- Test - lists.nanog.org

Deprecation of outdated crypto support (was: Fwd: [arin-announce] Changes Coming to Cryptographic Features Across ARIN Services)
by John Curran 01 Aug '24

01 Aug '24

NANOGers - Note the planned depreciation of outdated cryptographic support for ARIN services in February 2025, as per the attached announcement. While this may seem to be quite some time away, please take a moment to note the upcoming change with your IT/devops folks just in case. Thanks! /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net> Subject: [arin-announce] Changes Coming to Cryptographic Features Across ARIN Services Date: August 1, 2024 at 2:37:57 PM AST To: "arin-announce(a)arin.net" <arin-announce(a)arin.net> As of 3 February 2025, ARIN Will Only Support TLS 1.2 and TLS 1.3 Cryptographic Features Across All ARIN Services. Historically, ARIN has allowed the use of a wide range of Secure Socket Layer (SSL) and Transport Layer Security (TLS) algorithms to enable secure, encrypted communication between our customers and services. Currently, ARIN supports TLS 1.2 and TLS 1.3 as well as a subset of the stronger algorithms within TLS 1.0, TLS 1.1, and SSLv3 specifications for publicly available services such as ARIN.net<http://arin.net/> mail, Whois Restful Web Service (Whois-RWS), Registry Data Access Protocol (RDAP), ftp://ftp.arin.net<ftp://ftp.arin.net/>, and Resource Public Key Infrastructure Repository Data Protocol (RRDP). The remainder of ARIN services, including the ARIN website and Registration RESTful Web Service (Reg-RWS), only support TLS 1.2 and TLS 1.3. ARIN will deprecate the outdated versions of SSL and TLS on 3 February 2025 and begin only using TLS 1.2 and TLS 1.3 protocols across all our services. We are providing six months’ notice of this change to allow customers to ensure that all applicable software supports TLS 1.2 and TLS 1.3 protocols to avoid losing connectivity to ARIN services.  In the future, ARIN may more regularly update cipher suite and algorithm support within our published supported protocols to align with requirements from internal and external audits, security certifications, and community feedback. Regards, American Registry for Internet Numbers (ARIN) _______________________________________________ ARIN-Announce

1 0

Digicert revoking certain certs failing CNAME validation
by Innocent Obi 31 Jul '24

31 Jul '24

Just in-case this hasn't made its way around: https://www.digicert.com/support/certificate-revocation-incident.

5 7

DNSSEC failing when querying zones under ca. randomly but only from some regions
by Adam Daniels 30 Jul '24

30 Jul '24

Subject says it all, and I’m in 500-mile email mystery here. Anybody want to take a guess what it could be? Synopsis: Queries to .ca zones randomly fail with a DNSSEC validation error but it appears to be region dependent and zone dependent. Anycast verifying resolvers seem most prone to trigger the failure mode. I can’t trigger it running a local verifying resolver (unbound). I tried raising this with CIRA on Friday morning, and have observed it since Wednesday, but nothing back from CIRA yet. Being geo-dependent, I’m guessing the resolver that’s shortest path to me might have an issue, but I can trigger it on multiple services usually (Google + CloudFlare at least) so I can’t see that being the issue. I can trigger this from the Google DNS Web page as well, but not reliably. I can trigger this on domains I am not authoritive for (random domains I found while browsing) but I’ll use two authoritive domains here. $ dig seattle.mediadrive.ca @8.8.8.8 ; <<>> DiG 9.10.6 <<>> seattle.mediadrive.ca ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 56149 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ; OPT=15: 00 07 45 78 70 69 72 65 64 20 52 52 53 49 47 20 66 6f 75 6e 64 20 66 6f 72 20 70 75 66 35 32 6b 70 68 36 75 30 71 35 67 68 73 69 6c 72 33 68 63 31 64 37 65 6c 62 61 68 67 33 2e 63 61 2f 6e 73 65 63 33 20 28 6b 65 79 74 61 67 3d 35 36 38 31 36 29 ("..Expired RRSIG found for puf52kph6u0q5ghsilr3hc1d7elbahg3.ca/nsec3 (keytag=56816)") ;; QUESTION SECTION: ;seattle.mediadrive.ca. IN A ;; Query time: 67 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sat Jul 27 16:26:37 EDT 2024 ;; MSG SIZE rcvd: 136 $ dig adamdaniels.ca @1.1.1.1 ; <<>> DiG 9.10.6 <<>> adamdaniels.ca @1.1.1.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 4638 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; OPT=15: 00 0a 66 61 69 6c 65 64 20 74 6f 20 76 65 72 69 66 79 20 73 69 67 6e 61 74 75 72 65 73 20 66 6f 72 20 61 64 61 6d 64 61 6e 69 65 6c 73 2e 63 61 2e 20 6f 70 74 2d 6f 75 74 20 70 72 6f 6f 66 ("..failed to verify signatures for adamdaniels.ca. opt-out proof") ;; QUESTION SECTION: ;adamdaniels.ca. IN A ;; Query time: 50 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) ;; WHEN: Sat Jul 27 17:27:28 EDT 2024 ;; MSG SIZE rcvd: 110 If I let it run long enough, I can trigger it on canada.ca but not with any frequency. Performing the queries from my home is incredibly reliable for reproducing this, but I can trigger it from a facility I colocate with in Toronto as well. == MTR from Toronto, Canada Start: 2024-07-27T17:30:07-0400 HOST: manager Loss% Snt Last Avg Best Wrst StDev 1.|-- _gateway 0.0% 10 1.2 1.0 0.8 1.2 0.1 2.|-- 198.55.53.14 90.0% 10 0.5 0.5 0.5 0.5 0.0 3.|-- i.cr003.ca1-01.yyz.as1100.net 0.0% 10 0.3 0.4 0.2 0.8 0.2 4.|-- i.rogers.ca1-01.yyz.as1100.net 0.0% 10 0.4 0.5 0.3 0.7 0.2 5.|-- 99.209.203.17 0.0% 10 0.6 0.6 0.5 0.9 0.1 6.|-- 24.153.31.130 0.0% 10 1.4 1.6 1.3 1.9 0.2 7.|-- 3021-cgw01.mtnk.asr9k.rmgt.net.rogers.com 0.0% 10 1.5 1.8 1.5 2.1 0.2 8.|-- 209.148.235.222 0.0% 10 2.9 4.7 2.6 14.6 3.9 9.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 10.|-- 192.178.99.39 0.0% 10 2.4 2.2 2.0 2.4 0.1 11.|-- 216.239.50.119 0.0% 10 3.2 3.1 2.9 3.3 0.1 12.|-- dns.google 0.0% 10 2.0 2.0 1.9 2.2 0.1 == MTR from my home (Niagara region, Canada) Start: 2024-07-27T17:30:21-0400 HOST: Adams-MacBook-Air.local Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.1.1 0.0% 10 2.7 3.1 2.7 3.4 0.2 2.|-- 10.202.100.1 0.0% 10 74.9 20.2 9.0 74.9 21.7 3.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 4.|-- c8.tpia.start.ca 0.0% 10 43.5 27.1 14.8 58.8 16.8 5.|-- 72.14.198.214 0.0% 10 41.7 22.9 16.4 41.7 7.6 6.|-- 192.178.99.31 0.0% 10 37.8 20.0 14.2 37.8 7.6 7.|-- 216.239.41.175 0.0% 10 41.2 19.3 15.3 41.2 7.8 8.|-- dns.google 0.0% 10 19.2 17.8 14.7 21.5 2.2 I’ve tried the same queries from NYC and Seattle but do not trigger any failures. Thoughts? Adam

2 2

Help with compromised Gmail Account
by Norman Jester 29 Jul '24

29 Jul '24

Could someone from Google/gmail ops contact me please? A downstream customer of our has lost access to their gmail account which contains lots of important network elements and info. They had emailed Google etc but got no response. The bad actor managed to change the cell phone on the account etc. Please let me know any advice so I can help them and/or get you in touch with them. Norm

1 0

A single place for information relating to the deployment and usage of RPKI
by Christopher Hawker 29 Jul '24

29 Jul '24

Hello All, When it comes to RPKI, its deployment and usage, there is a fair bit of information available on the Internet. Each RIR has their own guides for creating ROAs, each router vendor and developer has their own guides for deploying route object validation on their devices and software, each Relying Party software developer has their own how-to guide on installing/configuring/maintaining the software, among others. What I haven’t been able to find thus far is a place where all of this information is altogether, in one place, for simplicity and ease of comparison to find the best solution for a network operator’s needs. This is where the RPKI Deployment Hub comes in. The RPKI Deployment Hub is the start of a documentation site that is designed to compile all of this information in one place. For new network operators this may prove to be an invaluable tool to find the best method of operating their own RP software, for students this may be a source of information to help further their studies, or for long-standing network operators it may be a resource for them to keep up-to-date with the latest methods. It is presently being hosted on GitHub pages, where each commit to the underlying repository updating the site live. The site itself is located at https://rpkihub.au<https://rpkihub.au/>, with the GitHub repository located at https://github.com/thesysadmindev/rpkihub. Unfortunately, I can only do so much, and this is where I need to ask for contributors to help work on this site. As we all know, there are a large number of router vendors on the market, each with their own way of implementing RPKI. Cisco, Juniper, MikroTik, Nokia, Arista, and the like all do things differently. It would be a wonderful world if they all worked the exact same way with the same commands. It’d make life a lot easier for us. What I’m calling out to the community for, is for assistance with building this site as it is impossible for me to look at every major hardware vendor and model. We need information such as router configurations relating to RPKI and the commands used, along with the vendor names, hardware models and software versions. The idea to this is that people can look at a guide, find their router model and it’ll tell them how to configure route object validation. As for creating ROAs, it’ll tell them how to do so with their respective RIRs. I understand that the best source of information for this is from the RIR itself and will always be the case; this is simply designed to provide everything in one central location. If there are any members from the other four RIRs (as I have already put together a guide for creating ROAs within MyAPNIC) who are willing to work with me to develop a guide with screenshots it would be greatly appreciated It could even be as simple as sending me an email with the steps listed and a few screenshot attachments and I can work on creating the guide otherwise you’re welcome to submit a pull request on the repository. I would also like to hear about people’s experiences with deploying RPKI across their networks, why you chose to and for those who haven’t or won’t, why that is the case. This sort of information would be valuable to help shape the site. If you would like to contribute to this project, you can do so via any number of ways: 1. Open a pull request against the repository on GitHub. 2. Click on the “Edit This Page” button on any page on the site to take you straight to its source on GitHub where you can make changes and open a PR directly from the GitHub site. 3. Send me an email to chris(a)thesysadmin.au<mailto:chris@thesysadmin.au>. 4. Drop me a direct message on Discord (Username: thesysadmin). The site itself is licensed under GPLv3, so feel free to tear it apart, share it and work together. If you also have any other recommendations as to how it can be improved or if you feel there is anything missing, do let me know. Regards, Christopher Hawker

2 1

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 26 Jul '24

26 Jul '24

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 27 Jul, 2024 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 954508 Prefixes after maximum aggregation (per Origin AS): 364481 Deaggregation factor: 2.62 Unique aggregates announced (without unneeded subnets): 466529 Total ASes present in the Internet Routing Table: 76009 Prefixes per ASN: 12.56 Origin-only ASes present in the Internet Routing Table: 65129 Origin ASes announcing only one prefix: 26720 Transit ASes present in the Internet Routing Table: 10880 Transit-only ASes present in the Internet Routing Table: 535 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 84 Max AS path prepend of ASN (152107) 80 Prefixes from unregistered ASNs in the Routing Table: 1013 Number of instances of unregistered ASNs: 1019 Number of 32-bit ASNs allocated by the RIRs: 45038 Number of 32-bit ASNs visible in the Routing Table: 36798 Prefixes from 32-bit ASNs in the Routing Table: 189911 Number of bogon 32-bit ASNs visible in the Routing Table: 38 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 561 Number of addresses announced to Internet: 3026104448 Equivalent to 180 /8s, 94 /16s and 176 /24s Percentage of available address space announced: 81.7 Percentage of allocated address space announced: 81.7 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 311994 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 255837 Total APNIC prefixes after maximum aggregation: 74892 APNIC Deaggregation factor: 3.42 Prefixes being announced from the APNIC address blocks: 247605 Unique aggregates announced from the APNIC address blocks: 101816 APNIC Region origin ASes present in the Internet Routing Table: 14277 APNIC Prefixes per ASN: 17.34 APNIC Region origin ASes announcing only one prefix: 4351 APNIC Region transit ASes present in the Internet Routing Table: 1901 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 84 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9690 Number of APNIC addresses announced to Internet: 761746304 Equivalent to 45 /8s, 103 /16s and 83 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 278289 Total ARIN prefixes after maximum aggregation: 125528 ARIN Deaggregation factor: 2.22 Prefixes being announced from the ARIN address blocks: 282872 Unique aggregates announced from the ARIN address blocks: 135082 ARIN Region origin ASes present in the Internet Routing Table: 19127 ARIN Prefixes per ASN: 14.79 ARIN Region origin ASes announcing only one prefix: 6936 ARIN Region transit ASes present in the Internet Routing Table: 1983 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 27 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4949 Number of ARIN addresses announced to Internet: 1267324928 Equivalent to 75 /8s, 137 /16s and 216 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 266065 Total RIPE prefixes after maximum aggregation: 127863 RIPE Deaggregation factor: 2.08 Prefixes being announced from the RIPE address blocks: 261558 Unique aggregates announced from the RIPE address blocks: 165336 RIPE Region origin ASes present in the Internet Routing Table: 28672 RIPE Prefixes per ASN: 9.12 RIPE Region origin ASes announcing only one prefix: 12115 RIPE Region transit ASes present in the Internet Routing Table: 3986 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 39 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11903 Number of RIPE addresses announced to Internet: 714597120 Equivalent to 42 /8s, 151 /16s and 227 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 121970 Total LACNIC prefixes after maximum aggregation: 29289 LACNIC Deaggregation factor: 4.16 Prefixes being announced from the LACNIC address blocks: 119949 Unique aggregates announced from the LACNIC address blocks: 50156 LACNIC Region origin ASes present in the Internet Routing Table: 11138 LACNIC Prefixes per ASN: 10.77 LACNIC Region origin ASes announcing only one prefix: 2645 LACNIC Region transit ASes present in the Internet Routing Table: 2447 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 60 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9031 Number of LACNIC addresses announced to Internet: 177146880 Equivalent to 10 /8s, 143 /16s and 12 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 31334 Total AfriNIC prefixes after maximum aggregation: 6257 AfriNIC Deaggregation factor: 5.01 Prefixes being announced from the AfriNIC address blocks: 41963 Unique aggregates announced from the AfriNIC address blocks: 13682 AfriNIC Region origin ASes present in the Internet Routing Table: 1865 AfriNIC Prefixes per ASN: 22.50 AfriNIC Region origin ASes announcing only one prefix: 673 AfriNIC Region transit ASes present in the Internet Routing Table: 365 Average AfriNIC Region AS path length visible: 5.0 Max AfriNIC Region AS path length visible: 38 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1225 Number of AfriNIC addresses announced to Internet: 104921600 Equivalent to 6 /8s, 64 /16s and 250 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9861 8747 79 CHINAMOBILE-CN China Mobile Communication 7545 5658 776 668 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4935 4192 74 ERX-CERNET-BKB China Education and Resear 18403 4185 347 23 FPT-AS-AP FPT Telecom Company, VN 7552 3962 1331 21 VIETEL-AS-AP Viettel Group, VN 9498 3790 511 261 BBIL-AP BHARTI Airtel Ltd., IN 7713 3645 1044 66 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3241 1841 105 VNPT-AS-VN VNPT Corp, VN 24560 2811 855 446 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2274 11520 574 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 10265 11564 3642 AMAZON-02, US 11492 4621 307 549 CABLEONE, US 7155 4166 287 88 VIASAT-SP-BACKBONE, US 174 3791 8789 881 COGENT-174, US 6327 3595 1320 79 SHAW, CA 22773 3421 3035 188 ASN-CXA-ALL-CCI-22773-RDC, US 749 3253 54899 2505 DNIC-AS-00749, US 16625 3136 1322 2198 AKAMAI-AS, US 7018 2914 23688 1831 ATT-INTERNET4, US 396982 2758 3594 409 GOOGLE-CLOUD-PLATFORM, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7712 1708 145 UNI2-AS, ES 39891 4521 271 59 ALJAWWALSTC-AS, SA 20940 3836 3396 133 AKAMAI-ASN1, NL 9009 3565 304 1837 M247, RO 12389 2939 2301 888 ROSTELECOM-AS, RU 34984 2355 362 574 TELLCOM-AS, TR 8551 1776 368 35 BEZEQ-INTERNATIONAL-AS Bezeqint Internet 212238 1729 124 1264 CDNEXT, GB 13188 1607 100 26 TRIOLAN, UA 8452 1575 1852 14 TE-AS TE-AS, EG Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11868 3305 502 UNINET, MX 10620 3523 493 939 Telmex Colombia S.A., CO 13999 2539 355 680 Mega Cable, S.A. de C.V., MX 11830 2004 369 64 Instituto Costarricense de Electricidad y 28573 1343 2311 258 Claro NXT Telecomunicacoes Ltda, BR 3816 1314 768 202 COLOMBIA TELECOMUNICACIONES S.A. ESP, CO 6503 1124 314 478 Axtel, S.A.B. de C.V., MX 6147 1100 369 22 Telefonica del Peru S.A.A., PE 26615 1084 2503 53 TIM SA, BR 22884 1064 97 369 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1613 389 16 LINKdotNET-AS, EG 24835 1559 593 29 RAYA-AS, EG 36992 1382 1520 280 ETISALAT-MISR, EG 29571 1293 82 76 ORANGE-COTE-IVOIRE, CI 36903 1249 554 96 MT-MPLS, MA 36935 938 521 43 Vodafone-, EG 6713 555 1861 35 IAM-AS, MA 36914 473 82 3 KENET-AS, KE 24757 425 73 5 EthioNet-AS, ET 37342 418 32 1 MOVITEL, MZ Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11868 3305 502 UNINET, MX 16509 10265 11564 3642 AMAZON-02, US 9808 9861 8747 79 CHINAMOBILE-CN China Mobile Communication 12479 7712 1708 145 UNI2-AS, ES 7545 5658 776 668 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4935 4192 74 ERX-CERNET-BKB China Education and Resear 11492 4621 307 549 CABLEONE, US 39891 4521 271 59 ALJAWWALSTC-AS, SA 18403 4185 347 23 FPT-AS-AP FPT Telecom Company, VN 7155 4166 287 88 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9861 9782 CHINAMOBILE-CN China Mobile Communications Grou 12479 7712 7567 UNI2-AS, ES 16509 10265 6623 AMAZON-02, US 7545 5658 4990 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4935 4861 ERX-CERNET-BKB China Education and Research Net 39891 4521 4462 ALJAWWALSTC-AS, SA 18403 4185 4162 FPT-AS-AP FPT Telecom Company, VN 7155 4166 4078 VIASAT-SP-BACKBONE, US 11492 4621 4072 CABLEONE, US 7552 3962 3941 VIETEL-AS-AP Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-D 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.38.73.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 6939 HURRICANE, US 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.152.48.0/24 Origin: 46167 RESERVED, ZZ 23.152.48.0/24 Transit: 7018 ATT-INTERNET4, US 23.170.224.0/24 Origin: 30168 RESERVED, ZZ 23.170.224.0/24 Transit: 397095 SETSONLLC, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:16 /10:37 /11:92 /12:294 /13:571 /14:1162 /15:2058 /16:13206 /17:8269 /18:13741 /19:24700 /20:44349 /21:51966 /22:111603 /23:100148 /24:581558 /25:722 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6803 7712 UNI2-AS, ES 8151 5937 11868 UNINET, MX 11492 3532 4621 CABLEONE, US 6327 3392 3595 SHAW, CA 39891 3361 4521 ALJAWWALSTC-AS, SA 7155 3111 4166 VIASAT-SP-BACKBONE, US 22773 2558 3421 ASN-CXA-ALL-CCI-22773-RDC, US 16509 2158 10265 AMAZON-02, US 30036 2156 2496 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2152 3523 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2311 2:1549 3:388 4:6 5:4373 6:149 7:6 8:1520 9:1 11:172 12:1437 13:368 14:2370 15:326 16:218 17:368 18:786 20:385 21:4 22:188 23:6918 24:2697 25:2 27:2567 29:19 31:2603 32:47 34:65 35:136 36:2349 37:4447 38:8121 39:912 40:147 41:4037 42:1990 43:2395 44:330 45:17402 46:4564 47:298 49:1980 50:1858 51:580 52:1576 54:318 55:927 56:8 57:214 58:2221 59:1251 60:1051 61:2664 62:2761 63:1862 64:5456 65:2275 66:4637 67:3013 68:1300 69:4022 70:1159 71:559 72:2862 74:2605 75:1559 76:617 77:2486 78:1867 79:1781 80:2197 81:2022 82:1656 83:1365 84:1724 85:3190 86:941 87:2298 88:1250 89:4196 90:701 91:8189 92:2350 93:2720 94:3744 95:4214 96:1280 97:317 98:1033 99:739 100:73 101:1171 102:3295 103:32249 104:4787 105:695 106:1010 107:2499 108:1158 109:4051 110:2126 111:3217 112:2061 113:1821 114:1819 115:2040 116:1964 117:2643 118:2789 119:1963 120:1823 121:1357 122:2706 123:2279 124:1627 125:2861 126:32 128:1403 129:939 130:1183 131:1866 132:815 133:417 134:1712 135:319 136:1126 137:1095 138:2856 139:1527 140:1417 141:1383 142:1675 143:1619 144:1025 145:360 146:2103 147:1991 148:2533 149:2786 150:1029 151:1343 152:2231 153:522 154:6482 155:1434 156:2333 157:1901 158:1172 159:2434 160:2849 161:1707 162:3525 163:1714 164:1684 165:2127 166:1256 167:1828 168:4070 169:812 170:4924 171:1045 172:3905 173:3074 174:898 175:1234 176:3461 177:4628 178:3642 179:2209 180:2424 181:3797 182:3325 183:1982 184:2257 185:20920 186:4947 187:4337 188:4073 189:4124 190:9460 191:1521 192:11059 193:9174 194:7485 195:5316 196:3211 197:2559 198:6052 199:8018 200:8138 201:6307 202:10531 203:10328 204:4573 205:3706 206:4494 207:3611 208:4168 209:5046 210:4725 211:2632 212:4371 213:3626 214:1068 215:49 216:6735 217:2934 218:1398 219:600 220:2023 221:1037 222:864 223:2248 End of report

1 0

Current diameter of the Internet?
by Sean Donelan 24 Jul '24

24 Jul '24

What is the current estimated diameter of the Internet? Maximum (worst-case) RTT edge-to-edge? Most public latency data is now edge-to-cloud, not edge-to-edge. Cloud engineers have done a great job, and edge-to-cloud less than 1-sec RTT. Where have the long-slow pipes gone? https://www.cloudping.co/grid https://learn.microsoft.com/en-us/azure/networking/azure-network-latency?ta… https://www.verizon.com/business/terms/latency/

14 29

lots of internet starting at ~3 a.m. cst
by Aaron Gould 23 Jul '24

23 Jul '24

Anyone else see a lot of Internet traffic starting at 3 a.m. and continuing even now? Seems to be spiky tcp. -- -Aaron

12 16

Re: pgp keyservers
by nanog＠fleish.org 22 Jul '24

22 Jul '24

While the sks-keyservers.net domain and many of the old hostnames that powered it are dead & gone, the actual SKS keyserver network does in fact live on, complete with new & improved DOS mitigations and active development of the underlying server software powering it, Hockeypuck. More information can be found @ https://spider.pgpkeys.eu/ & https://github.com/hockeypuck/hockeypuck respectively. Keyserver.ubuntu.com also exists, but has fallen out of sync with the network and to date has been unwilling to reengage. -T > On Jul 22, 2024, at 05:00, nanog-request(a)nanog.org wrote: > > Message: 15 > Date: Sun, 21 Jul 2024 20:23:43 -0400 > From: Matt Corallo <nanog(a)as397444.net <mailto:nanog@as397444.net>> > To: Randy Bush <randy(a)psg.com <mailto:randy@psg.com>>, North American Network Operators' > Group <nanog(a)nanog.org <mailto:nanog@nanog.org>> > Subject: Re: pgp keyservers > Message-ID: <23baf526-4319-49ba-aa6d-af3460ab925d(a)as397444.net <mailto:23baf526-4319-49ba-aa6d-af3460ab925d@as397444.net>> > Content-Type: text/plain; charset=UTF-8; format=flowed > > pgp.mit.edu <http://pgp.mit.edu/> has been sporadically available for me over the last while, but yea AFAIU sks-keyservers > shut down after the DoS drama, as did most of the old servers in the pool. > > I believe keyserver.ubuntu.com <http://keyserver.ubuntu.com/> generally works and doesn't strip all the signatures and whatnot off > keys when they upload. > > I think the hipster thing to do now, though, is --auto-locate-key with the Web Key Distribution or > the DNSSEC Key Distribution mechanism. > > Matt > > On 7/21/24 7:25 PM, Randy Bush wrote: >> are there any old keyservers still working? or only the new hipster >> ones? i tried three and no love >> >> hkps://pgp.mit.edu <hkps://pgp.mit.edu> >> hkps://pgp.uni-mainz.de <hkps://pgp.uni-mainz.de> >> hkps://hkps.pool.sks-keyservers <hkps://hkps.pool.sks-keyservers> >> >> randy >

2 3

pgp keyservers
by Randy Bush 22 Jul '24

22 Jul '24

are there any old keyservers still working? or only the new hipster ones? i tried three and no love hkps://pgp.mit.edu hkps://pgp.uni-mainz.de hkps://hkps.pool.sks-keyservers randy

7 7