- Test - lists.nanog.org

IP transit providers @ 625 RL
by A Mekkaoui 13 Nov '13

13 Nov '13

Hi, anyone knows about carrier companies which provides IP transit service and has are located in Cologix data center at 625 Rene Levesque, Montreal, Canada. Thanks in advance for your help. Karim

1 0

CPE dns hijacking malware
by Mike 12 Nov '13

12 Nov '13

Hi, It appears that some of my subscribers DSL modems (which are acting as nat routers) have had their dns settings hijacked and presumably for serving ads or some such nonsense. The dns server addresses are statically programmed in and of the onces I have seen, they are not currently responsive, leading to slow page loads or 404 errors and hence tech support calls to my support desk. I have set up a resolver that will answer dns queries and have done some routing magic to re-direct queries sent from my customer CPE's to these hijacked dns addresses. This is working for the time being and affected clients don't know about the problem (yet). I realise it's highly likely there are more than just the 2 addresses I have identified so far in the realm of dns hijackers, and so I am I am wondering if anyone has a line on dns server addresses that have been used or are currently in use for dns redirecting malware. I would like to maybe script something so that addresses on such a list would automatically get dropped into a routing table pointing at my special dns resolver. In the future I would also likely set up some sort of web redirect so that any client that queries the special resolver would get a web page explaining they have been hijacked and how to handle it. For now however I just want to stem the tide and make sure clients continue to work and to catch as many of these as I can. Anyone ? Mike-

7 9

Re: CPE dns hijacking malware
by Larry Sheldon 12 Nov '13

12 Nov '13

On 11/12/2013 3:54 PM, Larry Sheldon wrote: > On 11/12/2013 3:24 PM, Larry Sheldon wrote: >> On 11/12/2013 12:12 AM, Dobbins, Roland wrote: >>> >>> On Nov 12, 2013, at 12:56 PM, Mike <mike-nanog(a)tiedyenetworks.com> >>> wrote: >>> >>>> It appears that some of my subscribers DSL modems (which are acting >>>> as nat routers) have had their dns settings hijacked and presumably >>>> for serving ads or some such nonsense. >>> >>> How do you think this was accomplished? Via some kind of Web exploit >>> customized for those devices and targeting your user population via >>> email or social media, which tricked users into clicking on something >>> that accessed the Web admin interface via default admin credentials >>> or somsesuch; or via some direct attack on the CPE devices >>> themselves; or via some other method? >> >> I am less well informed here than in a lot of other things, so please be >> gentle. >> >> As a user of such equipment, I don't see or know of anything in the I/F >> that I have access-to that mentions DNSish stuff except the servers I am >> to use. >> >> But interestingly enough, when I tried to look at it to verify my >> belief's just no I got a certificate error that it won't let me past. >> >> That seems odd. >> > > Meant to send this to the list. > > The on-line chat to Linksys was subsatisfying, but for want of something > to do I dropped the "s" IN "https" and go on the router just fine. Makes > you wonder if I understand "certificates". > > But I do not see anything that looks like I can affect DNS beyond which > servers I use. And I don't know a way to get on Cox's "cable modem" at all. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Re: CPE dns hijacking malware
by Larry Sheldon 12 Nov '13

12 Nov '13

On 11/12/2013 3:24 PM, Larry Sheldon wrote: > On 11/12/2013 12:12 AM, Dobbins, Roland wrote: >> >> On Nov 12, 2013, at 12:56 PM, Mike <mike-nanog(a)tiedyenetworks.com> >> wrote: >> >>> It appears that some of my subscribers DSL modems (which are acting >>> as nat routers) have had their dns settings hijacked and presumably >>> for serving ads or some such nonsense. >> >> How do you think this was accomplished? Via some kind of Web exploit >> customized for those devices and targeting your user population via >> email or social media, which tricked users into clicking on something >> that accessed the Web admin interface via default admin credentials >> or somsesuch; or via some direct attack on the CPE devices >> themselves; or via some other method? > > I am less well informed here than in a lot of other things, so please be > gentle. > > As a user of such equipment, I don't see or know of anything in the I/F > that I have access-to that mentions DNSish stuff except the servers I am > to use. > > But interestingly enough, when I tried to look at it to verify my > belief's just no I got a certificate error that it won't let me past. > > That seems odd. > Meant to send this to the list. The on-line chat to Linksys was subsatisfying, but for want of something to do I dropped the "s" IN "https" and go on the router just fine. Makes you wonder if I understand "certificates". But I do not see anything that looks like I can affect DNS beyond which servers I use. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Do you obfuscate email headers when reporting spam issues to clients?
by Landon 12 Nov '13

12 Nov '13

Hello, We (iWeb AS32613) are currently making great strides in getting out from under the volume of reports received and getting on top of things. How much trouble does your abuse department go to in order to obfuscate headers when providing evidence of spamming activity regardless of if it’s intentional/professional spammer activity or some kind of malware infection allowing a third party to spam. Especially for the pro spammers, we don’t want them list washing anything or worse yet becoming privy to spamtrap data if the reporting party wasn’t smart enough to obfuscate their own data before sending in the report. So basically in order to be able to provide some evidence to clients they can use in the case of an infection of some type but not give away too much information to professional spammers we need to find a balance. I’m not sure if it’s worthwhile going to too much trouble on this since basically regardless of the data they get sent they are going to be nuked if they are actual spammers anyway. -- Landon Stewart <LandonStewart(a)Gmail.com>

8 10

Any issues with Verizon FIOS?
by Sean Cline 10 Nov '13

10 Nov '13

Good evening everyone, for the past two days our customers using Verizon FIOS (residential) have been complaining about high latency or intermittent packetloss to several of our datacenters throughout the US. We have been trying to get in contact with Verizon but since we don't directly peer with Verizon they have no obligation to answer us, we are not getting very far with them directly. Here is a sample traceroutes, any information if you guys/girls are aware of would be super helpful :) 1 <1 ms <1 ms <1 ms Wireless_Broadband_Router.home [192.168.1.1] 2 5 ms 5 ms 4 ms 96.243.154.1 3 9 ms 11 ms 11 ms G0-9-1-6.TAMPFL-LCR-22.verizon-gni.net [130.81.140.64] 4 34 ms 10 ms 9 ms so-4-0-0-0.TPA01-BB-RTR2.verizon-gni.net [130.81.199.28] 5 96 ms 96 ms 78 ms 0.ae2.XL4.LAX15.ALTER.NET [140.222.227.21] 6 63 ms 64 ms 64 ms POS7-0-0.GW3.LAX15.ALTER.NET [152.63.112.109] 7 77 ms 78 ms 78 ms internapGIGE-gw.customer.alter.net [157.130.236.110] 8 77 ms 77 ms 77 ms border1.po2-20g-bbnet2.lax010.pnap.net [216.52.255.103] 1 1 ms <1 ms 1 ms Wireless_Broadband_Router.home [192.168.1.1] 2 5 ms 5 ms 5 ms L100.NYCMNY-VFTTP-32.verizon-gni.net [71.125.61.1] 3 8 ms 7 ms 7 ms G1-15-2-5.NYCMNY-LCR-22.verizon-gni.net [130.81.218.58] 4 7 ms 6 ms 6 ms ae4-0.NY5030-BB-RTR1.verizon-gni.net [130.81.163.224] 5 92 ms 91 ms 70 ms 0.xe-6-1-0.XL3.LAX15.ALTER.NET [152.63.112.146] 6 71 ms 69 ms 71 ms POS6-0-0.GW3.LAX15.ALTER.NET [152.63.112.105] 7 81 ms 83 ms 83 ms internapGIGE-gw.customer.alter.net [157.130.236.110] 8 81 ms 81 ms 84 ms border1.po2-20g-bbnet2.lax010.pnap.net [216.52.255.103]

2 1

BGP Update Report
by cidr-report＠potaroo.net 08 Nov '13

08 Nov '13

BGP Update Report Interval: 31-Oct-13 -to- 07-Nov-13 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS6407 178473 8.4% 6610.1 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 2 - AS30693 85995 4.1% 236.2 -- EONIX-CORPORATION-AS-WWW-EONIX-NET - Eonix Corporation 3 - AS9829 38135 1.8% 40.2 -- BSNL-NIB National Internet Backbone 4 - AS8402 37309 1.8% 35.9 -- CORBINA-AS OJSC "Vimpelcom" 5 - AS7303 27140 1.3% 17.1 -- Telecom Argentina S.A. 6 - AS38457 26960 1.3% 359.5 -- HNS-AS-AP Honesty Net Solution (I) Pvt Ltd 7 - AS29990 21261 1.0% 1518.6 -- ASN-APPNEXUS - AppNexus, Inc 8 - AS13118 21067 1.0% 2340.8 -- ASN-YARTELECOM OJSC Rostelecom 9 - AS35873 20191 0.9% 20191.0 -- MOVE-NETWORKS - Move Networks, inc. 10 - AS4775 16388 0.8% 268.7 -- GLOBE-TELECOM-AS Globe Telecoms 11 - AS29049 15528 0.7% 46.4 -- DELTA-TELECOM-AS Delta Telecom LTD. 12 - AS7029 13597 0.6% 9.3 -- WINDSTREAM - Windstream Communications Inc 13 - AS28573 13588 0.6% 11.7 -- NET Serviços de Comunicação S.A. 14 - AS57130 11915 0.6% 3971.7 -- SECPRAL-AS Secpral COM SRL 15 - AS7552 11227 0.5% 9.4 -- VIETEL-AS-AP Vietel Corporation 16 - AS4538 10899 0.5% 20.9 -- ERX-CERNET-BKB China Education and Research Network Center 17 - AS11976 10850 0.5% 339.1 -- FIDN - Fidelity Communication International Inc. 18 - AS3475 9727 0.5% 100.3 -- DNIC-AS-03475 - Navy Network Information Center (NNIC) 19 - AS14754 9397 0.4% 39.5 -- Telgua 20 - AS24863 9096 0.4% 20.0 -- LINKdotNET-AS TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS35873 20191 0.9% 20191.0 -- MOVE-NETWORKS - Move Networks, inc. 2 - AS6629 8991 0.4% 8991.0 -- NOAA-AS - NOAA 3 - AS6407 178473 8.4% 6610.1 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 4 - AS7202 8777 0.4% 4388.5 -- FAMU - Florida A & M University 5 - AS57130 11915 0.6% 3971.7 -- SECPRAL-AS Secpral COM SRL 6 - AS6174 6415 0.3% 3207.5 -- SPRINTLINK8 - Sprint 7 - AS54465 8623 0.4% 2874.3 -- QPM-AS-1 - QuickPlay Media Inc. 8 - AS13118 21067 1.0% 2340.8 -- ASN-YARTELECOM OJSC Rostelecom 9 - AS32244 6936 0.3% 2312.0 -- LIQUID-WEB-INC - Liquid Web, Inc. 10 - AS62431 2091 0.1% 2091.0 -- NCSC-IE-AS National Cyber Security Centre 11 - AS1778 1840 0.1% 1840.0 -- DNIC-AS-01778 - DoD Network Information Center 12 - AS57109 1828 0.1% 1828.0 -- ASPROREVIZOR Pro-Revizor LLC. 13 - AS22592 3522 0.2% 1761.0 -- HBP - HBP, Inc. 14 - AS37367 1724 0.1% 1724.0 -- CALLKEY 15 - AS29990 21261 1.0% 1518.6 -- ASN-APPNEXUS - AppNexus, Inc 16 - AS23304 2808 0.1% 1404.0 -- DATOTEL-STL-AS - Datotel LLC, a NetLabs LLC Company 17 - AS144 6880 0.3% 1376.0 -- ATT-INTERNET - Lucent Technologies/Bell Laboratories 18 - AS6775 5881 0.3% 1176.2 -- BACKBONE_EHF_EUROPE Backbone ehf 19 - AS45808 1164 0.1% 1164.0 -- UTP-MY Bandar Seri Iskandar 20 - AS32528 2740 0.1% 913.3 -- ABBOTT Abbot Labs TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 103.243.220.0/22 21220 0.9% AS29990 -- ASN-APPNEXUS - AppNexus, Inc 2 - 109.161.64.0/20 21052 0.9% AS13118 -- ASN-YARTELECOM OJSC Rostelecom 3 - 8.20.2.0/24 20191 0.9% AS35873 -- MOVE-NETWORKS - Move Networks, inc. 4 - 216.181.203.0/24 16752 0.8% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 5 - 216.181.202.0/24 16752 0.8% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 6 - 216.181.196.0/22 16752 0.8% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 7 - 216.181.200.0/24 16752 0.8% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 8 - 216.181.201.0/24 16752 0.8% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 9 - 216.181.200.0/23 15779 0.7% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 10 - 216.181.202.0/23 15779 0.7% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 11 - 216.181.197.0/24 15779 0.7% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 12 - 216.181.198.0/24 15778 0.7% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 13 - 216.181.199.0/24 15778 0.7% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 14 - 216.181.196.0/24 15777 0.7% AS6407 -- PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 15 - 23.90.5.0/24 13364 0.6% AS30693 -- EONIX-CORPORATION-AS-WWW-EONIX-NET - Eonix Corporation 16 - 194.9.23.0/24 11911 0.5% AS57130 -- SECPRAL-AS Secpral COM SRL 17 - 23.90.21.0/24 10773 0.5% AS30693 -- EONIX-CORPORATION-AS-WWW-EONIX-NET - Eonix Corporation 18 - 192.58.232.0/24 8991 0.4% AS6629 -- NOAA-AS - NOAA 19 - 206.152.15.0/24 8619 0.4% AS54465 -- QPM-AS-1 - QuickPlay Media Inc. 20 - 120.28.62.0/24 8034 0.4% AS4775 -- GLOBE-TELECOM-AS Globe Telecoms Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

The Cidr Report
by cidr-report＠potaroo.net 08 Nov '13

08 Nov '13

This report has been generated at Fri Nov 8 21:14:17 2013 AEST. The report analyses the BGP Routing Table of AS2.0 router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org for a current version of this report. Recent Table History Date Prefixes CIDR Agg 01-11-13 481734 272520 02-11-13 481872 272864 03-11-13 482183 272900 04-11-13 482274 272490 05-11-13 481743 272481 06-11-13 481856 272607 07-11-13 482236 272408 08-11-13 482564 272297 AS Summary 45540 Number of ASes in routing system 18679 Number of ASes announcing only one prefix 4204 Largest number of prefixes announced by an AS AS7029 : WINDSTREAM - Windstream Communications Inc 118901504 Largest address span announced by an AS (/32s) AS4134 : CHINANET-BACKBONE No.31,Jin-rong Street Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 08Nov13 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 482675 272297 210378 43.6% All ASes AS28573 3445 86 3359 97.5% NET Serviços de Comunicação S.A. AS6389 3054 59 2995 98.1% BELLSOUTH-NET-BLK - BellSouth.net Inc. AS17974 2710 162 2548 94.0% TELKOMNET-AS2-AP PT Telekomunikasi Indonesia AS7029 4204 1727 2477 58.9% WINDSTREAM - Windstream Communications Inc AS22773 2195 152 2043 93.1% ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. AS4766 2934 951 1983 67.6% KIXS-AS-KR Korea Telecom AS10620 2648 1050 1598 60.3% Telmex Colombia S.A. AS18566 2056 566 1490 72.5% MEGAPATH5-US - MegaPath Corporation AS36998 1864 375 1489 79.9% SDN-MOBITEL AS18881 1548 100 1448 93.5% Global Village Telecom AS4323 2959 1537 1422 48.1% TWTC - tw telecom holdings, inc. AS7303 1727 468 1259 72.9% Telecom Argentina S.A. AS1785 2038 819 1219 59.8% AS-PAETEC-NET - PaeTec Communications, Inc. AS4755 1788 577 1211 67.7% TATACOMM-AS TATA Communications formerly VSNL is Leading ISP AS7552 1191 138 1053 88.4% VIETEL-AS-AP Vietel Corporation AS22561 1249 221 1028 82.3% DIGITAL-TELEPORT - Digital Teleport Inc. AS7545 2114 1289 825 39.0% TPG-INTERNET-AP TPG Telecom Limited AS35908 912 92 820 89.9% VPLSNET - Krypt Technologies AS18101 982 180 802 81.7% RELIANCE-COMMUNICATIONS-IN Reliance Communications Ltd.DAKC MUMBAI AS4788 848 67 781 92.1% TMNET-AS-AP TM Net, Internet Service Provider AS4808 1151 402 749 65.1% CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network AS24560 1094 365 729 66.6% AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services AS701 1507 785 722 47.9% UUNET - MCI Communications Services, Inc. d/b/a Verizon Business AS6983 1293 578 715 55.3% ITCDELTA - ITC^Deltacom AS8151 1367 654 713 52.2% Uninet S.A. de C.V. AS13977 852 143 709 83.2% CTELCO - FAIRPOINT COMMUNICATIONS, INC. AS8402 1912 1241 671 35.1% CORBINA-AS OJSC "Vimpelcom" AS855 724 55 669 92.4% CANET-ASN-4 - Bell Aliant Regional Communications, Inc. AS4780 1000 332 668 66.8% SEEDNET Digital United Inc. AS26615 750 88 662 88.3% Tim Celular S.A. Total 54116 15259 38857 71.8% Top 30 total Possible Bogus Routes 23.92.224.0/23 AS55048 VMWARE - VMware, Inc. 23.92.226.0/23 AS55048 VMWARE - VMware, Inc. 23.92.228.0/23 AS55048 VMWARE - VMware, Inc. 23.92.230.0/23 AS55048 VMWARE - VMware, Inc. 23.92.232.0/23 AS55048 VMWARE - VMware, Inc. 27.54.116.0/22 AS55452 27.54.116.0/24 AS55452 27.54.119.0/24 AS55452 27.100.7.0/24 AS56096 62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV 62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV 63.247.0.0/19 AS226 LOS-NETTOS-AS - Los Nettos 63.247.0.0/24 AS27609 63.247.1.0/24 AS27609 63.247.2.0/24 AS27609 63.247.3.0/24 AS27609 63.247.4.0/24 AS27609 63.247.5.0/24 AS27609 63.247.6.0/24 AS27609 63.247.7.0/24 AS27609 63.247.8.0/24 AS27609 63.247.9.0/24 AS27609 63.247.10.0/24 AS27609 63.247.11.0/24 AS27609 63.247.12.0/24 AS27609 63.247.13.0/24 AS27609 63.247.14.0/24 AS27609 63.247.15.0/24 AS27609 63.247.16.0/24 AS27609 63.247.17.0/24 AS27609 63.247.18.0/24 AS27609 63.247.19.0/24 AS27609 63.247.20.0/24 AS27609 63.247.21.0/24 AS27609 63.247.22.0/24 AS27609 63.247.23.0/24 AS27609 63.247.24.0/24 AS27609 63.247.25.0/24 AS27609 63.247.26.0/24 AS27609 63.247.27.0/24 AS27609 63.247.28.0/24 AS27609 63.247.29.0/24 AS27609 64.25.16.0/23 AS19535 64.25.20.0/24 AS19535 64.25.21.0/24 AS19535 64.25.22.0/24 AS19535 64.25.27.0/24 AS7046 RFC2270-UUNET-CUSTOMER - MCI Communications Services, Inc. d/b/a Verizon Business 64.111.0.0/20 AS8039 CCC-ASN-1 - Cinergy Communications 64.111.160.0/20 AS40551 64.111.160.0/24 AS40551 64.111.161.0/24 AS40551 64.111.162.0/24 AS40551 64.111.167.0/24 AS40551 64.111.169.0/24 AS40551 64.111.170.0/24 AS40551 64.111.171.0/24 AS40551 64.111.172.0/24 AS40551 64.111.173.0/24 AS40551 64.111.174.0/24 AS40551 64.111.175.0/24 AS40551 64.142.128.0/17 AS16415 64.142.236.0/24 AS18452 ALORICA - ALORICA INC 64.142.239.0/24 AS18452 ALORICA - ALORICA INC 64.185.224.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.225.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.226.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.227.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.228.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.229.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.230.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.231.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.232.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.233.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.234.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.235.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.236.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.237.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.238.0/24 AS27431 JTLNET - JTL Networks Inc. 64.185.239.0/24 AS27431 JTLNET - JTL Networks Inc. 64.202.48.0/22 AS23380 64.202.52.0/23 AS23380 64.202.54.0/24 AS23380 64.202.55.0/24 AS23380 64.202.56.0/22 AS23380 64.202.60.0/24 AS23380 64.202.61.0/24 AS23380 64.202.62.0/24 AS23380 64.202.63.0/24 AS23380 65.75.216.0/23 AS10494 AAI - Accurate Automation, Inc. 65.75.217.0/24 AS10494 AAI - Accurate Automation, Inc. 65.111.1.0/24 AS32258 SDNGLOBAL - SDN Global 66.11.112.0/20 AS14572 66.55.96.0/23 AS17203 66.55.98.0/24 AS17203 66.55.99.0/24 AS17203 66.55.100.0/22 AS17203 66.55.102.0/23 AS17203 66.55.104.0/21 AS17203 66.180.64.0/21 AS32558 ZEUTER - Zeuter Development Corporation 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.187.240.0/20 AS14552 ACS-SOUTHEASTDATACENTER - Affiliated Computer Services, Inc. 66.205.224.0/19 AS16526 BIRCH-TELECOM - Birch Telecom, Inc. 66.206.208.0/22 AS23380 66.206.211.0/24 AS14288 MPINET - MPInet 66.206.212.0/24 AS23380 66.206.213.0/24 AS14288 MPINET - MPInet 66.206.214.0/24 AS23380 66.206.215.0/24 AS23380 66.206.216.0/23 AS14288 MPINET - MPInet 66.206.218.0/23 AS23380 66.206.220.0/22 AS23380 66.251.128.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.133.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.134.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.136.0/21 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.140.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.141.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.142.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.254.160.0/20 AS11402 CCCAS-1 - Charlotte Colocation Center, LLc 66.254.176.0/21 AS11402 CCCAS-1 - Charlotte Colocation Center, LLc 66.254.184.0/22 AS11402 CCCAS-1 - Charlotte Colocation Center, LLc 66.254.188.0/22 AS35916 MULTA-ASN1 - MULTACOM CORPORATION 67.21.144.0/22 AS174 COGENT Cogent/PSI 67.21.148.0/22 AS174 COGENT Cogent/PSI 68.69.96.0/21 AS32986 68.69.96.0/24 AS32986 68.69.104.0/21 AS32986 69.46.224.0/20 AS32592 HUNT-BROTHERS-OF-LOUISIANA-LLC - Hunt Brothers 69.46.236.0/24 AS32592 HUNT-BROTHERS-OF-LOUISIANA-LLC - Hunt Brothers 71.19.134.0/23 AS3313 INET-AS BT Italia S.p.A. 72.19.0.0/19 AS16526 BIRCH-TELECOM - Birch Telecom, Inc. 72.35.224.0/22 AS30097 NUWAVE - NuWave 72.35.229.0/24 AS30188 TELEVERGENCE - Televergence Solutions Inc. 72.35.232.0/21 AS6246 AVALONTEL - AvalonTel 72.44.16.0/20 AS15054 NORTHEAST-TEXAS-BROADBAND-LLC - Northeast Texas Broadband, LLC 74.112.100.0/22 AS16764 74.113.200.0/23 AS46939 74.114.52.0/22 AS40818 74.114.140.0/22 AS32757 74.115.124.0/23 AS46540 NARSASN - National Asset Recovery Services, Inc 74.118.132.0/22 AS5117 91.193.60.0/22 AS3356 LEVEL3 Level 3 Communications 91.195.66.0/23 AS3356 LEVEL3 Level 3 Communications 91.197.36.0/22 AS43359 91.199.90.0/24 AS44330 91.200.188.0/22 AS44016 91.207.152.0/24 AS64100 91.207.153.0/24 AS64100 91.209.115.0/24 AS31103 KEYWEB-AS Keyweb AG 91.212.54.0/24 AS21409 IKOULA Ikoula Net SAS 93.190.8.0/24 AS47254 93.190.9.0/24 AS47254 93.190.10.0/24 AS47254 100.100.0.0/24 AS4847 CNIX-AP China Networks Inter-Exchange 102.2.88.0/22 AS38456 PACTEL-AS-AP Pacific Teleports. 103.11.1.0/24 AS9822 AMNET-AU-AP Amnet IT Services Pty Ltd 103.13.184.0/23 AS58674 115.166.130.0/23 AS45423 115.166.132.0/24 AS45423 116.206.72.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 116.206.85.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 116.206.103.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 117.120.56.0/21 AS4755 TATACOMM-AS TATA Communications formerly VSNL is Leading ISP 121.46.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 124.64.0.0/10 AS4847 CNIX-AP China Networks Inter-Exchange 164.40.184.0/24 AS19821 164.138.96.0/23 AS58101 164.138.96.0/24 AS58101 172.102.0.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 172.116.0.0/24 AS7018 ATT-INTERNET4 - AT&T Services, Inc. 174.136.192.0/18 AS14572 190.3.160.0/21 AS27975 SYNAPSIS COLOMBIA LTDA 190.15.72.0/21 AS15146 CABLEBAHAMAS - Cable Bahamas 190.124.252.0/22 AS7303 Telecom Argentina S.A. 192.166.32.0/20 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 193.9.59.0/24 AS1257 TELE2 193.22.224.0/20 AS3322 193.22.238.0/23 AS6824 HERMES-NETWORK Hermes Telecom International Ltd 193.33.66.0/23 AS39874 193.109.15.0/24 AS12690 MKSNET-AS MKS Autonomous System 193.164.152.0/24 AS3356 LEVEL3 Level 3 Communications 193.178.217.0/24 AS20737 193.188.252.0/24 AS8697 JTC-AS8697 Jordan Telecommunications Company 193.202.8.0/21 AS3322 193.254.218.0/23 AS25229 VOLIA-AS Kyivski Telekomunikatsiyni Merezhi LLC 194.50.82.0/24 AS16276 OVH OVH Systems 194.63.152.0/22 AS3356 LEVEL3 Level 3 Communications 194.79.48.0/22 AS39117 194.113.27.0/24 AS12518 SHLINK SHLINK Internet Service 194.126.219.0/24 AS34545 195.114.4.0/23 AS41158 195.128.240.0/23 AS21202 DCSNET-AS Bredband2 AB 195.216.234.0/24 AS31309 NMV-AS New Media Ventures BVBA 195.234.156.0/24 AS25028 195.248.240.0/23 AS34169 MEDIA-COM-TYCHY Media-Com Sp. z o.o. 200.1.112.0/24 AS29754 GO2TEL GO2TEL.COM INC. 200.58.248.0/21 AS27849 201.71.16.0/20 AS28638 EMTEC EMPRESA DE TECNOLOGIA EMPREENDIMENTOS DE COM 202.8.106.0/24 AS9530 SHINSEGAE-AS SHINSEGAE I&C Co., Ltd. 202.49.33.0/24 AS7657 VODAFONE-NZ-NGN-AS Vodafone NZ Ltd. 202.58.113.0/24 AS19161 202.83.120.0/21 AS37972 202.83.124.0/24 AS37972 202.83.125.0/24 AS37972 202.83.126.0/24 AS37972 202.86.216.0/23 AS38212 202.86.220.0/24 AS38212 202.86.222.0/24 AS17494 BTTB-AS-AP Telecom Operator & Internet Service Provider as well 202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.174.125.0/24 AS9498 BBIL-AP BHARTI Airtel Ltd. 202.179.134.0/24 AS23966 LDN-AS-PK LINKdotNET Telecom Limited 203.23.1.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.24.38.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.30.127.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.86.0/23 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.86.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.87.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.142.219.0/24 AS45149 203.191.48.0/20 AS24175 VINAREN-AS-AP VietNam Research and Education Network 203.191.56.0/21 AS38042 INCOMNET-MONGOLIA-AS-AP Incomnet LLC, Mongolia, VSAT and Wireless service 204.9.32.0/24 AS25617 204.9.33.0/24 AS25617 204.9.34.0/24 AS25617 204.9.35.0/24 AS25617 204.9.116.0/22 AS30097 NUWAVE - NuWave 204.10.88.0/21 AS3356 LEVEL3 Level 3 Communications 204.10.92.0/23 AS30097 NUWAVE - NuWave 204.10.94.0/23 AS30097 NUWAVE - NuWave 204.15.208.0/22 AS13706 COMPLETEWEBNET - CompleteWeb.Net LLC 204.69.144.0/24 AS27283 RJF-INTERNET - Raymond James Financial, Inc. 204.106.16.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.115.14.0/23 AS35910 204.115.101.0/24 AS35954 204.115.110.0/23 AS53709 204.115.250.0/24 AS32880 SMOOTHSTONE-IP-COMMUNICATIONS-CORP - Smoothstone IP Communications Corporation 204.115.251.0/24 AS32880 SMOOTHSTONE-IP-COMMUNICATIONS-CORP - Smoothstone IP Communications Corporation 204.115.252.0/23 AS32880 SMOOTHSTONE-IP-COMMUNICATIONS-CORP - Smoothstone IP Communications Corporation 204.187.11.0/24 AS51113 ELEKTA-AS Elekta 204.225.173.0/24 AS6407 PRIMUS-AS6407 - Primus Telecommunications Canada Inc. 205.159.44.0/24 AS40157 ADESA-CORP-AS - ADESA Corp 205.207.66.0/24 AS15290 ALLST-15290 - Allstream Corp. 205.211.160.0/24 AS30045 UHN-ASN - University Health Network 205.236.71.0/24 AS852 ASN852 - TELUS Communications Inc. 206.81.112.0/20 AS32618 ADKNO-KC - Adknowledge, Inc. 206.197.184.0/24 AS23304 DATOTEL-STL-AS - Datotel LLC, a NetLabs LLC Company 206.221.176.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.177.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.178.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.179.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.180.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.181.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.182.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.183.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.184.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.185.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.186.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.187.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.188.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.189.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.190.0/24 AS27431 JTLNET - JTL Networks Inc. 206.221.191.0/24 AS27431 JTLNET - JTL Networks Inc. 207.174.131.0/24 AS26116 INDRA - Indra's Net Inc 207.174.132.0/23 AS26116 INDRA - Indra's Net Inc 207.174.152.0/23 AS26116 INDRA - Indra's Net Inc 207.174.154.0/24 AS26116 INDRA - Indra's Net Inc 207.174.155.0/24 AS26116 INDRA - Indra's Net Inc 207.174.200.0/24 AS22658 EARTHNET - Earthnet, Inc. 207.174.248.0/21 AS6653 PRIVATEI - privateI, LLC 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc. 207.254.128.0/21 AS30689 FLOW-NET - FLOW 207.254.128.0/24 AS30689 FLOW-NET - FLOW 207.254.136.0/21 AS30689 FLOW-NET - FLOW 208.64.168.0/21 AS8121 TCH - TCH Network Services 208.66.120.0/22 AS32757 208.66.225.0/24 AS3549 GBLX Global Crossing Ltd. 208.66.227.0/24 AS3549 GBLX Global Crossing Ltd. 208.68.180.0/22 AS4323 TWTC - tw telecom holdings, inc. 208.69.24.0/23 AS4277 208.69.26.0/23 AS4277 208.74.224.0/22 AS174 COGENT Cogent/PSI 208.75.152.0/21 AS32146 208.76.20.0/24 AS31812 208.76.21.0/24 AS31812 208.77.132.0/24 AS40273 208.77.164.0/24 AS22659 208.77.165.0/24 AS22659 208.77.166.0/24 AS22659 208.77.167.0/24 AS22659 208.83.53.0/24 AS40569 YGOMI-AS - Ygomi LLC 208.84.232.0/24 AS33131 208.84.234.0/24 AS33131 208.84.237.0/24 AS33131 208.84.238.0/24 AS33131 208.85.116.0/23 AS25956 ALPHEUS - Alpheus Data Services, L.L.C. 208.85.212.0/22 AS32618 ADKNO-KC - Adknowledge, Inc. 208.89.32.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.33.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.34.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.35.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.80.0/23 AS23485 208.89.82.0/23 AS40569 YGOMI-AS - Ygomi LLC 208.90.64.0/22 AS16415 208.91.72.0/24 AS17361 BRASS - Sungard Trading System (ASC) 208.91.73.0/24 AS17361 BRASS - Sungard Trading System (ASC) 208.91.76.0/23 AS21681 ANDOVER-TRADING - ANDOVER TRADING 208.91.164.0/22 AS46099 208.92.224.0/22 AS32757 208.117.128.0/18 AS36859 209.87.144.0/21 AS21919 209.87.152.0/22 AS21919 209.87.156.0/24 AS21919 209.87.157.0/24 AS21919 209.87.158.0/24 AS21919 209.87.159.0/24 AS21919 209.161.96.0/20 AS8039 CCC-ASN-1 - Cinergy Communications 209.177.64.0/20 AS6461 MFNX MFN - Metromedia Fiber Network 209.193.112.0/20 AS209 ASN-QWEST-US NOVARTIS-DMZ-US 209.209.51.0/24 AS18687 MPOWER-2 - MPOWER COMMUNICATIONS CORP. 209.209.64.0/20 AS46851 IPARADIGMS - iParadigms, LLC 209.212.63.0/24 AS16467 ASN-NEXTWEB-R1 - Nextweb, Inc 209.213.0.0/20 AS33005 ELTOPIA - Eltopia.com, LLC 209.234.112.0/23 AS32252 209.234.114.0/23 AS32252 209.234.116.0/24 AS32252 209.234.117.0/24 AS32252 209.234.118.0/24 AS32252 209.234.119.0/24 AS32252 209.234.120.0/24 AS32252 209.234.121.0/24 AS32252 209.234.122.0/24 AS32252 212.119.32.0/19 AS12550 213.184.64.0/24 AS13071 213.184.65.0/24 AS13071 213.184.66.0/24 AS13071 213.184.67.0/24 AS13071 213.184.68.0/24 AS13071 213.184.69.0/24 AS13071 213.184.70.0/24 AS13071 213.184.71.0/24 AS13071 213.184.72.0/24 AS13071 213.184.73.0/24 AS13071 213.184.74.0/24 AS13071 213.184.75.0/24 AS13071 213.184.76.0/24 AS13071 213.184.77.0/24 AS13071 213.184.78.0/24 AS13071 216.12.163.0/24 AS26627 AS-PILOSOFT - Pilosoft, Inc. 216.14.64.0/20 AS14728 216.146.0.0/19 AS11915 TELWEST-NETWORK-SVCS-STATIC - TEL WEST COMMUNICATIONS LLC 216.152.24.0/22 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.170.96.0/24 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 216.170.101.0/24 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 216.170.104.0/24 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 216.170.105.0/24 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 216.234.128.0/22 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. 216.234.132.0/24 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. 216.234.139.0/24 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

DNS and nxdomain hijacking
by Warren Bailey 08 Nov '13

08 Nov '13

All, I've noticed a lot more nxdomain redirects on providers (cox, uverse, tmo, etc.) networks lately. How is this being done?? Is it a magic box or some kind of subscription service? Are any of you doing it? //warren

9 10

Cogent packet loss to Verizon in San Jose
by Robert Glover 08 Nov '13

08 Nov '13

Anyone from Cogent around? Normal support channels aren't getting me anywhere. We have been seeing consistent packet loss to Verizon over Cogent in San Jose for several days: HOST: noc-auth1.garlic.com Loss% Snt Last Avg Best Wrst StDev 1. router.garlic.com 0.0% 10 0.4 0.3 0.2 0.4 0.0 2. vl203.mag03.sfo01.atlas.cogentco.com 0.0% 10 2.2 2.3 2.1 2.4 0.1 3. te0-2-0-1.mpd21.sfo01.atlas.cogentco.com 0.0% 10 2.6 2.6 2.4 2.8 0.1 4. be2166.ccr21.sjc01.atlas.cogentco.com 0.0% 10 3.9 3.9 3.7 4.2 0.1 5. be2000.ccr21.sjc03.atlas.cogentco.com 0.0% 10 4.7 4.4 4.3 4.7 0.1 6. verizon.sjc03.atlas.cogentco.com 40.0% 10 80.0 80.8 79.9 81.8 0.7 7. so-1-0-0-0.SJC01-CORE-RTR1.verizon-gni.net 30.0% 10 82.2 87.9 81.1 114.6 11.3 8. A8-0-1710.SNFCCA-DSL-01.verizon-gni.net 30.0% 10 83.2 83.8 82.1 85.9 1.3 9. static-71-116-125-210.snfcca.dsl-w.verizon.net 20.0% 10 108.1 107.2 105.7 108.7 1.1 We have had to route some customer's traffic out through our alternate provider (AS20115), as their VPN's were borked by the packet loss. Thanks, -Bobby

3 2