- Test - lists.nanog.org

DDOS hardware appliances for network security - Arbor Pravail APS vs nsFocus ADS 6020 - Reviews - Feedback
by James Braunegg 02 Dec '12

02 Dec '12

Dear Nanog I would like to start a discussion on network security DDOS hardware appliances, mainly compairing the Arbor Pravail APS device vs the nsFocus ADS6020 device as I am looking at investing in such a product and would love to hear some industry feedback, reviews, information and from vendors etc. To provide some background information we are looking at a device for inline filtering to clean / filter out unwanted traffc inbound towards our network automaticaly. That being said I'm also happy to hear from other suppliers of appliances (not sure who else there is) or recomendations. For those who don't know much about either device the Arbor Pravail fact sheet can be found here http://www.arbornetworks.com/component/docman/doc_download/498-pravail-aps-… Like wise the fact sheet for the nsFocus ADS product can be found here http://www.nsfocus.com/en/uploadfile/Product/ADS/Datasheet/NSFOCUS%20ADS%20… Until recently I was only aware of the Arbor device, although after doing some research I quicky came up with another options, I'm sure many other people have asked / looked into the same questions before so let the debate begin... Kindest Regards James Braunegg W: 1300 769 972 | M: 0488 997 207 | D: (03) 9751 7616 E: james.braunegg(a)micron21.com<mailto:james.braunegg@micron21.com> | ABN: 12 109 977 666 [Description: Description: Description: Description: M21.jpg] This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.

1 0

Fwd: [tor-talk] William was raided for running a Tor exit node. Please help if you can.
by Mitar 02 Dec '12

02 Dec '12

Hi! Forwarding my answer to tor-talk list. Mitar ---------- Forwarded message ---------- From: Mitar <mmitar(a)gmail.com> Date: Sat, Dec 1, 2012 at 12:29 AM Subject: Re: [tor-talk] William was raided for running a Tor exit node. Please help if you can. To: tor-talk(a)lists.torproject.org Cc: nanog(a)nanog.org Hi! On Fri, Nov 30, 2012 at 2:09 PM, Naslund, Steve <SNaslund(a)medline.com> wrote: > Remember, they did not raid the Tor exit node. They raided the home of > the guy running the Tor exit node. Way different. I can probably explain that. We were running a Tor exit node in Slovenia (neighboring country of Austria, EU too). We had Tor exit node on collocation at local ISP and the collocation was on friend's name (not on some legal entity). Twice they came to his home in early hours with warrant for all computer equipment he has at home. Once because somebody was using Tor for blackmailing, the second time for child pornography. Why they came to his home? I believe the reason is simple: they have IP, they write to ISP something like "Who is your client who had that and that IP at that and that time?" ISP responds: "This is X Y, living there and there and + some other personal information they have on who this person is." Criminal investigators go to the judge and say "We need a warrant for this and this person at this and this location." They get one and they come to visit you in early morning hours. In both cases he just had to explain that: 1) this IP is at collocation and not at that location and 2) that it is a Tor exit node and we do not keep any logs of activity through it. 1) tells makes their warrant invalid and you move from being a suspect (they had in mind that you are using your own home connection to do something illegal, this is the highest probability based on their information) to a witness (you are server admin and it is higher probability that some your user did something illegal). 2) tells them that even if you are a witness, you are worthless witness: you do not have typical users and services, and you are not even logging anything. For most services you are not really required to log anything. Running Tor is not illegal. Having logs for it also not required. They left without taking anything and he hasn't heard from them afterwards (this was few years ago). It might be because both cases were international (Interpol) so for local investigators it was the easiest to just write: it was Tor exit nodes, no logs possible to obtain, case closed. And move on with their lives. If it would be some local thing with a very motivated investigator they might not believe him and would still confiscate equipment. But from a point when they discover that their warrant is probably wrong they are on thin ice as obviously IP was physically somewhere else. It might be that in this case of a guy from Austria he didn't know that it raid is for Tor node but he thought that it might be for something else and just later on discovered that. Or that they simply didn't listen to or believe him. Probably it depends on how you communicate with investigators and your language skills. Mitar

1 0

When an ISP should run their own IRR for customers
by ML 02 Dec '12

02 Dec '12

I'm querying the community on the feasibility of running my own IRR on behalf of customers whom probably aren't/won't register their own objects. I'm going down this path since I don't believe RADB or ARIN would let me register objects on behalf of my customers. I know I'm going to need this in the near future once my AS starts to peer. Conservatively I would be proxy registering about 100 customers. Would a potential upstream/peer NOT want to query my IRR because I'm not RADB, ARIN, etc (Essentially not a well known registry)? If not, is it likely my IRR could get mirrored by RADB so other networks can retrieve good info via RADB. If I was to run my own IRR is Merit's IRRd they way to go or is there something better? Thanks

2 1

Re: William was raided for running a Tor exit node. Please help if you can.
by Anne P. Mitchell, Esq. 01 Dec '12

01 Dec '12

> Example of an actual warrant: > > > https://www.eff.org/sites/default/files/filenode/inresearchBC/EXHIBIT-A.pdf Please also keep in mind, if it's relevant, that *no warrant* is required for data that is stored by a third-party. Data on a server, TOR or otherwise, would by definition be data that is stored by a third party. Which means that if there is a person of interest (POI), it would not be terribly hard to get at personal information about the POI that is not on their own private machines. (Here is an article we wrote about that: http://www.theinternetpatrol.com/no-warrant-necessary-for-law-enforcement-t… ) > Not a lawyer. Is a lawyer, but hasn't been following this thread. That said, if there are specific questions, I'd be happy to answer them if I can. Anne Anne P. Mitchell, Esq CEO/President Institute for Social Internet Public Policy http://www.ISIPP.com Member, Cal. Bar Cyberspace Law Committee

1 0

[liberationtech] Internet back in Syria
by Eugen Leitl 01 Dec '12

01 Dec '12

----- Forwarded message from Rafal Rohozinski <r.rohozinski(a)psiphon.ca> ----- From: Rafal Rohozinski <r.rohozinski(a)psiphon.ca> Date: Sat, 1 Dec 2012 10:39:24 -0500 To: liberationtech Technologies <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] Internet back in Syria Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Secdev detected BGP announcements from Syria as of 7:30 AM Eastern standard time. For our initial monitoring we look at the updates that are broadcast, because dumps of those are available every 15 minutes. However a more complete status is available every two hours, which will provide better insight into when the return of the address space was stabilized. How resources across the country are now reporting connectivity in a number of cities. Rafal Sent by SecDev secure mobile. Please excuse typos or other oddities. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

BGP Update Report
by cidr-report＠potaroo.net 30 Nov '12

30 Nov '12

BGP Update Report Interval: 22-Nov-12 -to- 29-Nov-12 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS37113 100140 5.0% 2328.8 -- tangerine-ug-as 2 - AS37044 46614 2.3% 2330.7 -- Tangerine-AS 3 - AS8402 43314 2.2% 23.0 -- CORBINA-AS OJSC "Vimpelcom" 4 - AS36915 39112 1.9% 1504.3 -- AFOL-KE-AS 5 - AS3909 38402 1.9% 9600.5 -- QWEST-AS-3908 - Qwest Communications Company, LLC 6 - AS9829 33612 1.7% 41.5 -- BSNL-NIB National Internet Backbone 7 - AS35228 30715 1.5% 117.7 -- BEUNLIMITED Avatar Broadband Limited 8 - AS24757 25237 1.3% 467.4 -- EthioNet-AS 9 - AS29039 22891 1.1% 2543.4 -- AFRICAONLINE-UG Africa Online Uganda 10 - AS22561 22032 1.1% 1049.1 -- DIGITAL-TELEPORT - Digital Teleport Inc. 11 - AS10620 20644 1.0% 11.3 -- Telmex Colombia S.A. 12 - AS29049 14202 0.7% 43.0 -- DELTA-TELECOM-AS Delta Telecom LTD. 13 - AS29032 13570 0.7% 424.1 -- DATANET-UG DATANET LLC 14 - AS7922 13144 0.7% 1460.4 -- COMCAST-7922 - Comcast Cable Communications, Inc. 15 - AS21491 13083 0.7% 1189.4 -- UGANDA-TELECOM Uganda Telecom 16 - AS37048 12852 0.6% 918.0 -- Foris-Uganda 17 - AS2708 12204 0.6% 89.1 -- Universidad de Guanajuato 18 - AS9808 11887 0.6% 14.2 -- CMNET-GD Guangdong Mobile Communication Co.Ltd. 19 - AS13118 11121 0.6% 556.0 -- ASN-YARTELECOM OJSC Rostelecom 20 - AS43695 10630 0.5% 10630.0 -- LISNER_AS UNIQ LISNER Sp. z o.o. TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS43695 10630 0.5% 10630.0 -- LISNER_AS UNIQ LISNER Sp. z o.o. 2 - AS3909 38402 1.9% 9600.5 -- QWEST-AS-3908 - Qwest Communications Company, LLC 3 - AS24057 6660 0.3% 6660.0 -- AIGL-AS-AP PT. AIA FINANCIAL, Insurance company, Indonesia 4 - AS6629 8545 0.4% 4272.5 -- NOAA-AS - NOAA 5 - AS19406 4173 0.2% 4173.0 -- TWRS-MA - Towerstream I, Inc. 6 - AS2033 3822 0.2% 3822.0 -- PANIX - Panix Network Information Center 7 - AS29039 22891 1.1% 2543.4 -- AFRICAONLINE-UG Africa Online Uganda 8 - AS37115 2333 0.1% 2333.0 -- TMP-UG 9 - AS37044 46614 2.3% 2330.7 -- Tangerine-AS 10 - AS37113 100140 5.0% 2328.8 -- tangerine-ug-as 11 - AS14680 6902 0.3% 2300.7 -- REALE-6 - Auction.com 12 - AS37273 5777 0.3% 1925.7 -- BCS 13 - AS37156 9253 0.5% 1850.6 -- XTRANET 14 - AS57918 1740 0.1% 1740.0 -- ACOD-AS ACOD CJSC 15 - AS6197 1642 0.1% 1642.0 -- BATI-ATL - BellSouth Network Solutions, Inc 16 - AS36915 39112 1.9% 1504.3 -- AFOL-KE-AS 17 - AS7922 13144 0.7% 1460.4 -- COMCAST-7922 - Comcast Cable Communications, Inc. 18 - AS9950 2508 0.1% 1254.0 -- PUBNETPLUS2-AS-KR DACOM 19 - AS51122 1210 0.1% 1210.0 -- SIT-CORP-AS Sitronics, AO 20 - AS36529 2416 0.1% 1208.0 -- AXXA-RACKCO - Rackco.com TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 151.118.18.0/24 12818 0.6% AS3909 -- QWEST-AS-3908 - Qwest Communications Company, LLC 2 - 151.118.255.0/24 12790 0.6% AS3909 -- QWEST-AS-3908 - Qwest Communications Company, LLC 3 - 151.118.254.0/24 12790 0.6% AS3909 -- QWEST-AS-3908 - Qwest Communications Company, LLC 4 - 184.159.130.0/23 10892 0.5% AS22561 -- DIGITAL-TELEPORT - Digital Teleport Inc. 5 - 184.157.224.0/19 10824 0.5% AS22561 -- DIGITAL-TELEPORT - Digital Teleport Inc. 6 - 93.181.254.0/23 10640 0.5% AS13118 -- ASN-YARTELECOM OJSC Rostelecom 7 - 91.198.110.0/24 10630 0.5% AS43695 -- LISNER_AS UNIQ LISNER Sp. z o.o. 8 - 202.14.255.0/24 6660 0.3% AS24057 -- AIGL-AS-AP PT. AIA FINANCIAL, Insurance company, Indonesia 9 - 23.67.247.0/24 6541 0.3% AS7922 -- COMCAST-7922 - Comcast Cable Communications, Inc. 10 - 184.51.102.0/24 6537 0.3% AS7922 -- COMCAST-7922 - Comcast Cable Communications, Inc. 11 - 12.139.133.0/24 5626 0.3% AS14680 -- REALE-6 - Auction.com 12 - 203.28.157.0/24 5167 0.2% AS4802 -- ASN-IINET iiNet Limited 13 - 139.139.19.0/24 4939 0.2% AS1562 -- DNIC-ASBLK-01550-01601 - DoD Network Information Center 14 - 194.63.9.0/24 4636 0.2% AS1273 -- CW Cable and Wireless Worldwide plc 15 - 192.58.232.0/24 4515 0.2% AS6629 -- NOAA-AS - NOAA 16 - 123.252.208.0/24 4446 0.2% AS17762 -- HTIL-TTML-IN-AP Tata Teleservices Maharashtra Ltd 17 - 49.248.72.0/21 4226 0.2% AS17762 -- HTIL-TTML-IN-AP Tata Teleservices Maharashtra Ltd 18 - 69.38.178.0/24 4173 0.2% AS19406 -- TWRS-MA - Towerstream I, Inc. 19 - 192.58.2.0/24 4030 0.2% AS6629 -- NOAA-AS - NOAA 20 - 209.48.168.0/24 3822 0.2% AS2033 -- PANIX - Panix Network Information Center Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

The Cidr Report
by cidr-report＠potaroo.net 30 Nov '12

30 Nov '12

This report has been generated at Fri Nov 30 21:13:10 2012 AEST. The report analyses the BGP Routing Table of AS2.0 router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org for a current version of this report. Recent Table History Date Prefixes CIDR Agg 23-11-12 435758 251760 24-11-12 435405 251764 25-11-12 435562 251850 26-11-12 435722 251810 27-11-12 435517 251735 28-11-12 435718 251249 29-11-12 435488 251596 30-11-12 435823 252285 AS Summary 42843 Number of ASes in routing system 17809 Number of ASes announcing only one prefix 3196 Largest number of prefixes announced by an AS AS7029 : WINDSTREAM - Windstream Communications Inc 114767072 Largest address span announced by an AS (/32s) AS4134 : CHINANET-BACKBONE No.31,Jin-rong Street Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 30Nov12 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 436867 252206 184661 42.3% All ASes AS6389 3145 152 2993 95.2% BELLSOUTH-NET-BLK - BellSouth.net Inc. AS28573 2169 67 2102 96.9% NET Servicos de Comunicao S.A. AS4766 2942 918 2024 68.8% KIXS-AS-KR Korea Telecom AS17974 2431 540 1891 77.8% TELKOMNET-AS2-AP PT Telekomunikasi Indonesia AS7029 3196 1450 1746 54.6% WINDSTREAM - Windstream Communications Inc AS18566 2083 423 1660 79.7% COVAD - Covad Communications Co. AS22773 1938 318 1620 83.6% ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. AS10620 2261 653 1608 71.1% Telmex Colombia S.A. AS7303 1666 395 1271 76.3% Telecom Argentina S.A. AS4323 1595 400 1195 74.9% TWTC - tw telecom holdings, inc. AS4755 1625 539 1086 66.8% TATACOMM-AS TATA Communications formerly VSNL is Leading ISP AS7552 1142 188 954 83.5% VIETEL-AS-AP Vietel Corporation AS8151 1610 703 907 56.3% Uninet S.A. de C.V. AS7545 1815 943 872 48.0% TPG-INTERNET-AP TPG Internet Pty Ltd AS18101 1017 173 844 83.0% RELIANCE-COMMUNICATIONS-IN Reliance Communications Ltd.DAKC MUMBAI AS1785 1934 1158 776 40.1% AS-PAETEC-NET - PaeTec Communications, Inc. AS4808 1126 350 776 68.9% CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network AS13977 861 118 743 86.3% CTELCO - FAIRPOINT COMMUNICATIONS, INC. AS2118 784 85 699 89.2% RELCOM-AS OOO "NPO Relcom" AS855 707 52 655 92.6% CANET-ASN-4 - Bell Aliant Regional Communications, Inc. AS3356 1116 499 617 55.3% LEVEL3 Level 3 Communications AS17676 704 88 616 87.5% GIGAINFRA Softbank BB Corp. AS22561 1040 430 610 58.7% DIGITAL-TELEPORT - Digital Teleport Inc. AS3549 1049 442 607 57.9% GBLX Global Crossing Ltd. AS24560 1040 440 600 57.7% AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services AS19262 1004 405 599 59.7% VZGNI-TRANSIT - Verizon Online LLC AS36998 772 178 594 76.9% SDN-MOBITEL AS22047 579 22 557 96.2% VTR BANDA ANCHA S.A. AS4780 839 292 547 65.2% SEEDNET Digital United Inc. AS18881 596 49 547 91.8% Global Village Telecom Total 44786 12470 32316 72.2% Top 30 total Possible Bogus Routes 10.86.64.32/30 AS65530 -Private Use AS- 10.86.64.36/30 AS65530 -Private Use AS- 10.86.65.32/30 AS65530 -Private Use AS- 10.86.65.36/30 AS65530 -Private Use AS- 10.255.255.0/30 AS65530 -Private Use AS- 10.255.255.4/30 AS65530 -Private Use AS- 10.255.255.8/30 AS65530 -Private Use AS- 27.112.114.0/24 AS23884 PROENNET-AS Proimage Engineering and Communication Co.,Ltd. 41.222.80.0/21 AS37110 moztel-as 41.223.108.0/22 AS36966 EDL_AS Edgenet AS 62.12.96.0/19 AS38478 SUNNYVISION-AS-AP SunnyVision Limited 62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV 62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV 64.66.32.0/20 AS18864 64.187.208.0/24 AS174 COGENT Cogent/PSI 64.187.209.0/24 AS23005 SWITCH-COMMUNICATIONS - SWITCH Communications Group LLC 65.111.1.0/24 AS32258 SDNGLOBAL - SDN Global 66.171.32.0/20 AS705 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.245.176.0/20 AS19318 NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC 66.251.128.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.133.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.134.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.136.0/21 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.140.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.141.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.142.0/24 AS33227 BLUEBRIDGE-NETWORKS - Blue Bridge Networks 66.251.143.0/24 AS3356 LEVEL3 Level 3 Communications 69.46.224.0/20 AS32592 HUNT-BROTHERS-OF-LOUISIANA-LLC - Hunt Brothers 69.46.233.0/24 AS32592 HUNT-BROTHERS-OF-LOUISIANA-LLC - Hunt Brothers 69.46.236.0/24 AS32592 HUNT-BROTHERS-OF-LOUISIANA-LLC - Hunt Brothers 69.165.92.0/24 AS20077 IPNETZONE-ASN - IPNetZone 71.19.134.0/23 AS3313 INET-AS BT Italia S.p.A. 72.35.224.0/22 AS30097 NUWAVE - NuWave 72.35.229.0/24 AS30188 TELEVERGENCE - Televergence Solutions Inc. 72.35.232.0/21 AS30097 NUWAVE - NuWave 72.44.16.0/20 AS15054 NORTHEAST-TEXAS-BROADBAND-LLC - Northeast Texas Broadband, LLC 74.91.48.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.49.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.50.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.51.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.52.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.53.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.54.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.55.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.56.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.57.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.58.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.59.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.60.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.61.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.62.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.91.63.0/24 AS30137 SEA-BROADBAND - Sea Broadband, LLC 74.115.124.0/23 AS46540 NARSASN - National Asset Recovery Services, Inc 81.4.0.0/18 AS38478 SUNNYVISION-AS-AP SunnyVision Limited 81.22.64.0/20 AS5511 OPENTRANSIT France Telecom S.A. 82.101.160.0/19 AS5511 OPENTRANSIT France Telecom S.A. 91.213.138.0/24 AS33991 SKALA-AS Company Skala, Ltd 91.217.250.0/24 AS43108 GARM-AS Garm Technologies Ltd. 100.100.0.0/24 AS4847 CNIX-AP China Networks Inter-Exchange 102.2.88.0/22 AS38456 PACTEL-AS-AP Pacific Teleports. 110.34.44.0/22 AS12653 COMTONET KB Impuls Hellas S.A. 116.206.72.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 116.206.85.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 116.206.103.0/24 AS6461 MFNX MFN - Metromedia Fiber Network 117.120.56.0/21 AS4755 TATACOMM-AS TATA Communications formerly VSNL is Leading ISP 121.46.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 142.54.0.0/19 AS23498 CDSI - Cogeco Data Services LP 172.102.0.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 172.116.0.0/24 AS7018 ATT-INTERNET4 - AT&T Services, Inc. 185.11.224.0/22 AS19829 WAVE-MAX Wave-Max S.r.L. 200.1.112.0/24 AS29754 GO2TEL GO2TEL.COM INC. 200.53.0.0/19 AS13878 Diveo do Brasil Telecomunicacoes Ltda 200.58.248.0/21 AS27849 202.1.224.0/24 AS10097 FLOWCOM Flow Communications 2/541 Kent St Sydney NSW 2000 202.8.106.0/24 AS9530 SHINSEGAE-AS SHINSEGAE I&C Co., Ltd. 202.58.113.0/24 AS19161 202.65.96.0/20 AS2706 PI-HK Pacnet Internet (Hong Kong) Limited 202.73.240.0/20 AS2706 PI-HK Pacnet Internet (Hong Kong) Limited 202.83.120.0/21 AS37972 202.83.124.0/24 AS37972 202.83.125.0/24 AS37972 202.83.126.0/24 AS37972 202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.174.125.0/24 AS9498 BBIL-AP BHARTI Airtel Ltd. 202.176.1.0/24 AS9942 COMINDICO-AP SOUL Converged Communications Australia 202.179.134.0/24 AS23966 LDN-AS-PK LINKdotNET Telecom Limited 203.23.1.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.24.38.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.30.127.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.86.0/23 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.86.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.87.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.188.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.142.219.0/24 AS45149 204.9.116.0/22 AS30097 NUWAVE - NuWave 204.10.88.0/21 AS3356 LEVEL3 Level 3 Communications 204.10.92.0/23 AS30097 NUWAVE - NuWave 204.10.94.0/23 AS30097 NUWAVE - NuWave 205.175.214.0/24 AS5583 ORANGE-BUSINESS-SERVICES-BENELUX France Telecom S.A. 206.197.184.0/24 AS23304 DATOTEL-STL-AS - Datotel LLC, a NetLabs LLC Company 207.174.131.0/24 AS26116 INDRA - Indra's Net Inc 207.174.132.0/23 AS26116 INDRA - Indra's Net Inc 207.174.152.0/23 AS26116 INDRA - Indra's Net Inc 207.174.154.0/24 AS26116 INDRA - Indra's Net Inc 207.174.155.0/24 AS26116 INDRA - Indra's Net Inc 207.174.200.0/24 AS22658 EARTHNET - Earthnet, Inc. 207.174.248.0/21 AS6653 PRIVATEI - privateI, LLC 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc. 207.254.128.0/21 AS30689 FLOW-NET - FLOW 207.254.128.0/24 AS30689 FLOW-NET - FLOW 207.254.136.0/21 AS30689 FLOW-NET - FLOW 207.254.138.0/24 AS30689 FLOW-NET - FLOW 207.254.140.0/24 AS30689 FLOW-NET - FLOW 208.83.53.0/24 AS40569 YGOMI-AS - Ygomi LLC 208.89.32.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.33.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.34.0/24 AS27431 JTLNET - JTL Networks Inc. 208.89.35.0/24 AS27431 JTLNET - JTL Networks Inc. 209.148.64.0/19 AS13773 TELNETCOMM - Telnet Communications 209.177.64.0/20 AS6461 MFNX MFN - Metromedia Fiber Network 209.213.0.0/20 AS33005 ELTOPIA - Eltopia.com, LLC 213.150.204.0/24 AS29338 AFOL-AS Used by Africaonline Operations 216.12.160.0/20 AS26627 AS-PILOSOFT - Pilosoft, Inc. 216.21.160.0/20 AS27876 American Data Networks 216.146.0.0/19 AS11915 TELWEST-NETWORK-SVCS-STATIC - TEL WEST COMMUNICATIONS LLC 216.194.160.0/20 AS27876 American Data Networks 216.227.142.0/23 AS46856 GLOBAL-HOST-AS - The Global Host Exchange 216.227.144.0/21 AS46856 GLOBAL-HOST-AS - The Global Host Exchange 216.234.128.0/22 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. 216.234.132.0/24 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. 216.234.139.0/24 AS14545 ADR-DRIVING-RECORDS - AMERICAN DRIVING RECORDS, INC. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 30 Nov '12

30 Nov '12

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 01 Dec, 2012 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 434185 Prefixes after maximum aggregation: 180393 Deaggregation factor: 2.41 Unique aggregates announced to Internet: 212775 Total ASes present in the Internet Routing Table: 42729 Prefixes per ASN: 10.16 Origin-only ASes present in the Internet Routing Table: 33874 Origin ASes announcing only one prefix: 15815 Transit ASes present in the Internet Routing Table: 5690 Transit-only ASes present in the Internet Routing Table: 135 Average AS path length visible in the Internet Routing Table: 4.6 Max AS path length visible: 41 Max AS path prepend of ASN ( 22394) 35 Prefixes from unregistered ASNs in the Routing Table: 1103 Unregistered ASNs in the Routing Table: 406 Number of 32-bit ASNs allocated by the RIRs: 3544 Number of 32-bit ASNs visible in the Routing Table: 3165 Prefixes from 32-bit ASNs in the Routing Table: 8591 Special use prefixes present in the Routing Table: 15 Prefixes being announced from unallocated address space: 146 Number of addresses announced to Internet: 2614823628 Equivalent to 155 /8s, 219 /16s and 10 /24s Percentage of available address space announced: 70.6 Percentage of allocated address space announced: 70.6 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 93.9 Total number of prefixes smaller than registry allocations: 153016 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 104809 Total APNIC prefixes after maximum aggregation: 32640 APNIC Deaggregation factor: 3.21 Prefixes being announced from the APNIC address blocks: 105681 Unique aggregates announced from the APNIC address blocks: 43268 APNIC Region origin ASes present in the Internet Routing Table: 4800 APNIC Prefixes per ASN: 22.02 APNIC Region origin ASes announcing only one prefix: 1244 APNIC Region transit ASes present in the Internet Routing Table: 786 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 26 Number of APNIC region 32-bit ASNs visible in the Routing Table: 375 Number of APNIC addresses announced to Internet: 715311872 Equivalent to 42 /8s, 162 /16s and 203 /24s Percentage of available APNIC address space announced: 83.6 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 131072-133119 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 155613 Total ARIN prefixes after maximum aggregation: 78549 ARIN Deaggregation factor: 1.98 Prefixes being announced from the ARIN address blocks: 156347 Unique aggregates announced from the ARIN address blocks: 69911 ARIN Region origin ASes present in the Internet Routing Table: 15313 ARIN Prefixes per ASN: 10.21 ARIN Region origin ASes announcing only one prefix: 5771 ARIN Region transit ASes present in the Internet Routing Table: 1598 Average ARIN Region AS path length visible: 4.1 Max ARIN Region AS path length visible: 41 Number of ARIN region 32-bit ASNs visible in the Routing Table: 18 Number of ARIN addresses announced to Internet: 1087539840 Equivalent to 64 /8s, 210 /16s and 138 /24s Percentage of available ARIN address space announced: 57.5 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 110794 Total RIPE prefixes after maximum aggregation: 57939 RIPE Deaggregation factor: 1.91 Prefixes being announced from the RIPE address blocks: 113671 Unique aggregates announced from the RIPE address blocks: 73036 RIPE Region origin ASes present in the Internet Routing Table: 16973 RIPE Prefixes per ASN: 6.70 RIPE Region origin ASes announcing only one prefix: 8130 RIPE Region transit ASes present in the Internet Routing Table: 2750 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 2051 Number of RIPE addresses announced to Internet: 648513060 Equivalent to 38 /8s, 167 /16s and 134 /24s Percentage of available RIPE address space announced: 94.3 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 196608-199679 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 44625 Total LACNIC prefixes after maximum aggregation: 8910 LACNIC Deaggregation factor: 5.01 Prefixes being announced from the LACNIC address blocks: 48145 Unique aggregates announced from the LACNIC address blocks: 22869 LACNIC Region origin ASes present in the Internet Routing Table: 1732 LACNIC Prefixes per ASN: 27.80 LACNIC Region origin ASes announcing only one prefix: 496 LACNIC Region transit ASes present in the Internet Routing Table: 330 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 27 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 715 Number of LACNIC addresses announced to Internet: 120089384 Equivalent to 7 /8s, 40 /16s and 107 /24s Percentage of available LACNIC address space announced: 71.6 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 262144-263167 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 9637 Total AfriNIC prefixes after maximum aggregation: 2298 AfriNIC Deaggregation factor: 4.19 Prefixes being announced from the AfriNIC address blocks: 10195 Unique aggregates announced from the AfriNIC address blocks: 3564 AfriNIC Region origin ASes present in the Internet Routing Table: 578 AfriNIC Prefixes per ASN: 17.64 AfriNIC Region origin ASes announcing only one prefix: 174 AfriNIC Region transit ASes present in the Internet Routing Table: 131 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 16 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 6 Number of AfriNIC addresses announced to Internet: 43071488 Equivalent to 2 /8s, 145 /16s and 56 /24s Percentage of available AfriNIC address space announced: 42.8 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2942 11557 900 Korea Telecom (KIX) 17974 2431 826 46 PT TELEKOMUNIKASI INDONESIA 7545 1811 301 90 TPG Internet Pty Ltd 4755 1625 374 159 TATA Communications formerly 9829 1412 1155 42 BSNL National Internet Backbo 9583 1182 88 499 Sify Limited 7552 1142 1062 11 Vietel Corporation 4808 1126 2056 317 CNCGROUP IP network: China169 24560 1040 385 165 Bharti Airtel Ltd., Telemedia 9498 1032 310 74 BHARTI Airtel Ltd. Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7029 3196 994 218 Windstream Communications Inc 6389 3145 3719 148 bellsouth.net, inc. 18566 2083 382 180 Covad Communications 22773 1938 2932 131 Cox Communications, Inc. 1785 1935 678 124 PaeTec Communications, Inc. 20115 1684 1607 625 Charter Communications 4323 1589 1153 394 Time Warner Telecom 30036 1360 280 750 Mediacom Communications Corp 7018 1279 10275 848 AT&T WorldNet Services 7011 1223 334 693 Citizens Utilities Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1715 544 16 Corbina telecom 12479 856 777 64 Uni2 Autonomous System 34984 849 210 215 BILISIM TELEKOM 2118 784 97 15 EUnet/RELCOM Autonomous Syste 13188 742 94 132 Educational Network 31148 738 38 13 FreeNet ISP 6830 717 2313 436 UPC Distribution Services 20940 705 227 545 Akamai Technologies European 8551 603 367 39 Bezeq International 58113 603 68 366 LIR DATACENTER TELECOM SRL Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 2261 386 206 TVCABLE BOGOTA 28573 2160 1285 66 NET Servicos de Comunicao S.A 7303 1668 1138 201 Telecom Argentina Stet-France 8151 1601 3022 356 UniNet S.A. de C.V. 6503 1538 435 67 AVANTEL, S.A. 27947 754 77 92 Telconet S.A 3816 659 309 70 Empresa Nacional de Telecomun 11172 603 85 68 Servicios Alestra S.A de C.V 18881 595 716 18 Global Village Telecom 7738 579 1178 33 Telecomunicacoes da Bahia S.A Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 873 274 36 LINKdotNET AS number 36998 772 48 3 MOBITEL 8452 536 958 13 TEDATA 6713 519 666 20 Itissalat Al-MAGHRIB 24835 289 80 8 RAYA Telecom - Egypt 3741 268 906 225 The Internet Solution 12258 194 28 66 Vodacom Internet Company 15706 191 32 6 Sudatel Internet Exchange Aut 29975 191 667 21 Vodacom 16637 179 697 88 MTN Network Solutions Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 7029 3196 994 218 Windstream Communications Inc 6389 3145 3719 148 bellsouth.net, inc. 4766 2942 11557 900 Korea Telecom (KIX) 17974 2431 826 46 PT TELEKOMUNIKASI INDONESIA 10620 2261 386 206 TVCABLE BOGOTA 28573 2160 1285 66 NET Servicos de Comunicao S.A 18566 2083 382 180 Covad Communications 22773 1938 2932 131 Cox Communications, Inc. 1785 1935 678 124 PaeTec Communications, Inc. 7545 1811 301 90 TPG Internet Pty Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6389 3145 2997 bellsouth.net, inc. 17974 2431 2385 PT TELEKOMUNIKASI INDONESIA 28573 2160 2094 NET Servicos de Comunicao S.A 10620 2261 2055 TVCABLE BOGOTA 4766 2942 2042 Korea Telecom (KIX) 18566 2083 1903 Covad Communications 1785 1935 1811 PaeTec Communications, Inc. 22773 1938 1807 Cox Communications, Inc. 7545 1811 1721 TPG Internet Pty Ltd 8402 1715 1699 Corbina telecom Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 59505 UNALLOCATED 5.2.65.0/24 50673 Serverius AS 59505 UNALLOCATED 5.2.66.0/24 50673 Serverius AS 59530 UNALLOCATED 5.8.182.0/24 31261 GARS Telecom 61408 UNALLOCATED 5.56.0.0/21 174 Cogent Communication 61395 UNALLOCATED 5.83.56.0/22 3292 TDC Tele Danmark 59414 UNALLOCATED 5.102.144.0/21 15576 Nextra backbone in D 59395 UNALLOCATED 5.133.16.0/21 3549 Global Crossing 59407 UNALLOCATED 5.134.16.0/21 51167 Giga-Hosting GmbH 59521 UNALLOCATED 5.134.192.0/21 29518 Labs2 59441 UNALLOCATED 5.144.128.0/21 50810 Mobin Net Communicat Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 128.0.0.0/24 2876 Jump Management SRL 128.0.24.0/21 41794 Altline LLC 128.0.64.0/22 49466 Declic Telecom SAS 128.0.68.0/22 49466 Declic Telecom SAS 128.0.72.0/21 23456 32-bit ASN transition 128.0.80.0/20 52041 Timer LTD 128.0.104.0/23 51848 FOP Gabidullina Ludmila Nikol 128.0.106.0/24 23456 32-bit ASN transition 128.0.128.0/20 29285 AMT closed joint-stock compan 128.0.144.0/22 59675 >>UNKNOWN<< Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.112.114.0/24 23884 Proimage Engineering and Comm 41.222.80.0/21 37110 Moztel LDA 41.223.108.0/22 36966 >>UNKNOWN<< 62.12.96.0/19 38478 SunnyVision Limited 62.61.220.0/24 24974 Tachyon Europe BV - Wireless 62.61.221.0/24 24974 Tachyon Europe BV - Wireless 64.66.32.0/20 18864 >>UNKNOWN<< 64.187.208.0/24 174 Cogent Communications 64.187.209.0/24 23005 Power Pulse 65.111.1.0/24 32258 SDN Global Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:13 /10:29 /11:88 /12:243 /13:478 /14:858 /15:1555 /16:12467 /17:6553 /18:10881 /19:21495 /20:30777 /21:32846 /22:43646 /23:40544 /24:227407 /25:1363 /26:1734 /27:885 /28:184 /29:79 /30:17 /31:0 /32:25 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 7029 2620 3196 Windstream Communications Inc 18566 2033 2083 Covad Communications 6389 1781 3145 bellsouth.net, inc. 8402 1424 1715 Corbina telecom 22773 1273 1938 Cox Communications, Inc. 30036 1273 1360 Mediacom Communications Corp 11492 1146 1181 Cable One 6503 1054 1538 AVANTEL, S.A. 1785 1021 1935 PaeTec Communications, Inc. 7011 958 1223 Citizens Utilities Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:646 2:753 3:1 4:13 5:660 6:3 8:488 12:1953 13:3 14:701 15:10 16:3 17:6 20:27 23:217 24:1779 27:1416 31:1297 32:54 33:2 34:2 36:7 37:1057 38:845 39:2 40:140 41:2624 42:179 44:3 46:1699 47:3 49:507 50:619 52:12 54:27 55:7 57:28 58:1067 59:550 60:234 61:1287 62:1026 63:2022 64:4332 65:2200 66:4499 67:2100 68:1165 69:3238 70:926 71:557 72:1893 74:2622 75:479 76:299 77:986 78:1020 79:506 80:1227 81:982 82:632 83:540 84:529 85:1159 86:477 87:960 88:354 89:1744 90:305 91:5352 92:590 93:1574 94:2014 95:1202 96:408 97:323 98:972 99:40 100:31 101:285 103:1868 105:516 106:119 107:202 108:487 109:1669 110:814 111:972 112:459 113:737 114:643 115:898 116:888 117:777 118:962 119:1253 120:376 121:678 122:1738 123:1179 124:1326 125:1290 128:572 129:201 130:294 131:666 132:317 133:143 134:254 135:62 136:215 137:238 138:340 139:168 140:492 141:294 142:499 143:363 144:492 145:83 146:523 147:287 148:735 149:330 150:155 151:221 152:398 153:183 154:22 155:440 156:226 157:375 158:279 159:673 160:335 161:414 162:370 163:192 164:581 165:449 166:479 167:561 168:980 169:130 170:977 171:151 172:6 173:1699 174:640 175:441 176:889 177:1451 178:1681 180:1351 181:178 182:1116 183:303 184:621 185:104 186:2065 187:1437 188:1790 189:1603 190:5975 192:6064 193:5428 194:4395 195:3659 196:1238 197:272 198:3951 199:5098 200:6018 201:1971 202:8803 203:8741 204:4439 205:2554 206:2759 207:2802 208:4067 209:3651 210:2900 211:1527 212:2149 213:1870 214:886 215:74 216:5180 217:1605 218:588 219:311 220:1258 221:533 222:336 223:419 End of report

1 0

Recovering from spam resulting from compromised account
by Dave Sotnick 30 Nov '12

30 Nov '12

Hello, oh knowledgeable NANOG. I am the technical lead for network for Pixar. (Note: I am not the mail admin, he's on vacation.) Yesterday we had an account compromise that resulted in ~2.5M messages being sent through our two MTAs. I have acknowledged/closed the two SpamCop incidents, and mail is starting to flow, slowly, however we are still receiving bounces (some hard!) and I am looking for assistance in getting Pixar's IPs cleared from the blacklists. I was pointed to: http://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a12.25.180.66 http://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a12.25.180.94 Which shows we're still listed on Backscatterer and SPAM Cannibal. Also had reports that we're still seeing bounces to Gmail, Comcast and Yahoo accounts. What can we do to speed things along? We have a ticket open with Gmail folks since we have a studio who uses Gmail for Corporate mail. Any Comcast or Gmail SMTP contacts on NANOG that can help? Would love to get all out stuck mail out of these folks' MTAs. Or do we need to just remove ourselves from the last two blacklists at mxtoolbox? Thanks, David Sotnick -- Pixar Emeryville, CA

5 7

Windows 2008/2012 arp timeout process
by James Stoll 30 Nov '12

30 Nov '12

Greetings Nanog, I apologize in advance if this should be directed towards a server/systems discussion list, but I've noticed some (what I think are) issues with the way windows 2008/2012 handles arp. I started noticing some high arp processes on some of our 6500s running sup720s, and after performing some captures of packets being punted to the cpu I found that there were quite a few repeat sources. After digging into the sources, it looks like windows 2008/2012 systems are sending arp refresh requests quite frequently. According to this article ( http://support.microsoft.com/kb/949589 ), if the neighbor entry is in use for the IP it should not go stale. Specifically: "If the entry is in the "Reachable" state, Windows Vista TCP/IP hosts do not send ARP requests to the network. Therefore, Windows Vista TCP/IP hosts use the information in the cache. If an entry is not used, and it stays in the "Reachable" state for longer than its "Reachable Time" value, the entry changes to the "Stale" state. If an entry is in the "Stale" state, the Windows Vista TCP/IP host must send an ARP request to reach that destination." I know that states Windows Vista, but the "applies to" section lists the other OSes. I've replicated this in my lab (server pinging its own gateway while capturing traffic), and I am seeing the same issue: 222 10:05:18.462720 Dell_a6:dc:52 All-HSRP-routers_0a ARP Who has 10.36.0.1? Tell 10.36.0.31 223 10:05:18.464759 All-HSRP-routers_0a Dell_a6:dc:52 ARP 10.36.0.1 is at 00:00:0c:07:ac:0a 1886 10:06:31.962218 Dell_a6:dc:52 All-HSRP-routers_0a ARP Who has 10.36.0.1? Tell 10.36.0.31 1887 10:06:31.963004 All-HSRP-routers_0a Dell_a6:dc:52 ARP 10.36.0.1 is at 00:00:0c:07:ac:0a 3348 10:07:23.461682 Dell_a6:dc:52 All-HSRP-routers_0a ARP Who has 10.36.0.1? Tell 10.36.0.31 3349 10:07:23.471003 All-HSRP-routers_0a Dell_a6:dc:52 ARP 10.36.0.1 is at 00:00:0c:07:ac:0a I've tried this on various devices, and the only place I don't see this behavior is on wireless interfaces. I'm more of a linux guy, and performing the same tests there I see the behavior stated in this article (which is what I would expect) - http://linux-ip.net/html/ether-arp.html . Specifically: "Entries in the ARP cache are periodically and automatically verified unless continually used." Has anyone run into this issue before ? Have a fix ? Point me to any documentation or other distros that I should ask ? TIA, James

2 2