- Test - lists.nanog.org

WebEx
by Jon Kibler 15 Aug '08

15 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yesterday, Cisco announced a critical vulnerability in WebEx: http://www.cisco.com/warp/public/707/cisco-sa-20080814-webex.shtml The interesting thing about this vulnerability is that you can clean up all of your WebEx installs, but as soon as you create a session with a WebEx server that has not been upgraded, you are once again vulnerable. In other words, you are at the mercy of your WebEx presenter. BTW, despite the fact that Cisco says exploits are available, there is not the first mention of this vulnerability on the WebEx web site. Jon Kibler - -- Jon R. Kibler Chief Technical Officer Advanced Systems Engineering Technology, Inc. Charleston, SC USA o: 843-849-8214 c: 843-224-2494 s: 843-564-4224 My PGP Fingerprint is: BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkiliucACgkQUVxQRc85QlMpJgCgiCPz+nXKOFrVsWkI/7o0HnHI OhAAnRVH6X9IU3+oc/TRnDrFOqAkadmo =aulb -----END PGP SIGNATURE----- ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

1 1

Re: route policy (Re: Public shaming list for ISPs announcing other ISPs IP space by mistake)
by Brandon Butterworth 15 Aug '08

15 Aug '08

> > Yes, RIPE rock. Please make it all not suck. > > Unfortunately, RIPE DB will allow anyone to add any route objects for > prefixes that are not under the RIPE management :-(. For example, > anyone could add route objects for most of DNS root server prefixes. Little details get used to avoid fixing bigger problems, see the please stop sucking bit. If there was somewhere else the aliens had to be registered then they could be dropped from RIPE brandon

4 3

Re: route policy (Re: Public shaming list for ISPs announcing other ISPs IP space by mistake)
by Brandon Butterworth 15 Aug '08

15 Aug '08

> I'm not sure I follow. I agreed with you. > Many of these aliens are in fact registered in > RADB, so AFAICS, there that is no reason for them to be registered in > RIPE DB. > > On the other hand, some want to register them in RIPE DB because some > operators just want to use RIPE DB e.g. for data consistency etc. > reasons. But putting data without practically any authorization in > RIPE DB doesn't seem to be a useful model in the long run. As the reason they should not be in RIPE is RIPE doesn't hold the ownership data I suggested they move to a RIPE alike which does hold their ownership, afaik RADB doesn't Seems pretty simple, RIPE delegates the space and maintains owners so is a natural place for their owner to record their allowed use. So ARIN and others need to do the same, thus all space is covered and then can me munged into whatever will enforce the use be it router based signed advertisements or an out of band system that applies controls to the routers directly or via a humanoid. brandon

1 0

BGP Update Report
by cidr-report＠potaroo.net 15 Aug '08

15 Aug '08

BGP Update Report Interval: 14-Jul-08 -to- 14-Aug-08 (32 days) Observation Point: BGP Peering with AS2.0 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS4538 95373 1.5% 19.0 -- ERX-CERNET-BKB China Education and Research Network Center 2 - AS1803 87115 1.4% 68.2 -- ICMNET-5 - Sprint 3 - AS9583 84127 1.3% 67.0 -- SIFY-AS-IN Sify Limited 4 - AS6298 75314 1.2% 35.7 -- COX-PHX - Cox Communications Inc. 5 - AS5691 74595 1.2% 6781.4 -- MITRE-AS-5 - The MITRE Corporation 6 - AS9051 69280 1.1% 441.3 -- IDM Autonomous System 7 - AS10396 66996 1.1% 1339.9 -- COQUI-NET - DATACOM CARIBE, INC. 8 - AS4766 50082 0.8% 56.7 -- KIXS-AS-KR Korea Telecom 9 - AS17488 48207 0.8% 34.6 -- HATHWAY-NET-AP Hathway IP Over Cable Internet 10 - AS33783 46405 0.7% 281.2 -- EEPAD 11 - AS8151 46142 0.7% 30.2 -- Uninet S.A. de C.V. 12 - AS4788 40621 0.6% 18.9 -- TMNET-AS-AP TM Net, Internet Service Provider 13 - AS8866 39117 0.6% 122.2 -- BTC-AS Bulgarian Telecommunication Company Plc. 14 - AS17974 38238 0.6% 58.4 -- TELKOMNET-AS2-AP PT Telekomunikasi Indonesia 15 - AS14522 34635 0.6% 169.0 -- Satnet 16 - AS3464 33796 0.5% 90.4 -- ASC-NET - Alabama Supercomputer Network 17 - AS9929 33628 0.5% 106.8 -- CNCNET-CN China Netcom Corp. 18 - AS18231 29153 0.5% 118.0 -- EXATT-AS-AP IOL NETCOM LTD 19 - AS7738 28702 0.5% 107.5 -- Telecomunicacoes da Bahia S.A. 20 - AS47467 26561 0.4% 13280.5 -- GRIFFEL Griffel AB TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS47467 26561 0.4% 13280.5 -- GRIFFEL Griffel AB 2 - AS27245 14296 0.2% 7148.0 -- HEIDRICK-CHICAGO - HEIDRICK 3 - AS5691 74595 1.2% 6781.4 -- MITRE-AS-5 - The MITRE Corporation 4 - AS29910 6463 0.1% 6463.0 -- IACP - INTL. ASSN OF CHIEF OF POLICEI 5 - AS22678 3947 0.1% 3947.0 -- OSDE 6 - AS39105 3891 0.1% 3891.0 -- CLASS-AS SC Class Computers And Service SRL 7 - AS23082 18722 0.3% 3744.4 -- MPHI - Michigan Public Health Institute 8 - AS40627 7463 0.1% 3731.5 -- RC-COLO1 - RingCentral Inc 9 - AS28361 3288 0.1% 3288.0 -- 10 - AS28194 18411 0.3% 2301.4 -- 11 - AS30929 2039 0.0% 2039.0 -- HUTCB Hidrotechnical Faculty - Technical University 12 - AS39748 2035 0.0% 2035.0 -- VITAS VITAS LLC 13 - AS5382 2001 0.0% 2001.0 -- TELESYSTEM-NET Planet Service Srl 14 - AS30969 20206 0.3% 1836.9 -- TAN-NET TransAfrica Networks 15 - AS28542 1750 0.0% 1750.0 -- Gobierno del Estado de Coahuila 16 - AS39794 1684 0.0% 1684.0 -- EL-KOZIENICE-AS Elektrownia Kozienice S.A. 17 - AS44194 1656 0.0% 1656.0 -- FREIFUNK-BERLIN-AS Freifunk Berlin 18 - AS39244 1655 0.0% 1655.0 -- TEQNOBASE-AS Teqnobase AS 19 - AS23917 1616 0.0% 1616.0 -- BRIBIE-NET-AS-AP Bribie Island Net Multihomed, Brisbane 20 - AS42380 1605 0.0% 1605.0 -- ERGOLT-AS ERGO LIETUVA UADB TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 192.12.120.0/24 74455 1.1% AS5691 -- MITRE-AS-5 - The MITRE Corporation 2 - 221.134.222.0/24 63100 0.9% AS9583 -- SIFY-AS-IN Sify Limited 3 - 194.126.143.0/24 61857 0.9% AS9051 -- IDM Autonomous System 4 - 83.228.71.0/24 31718 0.5% AS8866 -- BTC-AS Bulgarian Telecommunication Company Plc. 5 - 221.128.192.0/18 25501 0.4% AS18231 -- EXATT-AS-AP IOL NETCOM LTD 6 - 72.50.96.0/20 24581 0.4% AS10396 -- COQUI-NET - DATACOM CARIBE, INC. 7 - 196.42.0.0/20 15045 0.2% AS10396 -- COQUI-NET - DATACOM CARIBE, INC. 8 - 62.182.216.0/21 13290 0.2% AS35706 -- NAO Net at Once AS47467 -- GRIFFEL Griffel AB 9 - 91.203.160.0/22 13281 0.2% AS35706 -- NAO Net at Once AS47467 -- GRIFFEL Griffel AB 10 - 63.84.91.0/24 13136 0.2% AS27245 -- HEIDRICK-CHICAGO - HEIDRICK 11 - 203.63.26.0/24 10669 0.2% AS9747 -- EZINTERNET-AS-AP EZInternet Pty Ltd 12 - 196.27.104.0/21 10087 0.1% AS30969 -- TAN-NET TransAfrica Networks AS8668 -- TELONE-AS TelOne Zimbabwe P/L 13 - 196.27.108.0/22 9846 0.1% AS30969 -- TAN-NET TransAfrica Networks 14 - 83.239.192.0/21 8961 0.1% AS42362 -- ALANIA-AS Sevosetinelectrosvyaz 15 - 216.255.56.0/21 8955 0.1% AS7106 -- OHIOBRIGHTNET - Com Net, Inc. 16 - 202.150.80.0/20 8752 0.1% AS9251 -- SPEEDNET-AP PT Speed Internet Digital 17 - 196.42.48.0/20 8109 0.1% AS10396 -- COQUI-NET - DATACOM CARIBE, INC. 18 - 72.50.112.0/20 8046 0.1% AS10396 -- COQUI-NET - DATACOM CARIBE, INC. 19 - 203.202.140.128/ 6993 0.1% AS7474 -- OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 20 - 148.208.211.0/24 6962 0.1% AS8151 -- Uninet S.A. de C.V. Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

The Cidr Report
by cidr-report＠potaroo.net 15 Aug '08

15 Aug '08

This report has been generated at Fri Aug 15 21:17:41 2008 AEST. The report analyses the BGP Routing Table of AS2.0 router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org for a current version of this report. Recent Table History Date Prefixes CIDR Agg 08-08-08 275536 174033 09-08-08 277076 174082 10-08-08 277111 174109 11-08-08 277184 174315 12-08-08 277411 174839 13-08-08 277665 175560 14-08-08 278090 175338 15-08-08 277664 174543 AS Summary 29073 Number of ASes in routing system 12284 Number of ASes announcing only one prefix 5013 Largest number of prefixes announced by an AS AS4538 : ERX-CERNET-BKB China Education and Research Network Center 88346112 Largest address span announced by an AS (/32s) AS721 : DISA-ASNBLK - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 15Aug08 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 277853 174589 103264 37.2% All ASes AS4538 5013 877 4136 82.5% ERX-CERNET-BKB China Education and Research Network Center AS6389 3200 260 2940 91.9% BELLSOUTH-NET-BLK - BellSouth.net Inc. AS209 2893 668 2225 76.9% ASN-QWEST - Qwest AS4755 1701 292 1409 82.8% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS17488 1300 328 972 74.8% HATHWAY-NET-AP Hathway IP Over Cable Internet AS18566 1045 108 937 89.7% COVAD - Covad Communications Co. AS8151 1509 595 914 60.6% Uninet S.A. de C.V. AS6298 2004 1104 900 44.9% COX-PHX - Cox Communications Inc. AS22773 959 91 868 90.5% CCINET-2 - Cox Communications Inc. AS4323 1489 704 785 52.7% TWTC - tw telecom holdings, inc. AS1785 1454 741 713 49.0% AS-PAETEC-NET - PaeTec Communications, Inc. AS11492 1214 501 713 58.7% CABLEONE - CABLE ONE AS19262 937 242 695 74.2% VZGNI-TRANSIT - Verizon Internet Services Inc. AS2386 1563 913 650 41.6% INS-AS - AT&T Data Communications Services AS9498 674 106 568 84.3% BBIL-AP BHARTI Airtel Ltd. AS6478 1034 486 548 53.0% ATT-INTERNET3 - AT&T WorldNet Services AS18101 692 163 529 76.4% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS6197 954 477 477 50.0% BATI-ATL - BellSouth Network Solutions, Inc AS4766 884 417 467 52.8% KIXS-AS-KR Korea Telecom AS4808 617 154 463 75.0% CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network AS22047 565 129 436 77.2% VTR BANDA ANCHA S.A. AS855 591 157 434 73.4% CANET-ASN-4 - Bell Aliant AS9443 523 91 432 82.6% INTERNETPRIMUS-AS-AP Primus Telecommunications AS7018 1432 1007 425 29.7% ATT-INTERNET4 - AT&T WorldNet Services AS4134 836 421 415 49.6% CHINANET-BACKBONE No.31,Jin-rong Street AS24560 564 152 412 73.0% AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services AS7029 536 135 401 74.8% WINDSTREAM - Windstream Communications Inc AS4780 720 324 396 55.0% SEEDNET Digital United Inc. AS17676 524 142 382 72.9% GIGAINFRA BB TECHNOLOGY Corp. AS3602 450 78 372 82.7% AS3602-RTI - Rogers Telecom Inc. Total 37877 11863 26014 68.7% Top 30 total Possible Bogus Routes 14.14.14.0/24 AS577 BACOM - Bell Canada 24.51.159.0/24 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 24.53.86.0/24 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 24.54.224.0/19 AS20001 ROADRUNNER-WEST - Road Runner HoldCo LLC 24.55.0.0/18 AS20001 ROADRUNNER-WEST - Road Runner HoldCo LLC 24.75.160.0/19 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 24.142.40.0/21 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.142.160.0/19 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.245.128.0/17 AS11492 CABLEONE - CABLE ONE 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV - Wireless Broadband via Satellite 63.140.213.0/24 AS22555 UTC - Universal Talkware Corporation 63.143.71.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 63.143.115.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 63.143.251.0/24 AS22555 UTC - Universal Talkware Corporation 63.248.0.0/16 AS3356 LEVEL3 Level 3 Communications 64.7.112.0/21 AS6453 GLOBEINTERNET TATA Communications 64.7.120.0/21 AS6453 GLOBEINTERNET TATA Communications 64.50.128.0/18 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 64.64.159.0/24 AS32004 BIG-ASN - Business Information Group, Inc. 64.144.0.0/15 AS4565 MEGAPATH2-US - MegaPath Networks Inc. 64.188.0.0/16 AS3356 LEVEL3 Level 3 Communications 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.40.0/21 AS6261 VISINET - Visionary Systems, Inc. 66.54.91.0/24 AS30506 BLACKSUN-1 - Blacksun Technologies LLC 66.55.160.0/19 AS29994 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.199.32.0/20 AS10397 WISP-AS - Wispnet, LLC 66.206.32.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.33.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.34.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.35.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.40.0/22 AS174 COGENT Cogent/PSI 66.206.44.0/23 AS174 COGENT Cogent/PSI 66.206.47.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 66.207.32.0/20 AS23011 67.20.0.0/14 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 68.64.0.0/13 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 68.168.0.0/14 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 68.232.0.0/14 AS7843 ADELPHIA-AS - Road Runner HoldCo LLC 69.71.192.0/20 AS13818 PHX-INTL-TELEPORT - Phoenix International Teleport 69.80.0.0/17 AS3043 AMPHIB-AS - Amphibian Media Corporation 80.88.0.0/21 AS33774 DJAWEB 80.88.8.0/22 AS33774 DJAWEB 80.88.10.0/24 AS33774 DJAWEB 80.88.12.0/24 AS33779 wataniya-telecom-as 91.200.192.128/25 AS44045 DIGIEF-AS Didjief internation kulinari koncept LLC 91.200.193.128/25 AS44045 DIGIEF-AS Didjief internation kulinari koncept LLC 91.200.194.128/25 AS44045 DIGIEF-AS Didjief internation kulinari koncept LLC 91.200.195.128/25 AS44045 DIGIEF-AS Didjief internation kulinari koncept LLC 94.101.80.0/20 AS42926 RADORETELEKOM Radore Autonomous System 94.101.96.0/23 AS44836 SU155-AS SU-155 JSC 94.101.98.0/23 AS44836 SU155-AS SU-155 JSC 94.101.100.0/23 AS44836 SU155-AS SU-155 JSC 94.101.102.0/23 AS44836 SU155-AS SU-155 JSC 94.101.104.0/23 AS44836 SU155-AS SU-155 JSC 94.101.106.0/23 AS44836 SU155-AS SU-155 JSC 94.101.108.0/23 AS44836 SU155-AS SU-155 JSC 94.101.110.0/23 AS44836 SU155-AS SU-155 JSC 95.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 95.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 121.50.12.0/24 AS38236 121.50.13.0/24 AS38236 121.50.14.0/24 AS38236 121.50.15.0/24 AS38236 137.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 151.135.0.0/16 AS4768 CLIX-NZ TelstraClear Ltd 159.3.211.0/24 AS2687 ASATTCA AT&T Global Network Services - AP 163.142.0.0/16 AS2500 WIDE-BB WIDE Project 166.63.0.0/16 AS33775 NITEL-AS 172.7.0.0/24 AS28175 172.10.1.0/30 AS18305 POSNET POSDATA Co.,Ltd 172.16.0.0/16 AS8546 YOUR-COMMS-UK-AS Your Communications Ltd 188.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 188.0.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 188.0.0.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 192.9.200.0/24 AS3602 AS3602-RTI - Rogers Telecom Inc. 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS12582 TSF-DATANET-NGD-AS TSF MPLS VPN Services 192.64.85.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.107.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.108.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.177.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.96.36.0/24 AS5713 SAIX-NET 192.96.37.0/24 AS10474 NETACTIVE 192.96.135.0/24 AS2018 TENET-1 192.96.136.0/23 AS2018 TENET-1 192.96.141.0/24 AS2018 TENET-1 192.96.143.0/24 AS2018 TENET-1 192.96.145.0/24 AS2018 TENET-1 192.96.177.0/24 AS6083 POSIX-AFRICA 192.101.45.0/24 AS2905 TICSA-ASN 192.101.46.0/24 AS6503 Avantel, S.A. 192.101.47.0/24 AS6503 Avantel, S.A. 192.101.64.0/21 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.70.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.71.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.72.0/24 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.73.0/24 AS4765 WORLDNET-AS World Net & Services Co., Ltd. 192.101.74.0/24 AS1239 SPRINTLINK - Sprint 192.122.212.0/24 AS209 ASN-QWEST - Qwest 192.124.248.0/23 AS680 DFN-IP service G-WiN 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.131.233.0/24 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.153.144.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 192.154.32.0/19 AS81 NCREN - MCNC 192.188.208.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 193.200.114.0/23 AS31530 SERVERCREW-AS Servercrew LTD Autonomes System 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.254.192.0/19 AS2116 ASN-CATCHCOM Catch Communications 196.6.108.0/24 AS5713 SAIX-NET 196.10.119.0/24 AS2018 TENET-1 196.10.122.0/23 AS2018 TENET-1 196.10.251.0/24 AS2018 TENET-1 196.10.252.0/23 AS2018 TENET-1 196.10.254.0/24 AS2018 TENET-1 196.13.101.0/24 AS2018 TENET-1 196.13.102.0/23 AS2018 TENET-1 196.13.104.0/24 AS2018 TENET-1 196.13.121.0/24 AS2018 TENET-1 196.13.125.0/24 AS2018 TENET-1 196.13.126.0/24 AS2018 TENET-1 196.13.169.0/24 AS2018 TENET-1 196.13.174.0/23 AS2018 TENET-1 196.13.176.0/21 AS2018 TENET-1 196.13.192.0/22 AS2018 TENET-1 196.13.196.0/24 AS2018 TENET-1 196.201.98.0/24 AS29571 CITelecom-AS 196.216.132.0/24 AS9207 TAIDE-KE-NAIROBI Taide - Kenya POP 196.216.134.0/24 AS9207 TAIDE-KE-NAIROBI Taide - Kenya POP 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET-1 198.54.92.0/24 AS2018 TENET-1 198.54.222.0/24 AS2018 TENET-1 198.97.72.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.80.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.96.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.240.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.144.96.0/20 AS12185 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 198.169.0.0/16 AS803 SASKTEL - Saskatchewan Telecommunications 198.180.198.0/24 AS23715 SEOUL-INTGW-GXS-AP Global Exchange Services 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.0.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.128.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.130.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.131.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.132.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DoD Network Information Center 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DoD Network Information Center 199.114.142.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.144.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.148.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.150.0/24 AS6045 DDN-ASNBLK - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.156.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.0.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.16.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.80.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.73.144.0/20 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 202.80.192.0/20 AS2706 HKSUPER-HK-AP Pacific Internet (Hong Kong) Limited 202.86.252.0/22 AS4748 RESOLINK-AS-AP Resources Link Network Limited 202.86.252.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.94.70.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.207.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.164.100.0/24 AS18101 RIL-IDC Reliance Infocom Ltd Internet Data Centre, 202.176.228.0/24 AS17988 SINOSAT-AS-AP SINOSAT (HONG KONG) LIMITED 202.176.232.0/24 AS17988 SINOSAT-AS-AP SINOSAT (HONG KONG) LIMITED 202.181.32.0/24 AS4645 ASN-HKNET-AP HKNet Co. Ltd 203.12.45.0/24 AS4854 NETSPACE-AS-AP Netspace Online Systems 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.112.111.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.113.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.114.0/24 AS4802 ASN-IINET iiNet Limited 203.112.116.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.117.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.118.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.119.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.120.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.121.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.127.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.128.128.0/19 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 203.128.128.0/24 AS23849 CNNIC-NET263-AP Beijing Capital-online science development Co.,Ltd. 203.152.136.0/23 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.138.0/23 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.142.0/24 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.143.0/24 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.160.110.0/23 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 204.9.216.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.9.217.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.9.218.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.13.140.0/22 AS7270 NET2PHONE - Net2Phone Corp. 204.16.120.0/23 AS12077 204.16.122.0/23 AS12077 204.19.14.0/23 AS577 BACOM - Bell Canada 204.48.58.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.48.60.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.144.160.0/20 AS7296 ALCHEMYNET - Alchemy Communications, Inc. 205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 206.162.224.0/19 AS23464 ILCSNET - Interlink Computer Services 206.180.240.0/20 AS12083 KNOLOGY-NET - Knology Holdings 206.220.240.0/24 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.240.64/26 AS22335 MREN - Metropolitan Research and Education Network 206.220.240.128/25 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.240.160/30 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.240.220/32 AS10764 STARTAP - National Center for Supercomputing Applications 206.220.241.0/24 AS10764 STARTAP - National Center for Supercomputing Applications 207.98.209.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 207.98.223.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 207.191.128.0/19 AS10887 BPSI-AS - BPSI Internet Services 207.204.168.0/24 AS15150 BELLTECH-AS - BELLWETHER TECHNOLOGY CORPORATION 207.204.222.0/24 AS22773 CCINET-2 - Cox Communications Inc. 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc. 208.38.192.0/21 AS14237 BEAMSPEED1 - Beamspeed 208.38.202.0/24 AS14237 BEAMSPEED1 - Beamspeed 208.38.203.0/24 AS14237 BEAMSPEED1 - Beamspeed 208.38.204.0/22 AS14237 BEAMSPEED1 - Beamspeed 209.54.93.0/24 AS22773 CCINET-2 - Cox Communications Inc. 209.54.111.0/24 AS22773 CCINET-2 - Cox Communications Inc. 209.54.123.0/24 AS6062 NETPLEX - NETPLEX 209.54.240.0/21 AS10887 BPSI-AS - BPSI Internet Services 209.105.224.0/19 AS20074 209.140.90.0/24 AS14461 NTSL - NET SOLUTIONS 209.140.224.0/21 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.234.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.235.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.236.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.237.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.238.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.140.239.0/24 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.141.16.0/21 AS10573 WEBNEXUS - WebNexus Communications Inc. 209.141.48.0/22 AS14461 NTSL - NET SOLUTIONS 209.145.192.0/18 AS3043 AMPHIB-AS - Amphibian Media Corporation 210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone 216.37.114.0/23 AS3549 GBLX Global Crossing Ltd. 216.37.120.0/23 AS13377 216.59.0.0/17 AS3356 LEVEL3 Level 3 Communications 216.99.16.0/24 AS6395 LVLT-6395 - Level 3 Communications, Inc. 216.99.20.0/24 AS6395 LVLT-6395 - Level 3 Communications, Inc. 216.162.96.0/19 AS7393 CYBERCON - CYBERCON, INC. 216.172.198.0/24 AS22773 CCINET-2 - Cox Communications Inc. 216.172.199.0/24 AS22773 CCINET-2 - Cox Communications Inc. 216.176.22.0/24 AS20299 Newcom Limited 216.210.86.0/24 AS577 BACOM - Bell Canada 216.240.240.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.241.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.251.207.0/24 AS1239 SPRINTLINK - Sprint 217.78.71.0/24 AS12491 IPPLANET-AS IPPlanet 217.78.72.0/24 AS12491 IPPLANET-AS IPPlanet 217.78.73.0/24 AS12491 IPPLANET-AS IPPlanet Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Re: route policy (Re: Public shaming list for ISPs announcing other ISPs IP space by mistake)
by Brandon Butterworth 15 Aug '08

15 Aug '08

> > My thoughts on the prefix filtering issue would be that we need some kind > > of system that works along the same principles as DNSSEC and SPF, ie a > > holder of IP space can publish that they would like everybody to filter > > in a certain way for announcements for that perticular prefix, and then > > the other end can do so if they want to. http://blog.wired.com/27bstroke6/2008/08/experts-accuse.html "The Internet Assigned Numbers Authority -- which coordinates the internet -- has been prototyping a system to sign the root-zone file for the last year, but they can't do the same for the internet's top servers without approval from the Department of Commerce" Sounds like some work that could be recycled (and save being wasted if it's decided to have Verisign do the dnssec instead) > Herein is the value, the RIR (RIPE) is also the holder of the policy. > With ARIN, this is not the case, there is RADB and a number of other RR's > that are out there for varying reasons, some personal and some business. Yes, RIPE rock. Please make it all not suck. > I think in this web 2.0 world, everything you're speaking of > can be a challenge but not be impossible. The problem I see is there are > no good tools. In 2.0 world someone would make routetubebookparty and sell out to Google for millions, VCs line up here (the owner is as close to owning the internet as anyone) > This can help you audit the routes that are going to be placed > in a prefix-list. How do you integrate something like this into your > business policy? Have customers submit a web form for their routes? It's > easy when your customer is AS267, but what if your customer is something > larger like telstra? probably signed lumps of XML, people can make it however they want > If I can make this backend uglyness called "RADB/irrd" invisible > to my customers, will that help? I presume this would replace all the old stuff brandon

3 2

ARIN is currently seeking nominations...
by Paul Vixie 14 Aug '08

14 Aug '08

ARIN encourages eligible members of the internet community to take part in nominating and electing candidates for its Board of Trustees, Advisory Council, and representatives on the Number Resource Organization Number Council. Please take the time to nominate qualified candidates for these positions. The call for nominations closes at 17:00 ET on Wednesday, 20 August 2008. ARIN is currently seeking nominations for the following positions: * Two (2) seats on the ARIN Board of Trustees * Five (5) seats on the ARIN Advisory Council * One (1) seat on the Number Resource Organization (NRO) Number Council Board of Trustees and Advisory Council: You must be a Trustee or ARIN General Member in good standing to make nominations for the Board of Trustees and Advisory Council. However, those nominated do not need to be ARIN members. Self-nominations are permitted. A petition process is available to nonmembers seeking to nominate themselves for the Board of Trustees. NRO Number Council: Any individual residing within the ARIN service region may be nominated, with the exception of Regional Internet Registry staff members. Self-nominations are permitted. Nominators are not required to be ARIN General Members in good standing. All nominees are subject to the Nomination and Appointment Conflict of Interest List at: http://www.arin.net/elections/electionguidelines.html#conflicts The nomination form is available through ARIN’s online Election Headquarters at: https://app.arin.net/election/ Regards, ARIN NomCom -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

New Tool for SSH and self-signed HTTPS Authentication
by Dan Wendlandt 14 Aug '08

14 Aug '08

Hi NANOG, Our research group at Carnegie Mellon has created a new tool called Perspectives to help authenticate remote hosts without requiring a full-blown PKI. Given the increased vulnerability to "man-in-the-middle" attacks due to the recent DNS issue, this tool seems relevant to anyone using SSH or HTTPS with self-signed certificates (It also can help clients avoid the annoying security error page Firefox 3 now shows for all sites using self-signed SSL certificates). http://www.cs.cmu.edu/~perspectives/ How it works: Perspectives uses network probes from multiple network locations and over time to get a better idea if the unauthenticated key your SSH client or browser received from the network is in fact the server's valid key. We have a few such probing servers, which we call "network notaries", scattered through the Internet, meaning that you can easily check if a key is likely to be valid even if it has not been signed by a certificate authority. The first time a notary is queried for a particular destination, they probe "on-demand" and return information about the key currently used by that sever. Once they know about a server, the notary will contact it daily to build up a history of the keys that server has used over time. Subsequent client queries can take advantage of historical key information as well. You can play with this approach using one of three "clients" we've created: * a web interface which shows a graphical timeline of the keys used by a server ( http://moo.cmcl.cs.cmu.edu/perspectives/ ) * a modified version of openSSH that contacts notaries and reports the results when the key received from the remove server differs from the cached key (http://www.cs.cmu.edu/~perspectives/openssh.html ) * a firefox extension (version 3+ only) that queries notaries and can override the annoying security error page firefox gives you for any self-signed certificate. ( http://www.cs.cmu.edu/~perspectives/firefox.html ) An academic paper and more general information is available at: http://www.cs.cmu.edu/~perspectives/ All the code is open-source and we welcome feedback. Thanks for your time, Dan Wendlandt & the Perspectives Team -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Dan Wendlandt 650-906-2650 http://www.cs.cmu.edu/~dwendlan/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Security Assessment of the Internet Protocol
by Fernando Gont 14 Aug '08

14 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello, folks, The United Kingdom's Centre for the Protection of National Infrastructure has just released the document "Security Assessment of the Internet Protocol", on which I have had the pleasure to work during the last year or so. The motivation to produce this document is explained in the Preface of the document as follows: - ---- cut here ---- The TCP/IP protocols were conceived during a time that was quite different from the hostile environment they operate in now. Yet a direct result of their effectiveness and widespread early adoption is that much of today's global economy remains dependent upon them. While many textbooks and articles have created the myth that the Internet Protocols (IP) were designed for warfare environments, the top level goal for the DARPA Internet Program was the sharing of large service machines on the ARPANET. As a result, many protocol specifications focus only on the operational aspects of the protocols they specify and overlook their security implications. Though Internet technology has evolved, the building blocks are basically the same core protocols adopted by the ARPANET more than two decades ago. During the last twenty years many vulnerabilities have been identified in the TCP/IP stacks of a number of systems. Some were flaws in protocol implementations which affect only a reduced number of systems. Others were flaws in the protocols themselves affecting virtually every existing implementation. Even in the last couple of years researchers were still working on security problems in the core protocols. The discovery of vulnerabilities in the TCP/IP protocols led to reports being published by a number of CSIRTs (Computer Security Incident Response Teams) and vendors, which helped to raise awareness about the threats as well as the best mitigations known at the time the reports were published. Much of the effort of the security community on the Internet protocols did not result in official documents (RFCs) being issued by the IETF (Internet Engineering Task Force) leading to a situation in which "known" security problems have not always been addressed by all vendors. In many cases vendors have implemented quick "fixes" to protocol flaws without a careful analysis of their effectiveness and their impact on interoperability. As a result, any system built in the future according to the official TCP/IP specifications might reincarnate security flaws that have already hit our communication systems in the past. Producing a secure TCP/IP implementation nowadays is a very difficult task partly because of no single document that can serve as a security roadmap for the protocols. There is clearly a need for a companion document to the IETF specifications that discusses the security aspects and implications of the protocols, identifies the possible threats, proposes possible counter-measures, and analyses their respective effectiveness. This document is the result of an assessment of the IETF specifications of the Internet Protocol from a security point of view. Possible threats were identified and, where possible, counter-measures were proposed. Additionally, many implementation flaws that have led to security vulnerabilities have been referenced in the hope that future implementations will not incur the same problems. This document does not limit itself to performing a security assessment of the relevant IETF specification but also offers an assessment of common implementation strategies. Whilst not aiming to be the final word on the security of the IP, this document aims to raise awareness about the many security threats based on the IP protocol that have been faced in the past, those that we are currently facing, and those we may still have to deal with in the future. It provides advice for the secure implementation of the IP, and also insights about the security aspects of the IP that may be of help to the Internet operations community. Feedback from the community is more than encouraged to help this document be as accurate as possible and to keep it updated as new threats are discovered. - ---- cut here ---- The document is available at CPNI's web site: http://www.cpni.gov.uk/Products/technicalnotes/3677.aspx Any comments will be more than welcome. Kind regards, Fernando Gont -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) - not licensed for commercial use: www.pgp.com wsBVAwUBSKSBzGl+Jnd3SMmAAQhJPAgAq4SY+PG0ONFUsJDMWmadjKnG+LUSbyg6 Fnr/Up7HF59Z61r6/NXUG2TiUccu8u/ZE2ew7aUteAvbRM4sUWuQBlGXTRwgtv6S PKxOCQ5luLJjxDN9cKCN5KfpMmkCazoUXgno1PblKQH9CSxmZJxipsDWDLTMJHfU sGIwtX0bpgj4kWw+S3ycAwTRiwBApVYAZbzC58HwxhFbxZdLohGNdaAv8yuKskFP hzsEOfKSvcmoqLVE3kvm/8prjZhfocBcc/7Pr5RFugbP0dhUkLxye6GOiyY/tEzL XL3sDKc9lygfr/l1hk5ZDFpZcp0Rjw6REMo8MlojiM4+3qR1L2Ib8g== =xJ/e -----END PGP SIGNATURE----- -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Re: [Fwd: Re: DNS attacks evolve]
by Mike Leber 14 Aug '08

14 Aug '08

FYI. There was some question here about whether PowerDNS was vulnerable or not and what it was doing, so I asked Bert Hubert about it. Here is his answer: -------- Original Message -------- Subject: Re: [Fwd: Re: DNS attacks evolve] Date: Wed, 13 Aug 2008 21:29:50 +0200 From: bert hubert <bert.hubert(a)netherlabs.nl> To: Mike Leber <mleber(a)he.net> References: <48A08113.6010801(a)he.net> On Mon, Aug 11, 2008 at 11:12:35AM -0700, Mike Leber wrote: > Is there any post anywhere that provides more technical detail about how > the PowerDNS cache is not vulnerable? Mike, very briefly, PowerDNS implements two things: source port randomization + near miss detection. Near miss detection is documented here: http://doc.powerdns.com/built-in-recursor.html spoof-nearmiss-max If set to non-zero, PowerDNS will assume it is being spoofed after seeing this many answers with the wrong id. Defaults to 20. Some more is in: http://doc.powerdns.com/recursor-details.html > I'll post a link to it and provide other operators a better answer than > the equivalent of "because I say so". The answer could be anything such > as "we reject updates to glue when", or "it takes 10 years based on > these calculations...". Calculations on how long it will take are on http://blog.netherlabs.nl/articles/2008/08/05/calculating-the-chance-of-spo… These calculations go beyond what powerdns 3.1.7 does however. > > If your vendor told you that you are not at risk they are wrong, > and need to go re-read the Kaminski paper. EVERYONE is vunerable, > the only question is if the attack takes 1 second, 1 minute, 1 hour > or 1 day. While possibly interesting for short term problem Or 1 year, or 2 years or a century. Bert -- http://www.PowerDNS.com Open source, database driven DNS Software http://netherlabs.nl Open and Closed source services -- +---------------- H U R R I C A N E - E L E C T R I C ----------------+ | Mike Leber Wholesale IPv4 and IPv6 Transit 510 580 4100 | | Hurricane Electric AS6939 | | mleber(a)he.net Internet Backbone & Colocation http://he.net | +---------------------------------------------------------------------+

2 1