- Test - lists.nanog.org

Survey on barriers for RPKI adoption
by Sofia Silva Berenguer 08 Sep '24

08 Sep '24

(Apologies for duplicates) Hello everyone, As part of the NRO RPKI Program<https://www.nro.net/technical-coordination/security/certification/#rpki_pro…> we would like to know more about the community’s expectations with regard to consistency in RPKI implementations across the Regional Internet Registries (RIRs). Our end goal is to define what a single, global RPKI system would look like. We want to know more about the experience of managing resources through multiple RIRs in order to understand whether the differences in the RIRs' RPKI implementations are hindering RPKI adoption, more specifically Route Origin Authorization (ROA) creation, and if so, which differences are the most painful. This will allow us to focus on making those aspects of the RPKI system more consistent. Are you a network operator with permissions to create ROAs for IP space allocated by multiple RIRs? If so, we would greatly appreciate your participation in our survey before September 12: https://www.surveymonkey.com/r/CHLHLML We want to hear from those who have already created ROAs as well as those who may be considering creating ROAs but have not yet done so. If this is not you, please consider forwarding this email to anyone else you know who could participate in the survey. Note that survey participants can enter a drawing for the equivalent to USD 35 e-gift voucher (If e-gift vouchers cannot be used in the winner's economy, an alternative gift will be provided). We really appreciate your participation! Warm regards, Sofía -- I am sending this email at a time that suits me and the time zone I work in. Please feel free to read, and act on or respond, at a time that suits you. ____________________________________________________________________ Sofía Silva Berenguer RPKI Program Manager, NRO / Process and Productivity Engineer, APNIC e: sofia(a)apnic.net<mailto:sofia@apnic.net> ____________________________________________________________________

1 1

Spoofer Report for NANOG for Aug 2024
by CAIDA Spoofer Project 08 Sep '24

08 Sep '24

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Aug 2024: ASN Name Fixed-By 55 UPENN 2024-08-06 394195 CLEARNETWORX 2024-08-12 25853 ELJY30540 2024-08-29 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Aug 2024: ASN Name First-Spoofed Last-Spoofed 40676 AS40676 2016-08-29 2024-08-31 27364 ACS-INTERNET 2016-09-27 2024-08-29 1403 EBOX 2016-11-12 2024-08-27 2152 CSUNET-NW 2017-11-08 2024-08-28 33363 BHN-33363 2018-11-29 2024-08-30 21804 ACCESS-SK 2019-06-09 2024-08-25 36352 AS-COLOCROSSING 2020-10-08 2024-08-23 4922 SHENTEL 2021-12-28 2024-08-22 12183 TALKIE-COMMUNICATIONS 2022-12-10 2024-08-31 3701 NERONET 2023-04-18 2024-08-31 400282 2023-04-27 2024-08-30 393577 SCCNET 2023-05-03 2024-08-31 202400 2023-05-08 2024-08-26 61461 Airtek Solutions C.A. 2023-05-13 2024-08-16 394684 WISPERNET 2024-01-17 2024-08-30 214961 2024-05-14 2024-08-30 393530 TLU 2024-05-22 2024-08-28 19935 CRRS 2024-05-29 2024-08-24 398182 BLN 2024-06-17 2024-08-15 216211 2024-06-22 2024-08-23 13371 DUKE-INTERCHANGE 2024-07-03 2024-08-14 57308 Rossvyazinform 2024-08-10 2024-08-24 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Seeking IANA ccTLD contact
by Chad Dailey 08 Sep '24

08 Sep '24

At some point during or after Neustar .us bits were assigned to GoDaddy, we lost administrative control over some $govtdayjob namespace, and it is claimed to now be held by the registry. Fast forward, we have a need to get things properly aligned. Have been trying to get things sorted out in good faith but the process is dragging on, and we are getting the side-eye from leadership because we're not getting a related issue resolved. I have a case number and supporting documentation, for what it's worth. Next step is legal, and I'd really like to avoid that mess. If you're an authoritative person that can help get this sorted, or have contact information for that person or persons, please reach out to me. Thank you, Chad D

3 5

Hurricane Electric now supports ASPA for route filtering
by Mike Leber 07 Sep '24

07 Sep '24

Hurricane Electric now uses ASPA to do hop by hop checking of AS paths when deciding which routes to accept when building prefix filters. Here is an example of a route failing the ASPA check. 44.31.69.0/24,rejected,AS path 4635 9002 945 7480 38254 38254 38254 38254 38254 ASPA record exists for 7480 and 945 is not listed as a provider. 44.31.73.0/24,rejected,AS path 4635 9002 945 7480 ASPA record exists for 7480 and 945 is not listed as a provider. These were found on the HKIX route servers (this example may be gone by the time you look at it, or it may exist for a while): https://routing.he.net/index.php?cmd=display_filter&as=4635&af=4&which=reas… For Hurricane Electric, the ASPA filtering is part of the prefix filter generation used for all customers and peers, which is responsible for the decision to accept a prefix. The vast majority of the route filtering decisions occur at this stage. We will shortly be adding ASPA reactive filtering which will monitor for prefixes that we have accepted that later become invalid. (Possible gross oversimplification ahead.) ASPA (Autonomous System Provider Authorization) is a relatively easy to understand add-on to RPKI that allow an ASN to create a record that lists which ASNs can be providers for that ASN. The concepts are "customer" (an ASN) and "providers" (a list of ASNs). How did we do this? How can you do something similar? You should already be familiar with RPKI and should set up an RPKI validator, ideally one with ASPA support. Test to see that you can validate origin and prefix pairs so that you know you have the RPKI validator working. Then do research regarding your specific RPKI validator to dump all the ASPA objects currently being published. The following article is an interesting starting point for the concepts involved and to help you play around: https://as51019.com/posts/aspa-bird2/ In the blog post the experimenter was building AS path filters for bird using ASPA records from a dump from routinator. If you wanted a routing daemon with builtin early stage ASPA support, I'm told you can use openbgpd with rpki-client. I'm sure Job will be able to give much better or more accurate guidance regarding ASPA software, protocols, and terminology.

1 0

Hurricane Electric now supports "Never via route servers" (the peeringdb flag)
by Mike Leber 07 Sep '24

07 Sep '24

Hurricane Electric now supports "Never via route servers" (the peeringdb flag) as part of our route filtering algorithm. Using peeringdb, an ASN may indicate that its routes should never be learned via route servers. As a simple detection method, currently route servers are detected at run time when the first AS hop of a path does not match the peer AS. When checking a path learned from a route server each hop is checked to see if it has "Never via route servers" set to true. Here is an example of a route failing the "Never via route servers" check. 80.96.25.0/24,rejected,received AS path 9009 62350 from a route server and 62350 has indicated that it is never to be learned via route servers (peeringdb flag). This path was learned via the Balcan-IX route servers (this example may be gone by the time you look at it, or it may exist for a while): https://routing.he.net/index.php?cmd=display_filter&as=24745&af=4&which=rea… The "Never via route servers" filtering is part of the static prefix filter generation, which is responsible for the decision to accept a prefix.

1 0

Apple Geolocation contact?
by J.R. Raith 06 Sep '24

06 Sep '24

Hi All, I have a laboratory in my department which thinks it's in central Russia when using Apple Maps on macOS and iOS devices. (I've also seen it in Google Maps on macOS, which I assume is GMaps getting its location from the OS). The lab has also reported Bhutan, Malta, and the equally exotic Ohio. This room is a shielded from GPS and cellular signals, but may pick up neighboring Access Points. Step outside of that specific room and you're back in Colorado. Phones and laptops keep setting their timezone wildly wrong and we're having graduate students and faculty missing classes/meetings. I've tried swapping out the Access Point in the lab. I've tried dropping a pin in Apple Maps and reporting the location as incorrect, repeatedly and with separate devices. I started looking at geolocatemuch, but I'm not sure that's the problem in this instance. The NAT IP we come from shows proper location in infosniper. I'd love to chat with an Apple person about how to solve it. Wish I could get frequent flyer miles for this... Thanks, J.R. Raith _________________________________________________ Network Administration & Desktop Support JILA Computing - University of Colorado, Boulder

4 5

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 06 Sep '24

06 Sep '24

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 07 Sep, 2024 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 959068 Prefixes after maximum aggregation (per Origin AS): 365188 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 464489 Number of IPv4 prefixes with a valid ROA: 496539 Number of IPv4 prefixes with an invalid ROA: 1541 Number of IPv4 prefixes with no ROA: 460988 Total ASes present in the Internet Routing Table: 76172 Prefixes per ASN: 12.59 Origin-only ASes present in the Internet Routing Table: 65237 Origin ASes announcing only one prefix: 26805 Transit ASes present in the Internet Routing Table: 10935 Transit-only ASes present in the Internet Routing Table: 530 Average AS path length visible in the Internet Routing Table: 5.3 Max AS path length visible: 71 Max AS path prepend of ASN ( 37447) 66 Prefixes from unregistered ASNs in the Routing Table: 1007 Number of instances of unregistered ASNs: 1017 Number of 32-bit ASNs allocated by the RIRs: 45322 Number of 32-bit ASNs visible in the Routing Table: 37037 Prefixes from 32-bit ASNs in the Routing Table: 192312 Number of bogon 32-bit ASNs visible in the Routing Table: 53 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 587 Number of addresses announced to Internet: 3035576064 Equivalent to 180 /8s, 239 /16s and 55 /24s Percentage of available address space announced: 82.0 Percentage of allocated address space announced: 82.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 314029 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 257505 Total APNIC prefixes after maximum aggregation: 75632 APNIC Deaggregation factor: 3.40 Prefixes being announced from the APNIC address blocks: 249205 Unique aggregates announced from the APNIC address blocks: 100757 APNIC Region origin ASes present in the Internet Routing Table: 14352 APNIC Prefixes per ASN: 17.36 APNIC Region origin ASes announcing only one prefix: 4373 APNIC Region transit ASes present in the Internet Routing Table: 1914 Average APNIC Region AS path length visible: 5.5 Max APNIC Region AS path length visible: 39 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9763 Number of APNIC addresses announced to Internet: 761919360 Equivalent to 45 /8s, 105 /16s and 247 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 279443 Total ARIN prefixes after maximum aggregation: 126059 ARIN Deaggregation factor: 2.22 Prefixes being announced from the ARIN address blocks: 283474 Unique aggregates announced from the ARIN address blocks: 135015 ARIN Region origin ASes present in the Internet Routing Table: 19155 ARIN Prefixes per ASN: 14.80 ARIN Region origin ASes announcing only one prefix: 6954 ARIN Region transit ASes present in the Internet Routing Table: 2002 Average ARIN Region AS path length visible: 4.6 Max ARIN Region AS path length visible: 28 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4987 Number of ARIN addresses announced to Internet: 1266942720 Equivalent to 75 /8s, 132 /16s and 3 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 266674 Total RIPE prefixes after maximum aggregation: 128424 RIPE Deaggregation factor: 2.08 Prefixes being announced from the RIPE address blocks: 262858 Unique aggregates announced from the RIPE address blocks: 166485 RIPE Region origin ASes present in the Internet Routing Table: 28716 RIPE Prefixes per ASN: 9.15 RIPE Region origin ASes announcing only one prefix: 12110 RIPE Region transit ASes present in the Internet Routing Table: 3982 Average RIPE Region AS path length visible: 5.5 Max RIPE Region AS path length visible: 43 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11989 Number of RIPE addresses announced to Internet: 723798144 Equivalent to 43 /8s, 36 /16s and 72 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 122531 Total LACNIC prefixes after maximum aggregation: 28009 LACNIC Deaggregation factor: 4.37 Prefixes being announced from the LACNIC address blocks: 120374 Unique aggregates announced from the LACNIC address blocks: 47465 LACNIC Region origin ASes present in the Internet Routing Table: 11158 LACNIC Prefixes per ASN: 10.79 LACNIC Region origin ASes announcing only one prefix: 2684 LACNIC Region transit ASes present in the Internet Routing Table: 2466 Average LACNIC Region AS path length visible: 5.9 Max LACNIC Region AS path length visible: 61 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9061 Number of LACNIC addresses announced to Internet: 178261760 Equivalent to 10 /8s, 160 /16s and 15 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 31908 Total AfriNIC prefixes after maximum aggregation: 6418 AfriNIC Deaggregation factor: 4.97 Prefixes being announced from the AfriNIC address blocks: 42570 Unique aggregates announced from the AfriNIC address blocks: 14274 AfriNIC Region origin ASes present in the Internet Routing Table: 1876 AfriNIC Prefixes per ASN: 22.69 AfriNIC Region origin ASes announcing only one prefix: 684 AfriNIC Region transit ASes present in the Internet Routing Table: 363 Average AfriNIC Region AS path length visible: 6.0 Max AfriNIC Region AS path length visible: 71 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1237 Number of AfriNIC addresses announced to Internet: 104337920 Equivalent to 6 /8s, 56 /16s and 18 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9903 8747 80 CHINAMOBILE-CN China Mobile Communication 7545 5707 837 659 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4942 4192 74 ERX-CERNET-BKB China Education and Resear 18403 4262 347 23 FPT-AS-AP FPT Telecom Company, VN 7552 3937 1330 20 VIETEL-AS-AP Viettel Group, VN 9498 3789 508 261 BBIL-AP BHARTI Airtel Ltd., IN 7713 3643 1044 66 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3258 1841 104 VNPT-AS-VN VNPT Corp, VN 24560 2797 831 481 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2269 11520 576 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 10665 11801 3762 AMAZON-02, US 11492 4639 308 547 CABLEONE, US 7155 4169 287 89 VIASAT-SP-BACKBONE, US 174 3903 8779 902 COGENT-174, US 6327 3602 1320 79 SHAW, CA 22773 3421 3035 187 ASN-CXA-ALL-CCI-22773-RDC, US 749 3242 54889 2494 DNIC-AS-00749, US 7018 3013 23680 1896 ATT-INTERNET4, US 16625 2854 1266 2129 AKAMAI-AS, US 396982 2802 3568 428 GOOGLE-CLOUD-PLATFORM, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7662 1708 145 UNI2-AS, ES 39891 4466 269 55 ALJAWWALSTC-AS, SA 20940 3830 3395 130 AKAMAI-ASN1, NL 9009 3666 312 1857 M247, RO 12389 2936 2299 883 ROSTELECOM-AS, RU 34984 2333 359 584 TELLCOM-AS, TR 212238 1796 128 1323 CDNEXT, GB 8551 1777 368 35 BEZEQ-INTERNATIONAL-AS Bezeqint Internet 13188 1607 100 26 TRIOLAN, UA 8452 1580 1852 14 TE-AS TE-AS, EG Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11733 3271 511 UNINET, MX 10620 3541 494 934 Telmex Colombia S.A., CO 13999 2547 629 22 Mega Cable, S.A. de C.V., MX 11830 2009 369 64 Instituto Costarricense de Electricidad y 28573 1337 2310 261 Claro NXT Telecomunicacoes Ltda, BR 3816 1316 774 204 COLOMBIA TELECOMUNICACIONES S.A. ESP, CO 11664 1229 278 33 Techtel LMDS Comunicaciones Interactivas 6503 1148 374 163 Axtel, S.A.B. de C.V., MX 6147 1105 369 22 Telefonica del Peru S.A.A., PE 22884 1067 98 371 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1622 593 29 RAYA-AS, EG 24863 1609 389 16 LINKdotNET-AS, EG 36992 1411 1519 282 ETISALAT-MISR, EG 29571 1334 84 68 ORANGE-COTE-IVOIRE, CI 36903 1249 554 96 MT-MPLS, MA 36935 932 521 42 Vodafone-, EG 6713 557 1861 35 IAM-AS, MA 36914 541 82 3 KENET-AS, KE 15399 511 57 58 WANANCHI-, KE 37342 425 32 1 MOVITEL, MZ Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11733 3271 511 UNINET, MX 16509 10665 11801 3762 AMAZON-02, US 9808 9903 8747 80 CHINAMOBILE-CN China Mobile Communication 12479 7662 1708 145 UNI2-AS, ES 7545 5707 837 659 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4942 4192 74 ERX-CERNET-BKB China Education and Resear 11492 4639 308 547 CABLEONE, US 39891 4466 269 55 ALJAWWALSTC-AS, SA 18403 4262 347 23 FPT-AS-AP FPT Telecom Company, VN 7155 4169 287 89 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9903 9823 CHINAMOBILE-CN China Mobile Communications Grou 12479 7662 7517 UNI2-AS, ES 16509 10665 6903 AMAZON-02, US 7545 5707 5048 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4942 4868 ERX-CERNET-BKB China Education and Research Net 39891 4466 4411 ALJAWWALSTC-AS, SA 18403 4262 4239 FPT-AS-AP FPT Telecom Company, VN 11492 4639 4092 CABLEONE, US 7155 4169 4080 VIASAT-SP-BACKBONE, US 7552 3937 3917 VIETEL-AS-AP Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-D 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.38.73.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 6939 HURRICANE, US 23.137.192.0/24 Origin: 31798 DATACITY, CA 23.137.192.0/24 Transit: 21949 BEANFIELD, CA 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.152.48.0/24 Origin: 46167 RESERVED, ZZ 23.152.48.0/24 Transit: 7018 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:16 /10:37 /11:93 /12:295 /13:580 /14:1168 /15:2070 /16:13244 /17:8260 /18:13788 /19:24716 /20:44402 /21:52010 /22:111928 /23:100324 /24:585403 /25:718 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6718 7662 UNI2-AS, ES 8151 5867 11733 UNINET, MX 11492 3550 4639 CABLEONE, US 6327 3397 3602 SHAW, CA 39891 3356 4466 ALJAWWALSTC-AS, SA 7155 3113 4169 VIASAT-SP-BACKBONE, US 22773 2555 3421 ASN-CXA-ALL-CCI-22773-RDC, US 10620 2170 3541 Telmex Colombia S.A., CO 30036 2162 2500 MEDIACOM-ENTERPRISE-BUSINESS, US 16509 2145 10665 AMAZON-02, US Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2313 2:1522 3:454 4:6 5:4459 6:161 7:6 8:1517 9:1 11:172 12:1429 13:366 14:2412 15:327 16:259 17:362 18:879 20:408 21:4 22:188 23:6826 24:2680 25:2 27:2556 29:19 31:2695 32:47 34:66 35:139 36:2364 37:4521 38:8492 39:920 40:147 41:4067 42:1984 43:2444 44:332 45:17561 46:4649 47:298 49:1996 50:1864 51:574 52:1578 54:318 55:960 56:8 57:214 58:2252 59:1267 60:1063 61:2724 62:2788 63:1850 64:5464 65:2279 66:4653 67:3035 68:1338 69:4027 70:1146 71:563 72:2858 74:2676 75:1568 76:620 77:2532 78:1852 79:1809 80:2212 81:2002 82:1689 83:1372 84:1748 85:3173 86:981 87:2319 88:1253 89:4268 90:682 91:8220 92:2452 93:2729 94:3752 95:4273 96:1274 97:316 98:1062 99:737 100:73 101:1167 102:3379 103:32264 104:4371 105:700 106:992 107:2375 108:1169 109:4072 110:2136 111:3291 112:2059 113:1814 114:1893 115:2091 116:1983 117:2678 118:2869 119:1990 120:1826 121:1417 122:2706 123:2161 124:1635 125:2858 126:64 128:1405 129:944 130:1217 131:1845 132:822 133:428 134:1509 135:310 136:1205 137:1107 138:2839 139:1535 140:1451 141:1444 142:1730 143:1620 144:1032 145:365 146:2086 147:2034 148:2542 149:2822 150:1068 151:1358 152:2100 153:500 154:6449 155:1437 156:2459 157:1793 158:1185 159:2445 160:3044 161:1707 162:3557 163:1756 164:1685 165:2144 166:1306 167:1848 168:4043 169:801 170:4943 171:1053 172:3891 173:3084 174:903 175:1226 176:3446 177:4736 178:3599 179:2194 180:2457 181:3908 182:3323 183:2015 184:2253 185:21040 186:5014 187:4299 188:4089 189:4171 190:9616 191:1522 192:11067 193:9233 194:7504 195:5367 196:3169 197:2989 198:6048 199:8106 200:8123 201:6364 202:10512 203:10393 204:4600 205:3701 206:4547 207:3647 208:4185 209:5119 210:4785 211:2662 212:4419 213:3655 214:1059 215:49 216:6731 217:2944 218:1419 219:556 220:2035 221:1048 222:871 223:2260 End of report

1 0

New Video Series Asks Community, "Why NANOG?" + More
by Nanog News 06 Sep '24

06 Sep '24

*New Video Series Asks Community, "Why NANOG?"* *Sponsor, Internet Systems Consortium's T. Marc Jones Talks about the Value of NANOG* Since 1994, NANOG has been the premier event where engineers, manufacturers, and operators connect, learn, and explore the latest industry research and development advancements. Hear directly from the passionate NANOG community as they share what makes NANOG special for them. *Why Sponsor NANOG? Learn firsthand from a NANOG Sponsor.* *WATCH NOW <https://nanog.org/stories/nanog-tv/why-nanog-sponsor/>* *Exciting Sponsorship Opportunity: Showcase Your Brand at NANOG* *NANOG Showcase Sponsorships Still Available! * *We’re thrilled to introduce our newest sponsorship option! *Similar to an exhibit hall, sponsors will have dedicated tables to engage with attendees and share product information in a high-traffic area—the Network Lounge + Espresso Bar. NANOG will provide branded table top banners to help elevate your presence. *Showcase Schedule:* Monday PM: 1:30-4:30 Tuesday AM: 9:00-12:00 Tuesday PM: 1:30-4:30 Sponsors can choose a 3-hour time slot, with the option to purchase additional slots. *Sponsorship Package:* $8,000, which includes one registration pass Don't miss this great opportunity to connect with the NANOG community! *EMAIL SHAWN <swinstead(a)nanog.org>* *Register for NANOG 92! Discounted Standard Rates will End Oct. 7* *Join us in Toronto From 21 - 23 October * *We are only 44 days away from our next meeting.* Have you registered yet for NANOG 92? *Check out:* - Keynote Speakers - Upcoming Social Events - Hotel Venue Information - Things To Do + See in Toronto - Registration Information *MORE INFO* <https://nanog.org/events/nanog-92/>

1 0

Important ARIN Operational Change re Automatic IRR object creation (was: [arin-announce] Reminder - Automatic Creation of Managed IRR Route Objects upon RPKI ROA Generation Coming Soon)
by John Curran 04 Sep '24

04 Sep '24

NANOGers - As announced in the recently closed consultation, ARIN Online will support automatic route object creation upon ROA generation starting on 4 November 2024 - more details available in the attached announcement. FYI, /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net> Subject: [arin-announce] Reminder - Automatic Creation of Managed IRR Route Objects upon RPKI ROA Generation Coming Soon Date: September 4, 2024 at 11:52:16 AM EDT To: <arin-announce(a)arin.net> In the software release scheduled for 4 November, ARIN will implement new features in ARIN Online that will provide tighter integration of ARIN’s Resource Public Key Infrastructure (RPKI) and Internet Routing Registry (IRR) routing security services. These improvements are informed by the community consultation that closed on 20 September 2023. Based on feedback received from our community during the consultation, ARIN plans to deploy the following features in ARIN Online and in our Application Programming Interface (API) for Hosted RPKI: 1. When a Route Origin Authorization (ROA) is generated, an auto-managed IRR route object will be created based on the contents of the ROA. This feature will be on by default but can be disabled by user action at the Org level. Additionally, a user can opt out of creating an auto-managed IRR route object upon each instance of ROA generation. All auto-managed IRR Route Objects will be identified as such in a remark field. 2. Auto-managed route objects resulting from ROA generation will use the prefix entry only and not take the maxLength value into consideration (using the least specific match). At ROA generation, the user will have the option to replace any existing, matching, and unmanaged route objects with an auto-managed route object. Users may manually create longer match IRR objects, but these manually created objects will not be auto managed. 3. Deleting a ROA will remove associated auto-managed IRR route objects. A user can opt out of removing auto-managed IRR route objects upon each instance of ROA deletion. If a user chooses to not delete an auto-managed IRR route object, the remarks field will be updated to reflect that the IRR route object is no longer auto-managed. Users maintain the ability to create, modify, or delete all IRR route objects through the Manage IRR page in ARIN Online. 4. ARIN Online users will have the option to selectively create auto-managed IRR route objects based on the Org’s existing ROAs in ARIN’s RPKI repository. The Reg-RWS API will be updated to reflect the capabilities as described in items one through three above. If you have questions about these upcoming features, please contact us by emailing routing.security(a)arin.net. Regards, Brad Gorman Senior Product Owner, Routing Security American Registry for Internet Numbers (ARIN) _______________________________________________ ARIN-Announce

1 0

REMINDER: Call for Participation -- ICANN81 DNSSEC and Security Workshop
by Jacques Latour 04 Sep '24

04 Sep '24

Hi all! We still have a few openings in our schedule. Thanks, Jacques Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN Annual General Meeting In cooperation with the ICANN Security and Stability Advisory Committee (SSAC), we are planning a DNSSEC and Security Workshop for the ICANN81 Annual General Meeting being held as a hybrid meeting from 09-14 November 2024 in Istanbul, Türkiyea in the Turkey Time TRT- (UTC +3). This workshop date will be determined once ICANN creates a block schedule for us to follow; then we will be able to request a day and time. The DNSSEC and Security Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments. For reference, the most recent session was held at the ICANN80 The Policy Forum on Monday, 10 June 2024. The presentations and transcripts are available at: https://icann80.sched.com/<https://urldefense.com/v3/__https:/icann80.sched.com/__;!!PtGJab4!7Vwf_nce_…>. The DNSSEC Workshop Program Committee is developing a program for the upcoming meeting. Proposals will be considered for the following topic areas and included if space permits. In addition, we welcome suggestions for additional topics either for inclusion in the ICANN78 workshop, or for consideration for future workshops. 1. Global DNSSEC Activities Panel For this panel, we are seeking participation from those who have been involved in DNSSEC deployment as well as from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment, including Root Key Signing Key (KSK) Rollover activities and plans. 2. DNSSEC Best Practice Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC? * Do you still submit/accept DS records with Digest Type 1? * What is the best practice around key roll-overs? * What about Algorithm roll-overs? * Do you use and support DNSKEY Algorithms 13-16? * How often do you review your disaster recovery procedures? * Is there operational familiarity within your customer support teams? * What operational statistics have been gathered about DNSSEC? * Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones? Activities and issues related to DNSSEC in the DNS Root Zone are also desired. 3. DNSSEC Deployment Challenges The program committee is seeking input from those that are interested in implementation of DNSSEC but have general or particular concerns with DNSSEC. In particular, we are seeking input from individuals that would be willing to participate in a panel that would discuss questions of the following nature: * Are there any policies directly or indirectly impeding your DNSSEC deployment? (RRR model, CDS/CDNSKEY automation) * What are your most significant concerns with DNSSEC, e.g., complexity, training, implementation, operation or something else? * What do you expect DNSSEC to do for you and what doesn't it do? * What do you see as the most important trade-offs with respect to doing or not doing DNSSEC? 4. Security Panel The program committee is looking for presentations on DNS, DNSSEC, routing and other topics that could impact the security and/or stability of the Internet. We are looking for presentations that cover implementation issues, challenges, opportunities and best practices for: * Emerging threats that could impact the security and/or stability of the Internet * DoH and DoT * RPKI (Resource Public Key Infrastructure) * BGP routing & secure implementations * MANRS ( Mutually Agreed Norms for Routing Security) * Browser security - DNS, DNSSEC, DoH * EMAIL & DNS related security - DMARC, DKIM, TLSA, etc... If you are interested in participating, please send a brief (1-3 sentence) description of your proposed presentation to dnssec-security-workshop(a)icann.org<mailto:dnssec-security-workshop@icann.org> by Friday, 13 September 2024. Thank you, Kim and Kathy On behalf of the DNSSEC Workshop Program Committee: Gautam Akiwate, Stanford University Steve Crocker, Edgemoor Research Institute Mark Elkins, DNS/ZARC Jacques Latour, .CA Ram Mohan, Identity Digital Russ Mundy, Tislabs Yoshiro Yoneya Dan York, Internet Society

1 0