati 16509 9846 11366 3476 AMAZON-02, US 12479 7711 1709 144 UNI2-AS, ES 7545 5665 778 678 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4936 4192 76 ERX-CERNET-BKB China Education and Rese 39891 4758 286 60 ALJAWWALSTC-AS, SA 11492 4603 305 604 CABLEONE, US 7155 4170 287 90 VIASAT-SP-BACKBONE, US 7552 3879 1330 20 VIETEL-AS-AP Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9882 9813 CHINAMOBILE-CN China Mobile Communications Grou 12479 7711 7567 UNI2-AS, ES 16509 9846 6370 AMAZON-02, US 7545 5665 4987 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4936 4860 ERX-CERNET-BKB China Education and Research Net 39891 4758 4698 ALJAWWALSTC-AS, SA 7155 4170 4080 VIASAT-SP-BACKBONE, US 11492 4603 3999 CABLEONE, US 7552 3879 3859 VIETEL-AS-AP Viettel Group, VN 20940 3879 3751 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 65536 DOCUMENT 5.102.30.0/24 65512 -Private Use AS-, ZZ 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.175.120.0/24 Origin: 400967 ASSUREDNET-ASN1, US 23.175.120.0/24 Transit: 21700 NEPTUNE-NETWORKS, US 23.189.192.0/24 Origin: 27593 RESERVED, ZZ 23.189.192.0/24 Transit: 174 COGENT-174, US 27.0.192.0/22 Origin: 138415 YANCYLIMITED-AS-HK Yancy Limited, HK 27.0.192.0/22 Transit: 51847 NEAROUTE, HK Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:37 /11:95 /12:298 /13:583 /14:1195 /15:2068 /16:13285 /17:8263 /18:13701 /19:24845 /20:43905 /21:51701 /22:111356 /23:98720 /24:573584 /25:726 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6826 7711 UNI2-AS, ES 8151 6425 12393 UNINET, MX 11492 3516 4603 CABLEONE, US 39891 3440 4758 ALJAWWALSTC-AS, SA 6327 3406 3609 SHAW, CA 7155 3114 4170 VIASAT-SP-BACKBONE, US 22773 2601 3512 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2145 2490 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2137 3524 Telmex Colombia S.A., CO 8551 2116 2640 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1654 2:1502 3:324 4:6 5:4527 6:163 7:6 8:1513 9:1 11:172 12:1456 13:371 14:2399 15:317 16:209 17:369 18:765 20:361 21:4 22:188 23:6690 24:2711 25:2 27:2561 29:19 31:2698 32:48 34:60 35:131 36:2298 37:4471 38:7279 39:891 40:123 41:4093 42:984 43:2376 44:314 45:17061 46:4442 47:305 49:1948 50:1922 51:573 52:1584 54:311 55:927 56:5 57:169 58:1922 59:1251 60:1032 61:2592 62:2693 63:1892 64:5528 65:2346 66:4694 67:3002 68:1336 69:4115 70:1188 71:574 72:2892 74:2594 75:1551 76:610 77:2435 78:1849 79:2495 80:2182 81:1962 82:1560 83:1317 84:1640 85:3129 86:841 87:2266 88:1241 89:4070 90:667 91:8104 92:2215 93:2667 94:3676 95:4138 96:1294 97:314 98:1038 99:742 100:78 101:1186 102:3143 103:32556 104:4845 105:651 106:949 107:2772 108:1111 109:4113 110:2146 111:3297 112:2074 113:1594 114:1785 115:2033 116:1889 117:2624 118:2392 119:1969 120:1808 121:1327 122:2662 123:2237 124:1622 125:2888 126:32 128:1482 129:937 130:1120 131:1842 132:803 133:410 134:1719 135:319 136:938 137:1062 138:2831 139:1550 140:1392 141:1367 142:1587 143:1481 144:1005 145:345 146:2063 147:1854 148:2494 149:2580 150:1036 151:1343 152:2028 153:524 154:6491 155:1450 156:2470 157:1722 158:1117 159:2328 160:2641 161:1637 162:3587 163:1697 164:1639 165:2130 166:1172 167:1792 168:3914 169:798 170:4826 171:1021 172:3828 173:3032 174:901 175:1201 176:3648 177:4649 178:3572 179:2267 180:2356 181:3690 182:3432 183:1806 184:2271 185:20730 186:5010 187:4480 188:4063 189:4172 190:9294 191:1446 192:10972 193:9066 194:7473 195:5275 196:3145 197:2478 198:6037 199:7652 200:8044 201:6311 202:10478 203:10170 204:4566 205:3775 206:4494 207:3495 208:4153 209:5066 210:4658 211:2580 212:4288 213:3426 214:1061 215:50 216:6775 217:2821 218:1362 219:579 220:2048 221:1033 222:880 223:2241 End of report

1 0

Xfinity Engineer
by Jason Kuehl 19 Apr '24

19 Apr '24

My company has many issues with Xfinity users using global protection on the Xfinity network, not Comcast. Does anyone have a contact email list or phone number I can use to reach a real person or engineer who is not in support? Thanks Jason. -- Sincerely, Jason W Kuehl Cell 920-419-8983 jason.w.kuehl(a)gmail.com

1 0

Last Call for Presentations + Don't Forget to Register for Hackathon! + More
by Nanog News 18 Apr '24

18 Apr '24

*LAST CALL for Presentations! * *Submission Deadline is Monday * Whether you are on the stage or as a live remote presenter, we want to hear from you! Submit a presentation proposal, including draft slides, no later than Monday, 22 April. *Submit Now* <https://nanog.org/program/call-presentations/> *Don't Forget to Register for Hackathon!* Hack Your Way to New Friends, Hands-on Learning, + Fun The NANOG Hackathons are hands-on and educational at their core — directly supporting the most critical aspects of our mission, so participants of all levels are welcome, and registration is free. Hackathon sponsorships are still available. Email Shawn Winstead at swinstead(a)nanog.org for more info. *Register Now <https://nanog.org/events/nanog-91-hackathon/> * *NANOG Sponsorships Still Available! * Stand out + get your company seen by your target demographics! Contact Shawn Winstead at swinstead(a)nanog.org for more info. *NANOG Talk of the Week! * *Off Label Use Of DNS with Fatema Bannat Wala* Why it's worth your time: At almost 700 views on YouTube, this talk is worth the watch. DNS is known to be one of the most widely abused protocols by threat actors to use in unconventional ways to hide under regular traffic. Apart from threat actors, DNS is being used or misused by many other service providers, vendors, etc., to provide the intended services. *Watch Now * <https://www.youtube.com/watch?v=YAtDytS-uok>

1 0

Upcoming LACNIC RPKI Migration
by Carlos Martinez-Cagnazzo 16 Apr '24

16 Apr '24

Hello all, On April 15th, 2024 starting approximately at 9.30am UTC-3 LACNIC will be migrating from our current legacy RPKI CA system to a new Krill-based RPKI core. In most cases no action will be required on your part (see below for some special cases). What follows is a list of events that will take place at the mentioned time and that may be of interest to you. * Our TAL file won't change at this time. There is no need to change anything in your current RP configuration. * Our RTA certificate, while keeping the old key will point to a new manifest. >From the outside, what RPs will see is the following sequence of events: * At some time T0 all our current servers (both RRDP and rsync) will be shut down, returning "connection refused '' for both http and rsync. * New values for the DNS records will be published (same names, different IPs). * At approximately T0+30min the servers listening on the new IPs will be started and will start serving the repository as produced by the new Krill-based system. * When they first connect, RPs will see a new RRDP session and will take it from there. We have tested this migration flow using a set of docker containers plus a DNS server container using dnsmasq server that allows us to modify records on the fly. In all the cases we tested this flow works just fine. We have tested this migration flow with the following RPs: * rpki-client from “latest” all the way back to 8.2. * routinator from “latest” all the way back to 0.8. * fort from “latest” all the way back to 1.5.0. What we have not tested: * RIPE rpki validator: it’s been deprecated for three years. You shouldn’t be running this and you know it :-) In any case, it should work. * OctoRPKI: also recently deprecated. * Rpki-prover. * RIPSTR. All of the above should work. However bear in mind the following: If you are running any of the above and you notice issues, just clear the local cache, launch a clean instance of your RP and you should be fine. We have set up a specific email inbox for this migration work: rpki-migracion(a)lacnic.net. It will be closely monitored during April 15 and the following days. It will be phased out once we are confident all issues that may arise have been addressed. For those interested, the new servers are already online and can be used to validate. These can be reached at: * lb-us-mia.rrdp.lacnic.net * lb-us-southeast.rrdp.lacnic.net * lb-br-gru.rrdp.lacnic.net Don’t expect to see the exact same VRPs as you see now on our current production server as minor differences are expected. Don’t hardcode this either, as during the migration “rrdp.lacnic.net” will be made to point to these servers and eventually these names may change and/or new ones may be added. Thank you all! /Carlos

3 5

MTA-STS operational practice survey
by Chung, Tijay 16 Apr '24

16 Apr '24

Greetings, Together with researchers from Virginia Tech and Max-Planck-Institut für Informatik, we would like to understand the general trends, operational practices, and challenges of MTA-STS protocol from the mail operators' point of view. It takes around 5-6 minutes and you can stop participating in the study at any time; we would truly appreciate your participation. We do not collect any personal information and all answers except the first couple of consent questions are optional. If you do not want to answer any questions, please just leave the field blank. https://www.surveymonkey.com/r/JKWNDSN Please do not hesitate to email me if you have questions or comments. Also, please excuse us if you have received this email from different mailing lists. Thank you. Thanks, Taejoong "Tijay" Chung, Assistant Professor Virginia Tech | Computer Science 220 Gilbert Street, RM 4303 Blacksburg, VA 24060 (540) 231-0667| tijay(a)vt.edu<mailto:tijay@vt.edu>

1 0