- Test - lists.nanog.org

Re: Power outages in Florida
by Paul Ferguson 27 Feb '08

27 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "David Diaz" <davediaz.tech(a)gmail.com> wrote: >Being that Miami is my home town. I found it interesting today that in >areas affected by the black out services like verizon EVDO lost their >backbone connections. The towers were up with signal but no one could get >to the IP gateway. Driving a few miles to a lit area provided >connectivity. > >This is a concern for those of us with hurricane experience in the area. > Ya think? ;-) In fact, there were multitudes of digital cellular outages reported this afternoon all across central & south Florida. Not a very comfortable feeling, methinks. - - ferg p.s. In fact, I think this morning's outages down in Florida should shed some light on some serious issue in communications reliabilities... even CNN couldn't keep a good signal due to power issues. :-) -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHxP6Yq1pz9mNUZTMRAvykAJ0av1YZIdXOT4vK/I7Py+yXWjZOGgCg/iiB angWtRCPTVvLVjP8UG5Ul2w= =zA7G -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

YouTube IP Hijacking
by Sargun Dhillon 27 Feb '08

27 Feb '08

As you guys probably know Youtube's IP's are being hijacked. Trace: ~ $ host youtube.com youtube.com has address 208.65.153.253 youtube.com has address 208.65.153.238 youtube.com has address 208.65.153.251 [Same /24] 701 3491 17557 64.74.137.253 (metric 1) from 66.151.144.148 (66.151.144.148) Origin IGP, metric 100, localpref 100, valid, external Community: 65010:300 Last update: Sun Feb 24 11:33:05 2008 [PST8PDT] 3491 17557 216.218.135.205 from 216.218.135.205 (216.218.252.164) Origin IGP, metric 100, localpref 100, valid, external, best Last update: Sun Feb 24 10:47:57 2008 [PST8PDT] So, it seems that youtube's ip block has been hijacked by a more specific prefix being advertised. This is a case of IP hijacking, not case of DNS poisoning, youtube engineers doing something stupid, etc. For people that don't know. The router will try to get the most specific prefix. This is by design, not by accident. This is a case of censorship on the internet. Anyways, I hope this doesn't get into a political situation, and someone stops this. What action are you going to take? Are you going to filter announcements from AS17557, or just filter that specific announcement? Considering youtube is a fairly high-traffic website I think that other operators are just going to start filtering that AS. This is a great example of global politics getting in the way of honest corporatism. This is also an example of how vulnerable the internet is, and how lax providers are in their filtering policies. I don't know how large Pakistani Telecom is, but it I bet its not large enough that PCCW should be allowing it to advertise anything.

20 22

Re: YouTube IP Hijacking
by Paul Ferguson 27 Feb '08

27 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Christopher Morrow" <morrowc.lists(a)gmail.com> wrote: >> Well... If you want to work on one, I'm willing help shepherd it >> through >> the process. We even have a working group setup for that purpose. > >proposal for work in GROW? Actually, that sounds reasonable -- if GROW [1] outcomes are heeded by the operations community. Historically, it seems, the Internet operations community picks and chooses the IETF RFCs/BCPs that each ISP implements on a "one-off" basis. Something (else) that I have long admired is the way the RIPE community has built working groups around critical issues. I'm still convinced that the NANOG community -- perhaps in collaboration with RIPE and APNIC, et al -- should work to craft ISP "best current practices" in these areas, since ISPs don't seem to heed IETF documents, except when it serves their own business & operational practices. - - ferg [1] http://www.ietf.org/html.charters/grow-charter.html -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHxMu8q1pz9mNUZTMRAk/wAJ9Mm3sWL9t1cCfy8sAhTd6DfxMIGwCfTauG 9lha9MMTiR4kPoPEHtBjfRQ= =atCM -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: YouTube IP Hijacking
by Randy Epstein 27 Feb '08

27 Feb '08

>>This isn't the answer. If it were, there would be no car accidents, pilot >>error caused plane crashes, etc. > Probably the reason you dont need to have a pilot license... Sorry, what? > Dont get me wrong: I not the "Policy this/that" type but i think its a > good idea to ensure that ppl who run "basic network infrastructure" have > minimal clue of how to do this. Do you really believe that LIRs should be administering tests before issuing ASNs? Should vendors do the same prior to selling their gear? Take this further, electric company should require its customers to take a test before they are allowed to order service for fear they might electrocute themselves or the water company fearing customers may drown? > -- Arnd Randy

9 11

Weekly Routing Table Report
by Routing Analysis Role Account 27 Feb '08

27 Feb '08

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 23 Feb, 2008 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 246872 Prefixes after maximum aggregation: 124953 Deaggregation factor: 1.98 Unique aggregates announced to Internet: 119515 Total ASes present in the Internet Routing Table: 27438 Prefixes per ASN: 9.00 Origin-only ASes present in the Internet Routing Table: 23927 Origin ASes announcing only one prefix: 11617 Transit ASes present in the Internet Routing Table: 3511 Transit-only ASes present in the Internet Routing Table: 72 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 19 Max AS path prepend of ASN (29642) 15 Prefixes from unregistered ASNs in the Routing Table: 59 Unregistered ASNs in the Routing Table: 15 Number of 32-bit ASNs allocated by the RIRs: 46 Prefixes from 32-bit ASNs in the Routing Table: 9 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 927 Number of addresses announced to Internet: 1835598080 Equivalent to 109 /8s, 105 /16s and 1 /24s Percentage of available address space announced: 49.5 Percentage of allocated address space announced: 60.8 Percentage of available address space allocated: 81.4 Percentage of address space in use by end-sites: 70.3 Total number of prefixes smaller than registry allocations: 116852 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 56515 Total APNIC prefixes after maximum aggregation: 20789 APNIC Deaggregation factor: 2.72 Prefixes being announced from the APNIC address blocks: 54018 Unique aggregates announced from the APNIC address blocks: 22875 APNIC Region origin ASes present in the Internet Routing Table: 3133 APNIC Prefixes per ASN: 17.24 APNIC Region origin ASes announcing only one prefix: 826 APNIC Region transit ASes present in the Internet Routing Table: 481 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 330881472 Equivalent to 19 /8s, 184 /16s and 217 /24s Percentage of available APNIC address space announced: 75.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 115756 Total ARIN prefixes after maximum aggregation: 65427 ARIN Deaggregation factor: 1.77 Prefixes being announced from the ARIN address blocks: 84476 Unique aggregates announced from the ARIN address blocks: 33341 ARIN Region origin ASes present in the Internet Routing Table: 12151 ARIN Prefixes per ASN: 6.95 ARIN Region origin ASes announcing only one prefix: 4686 ARIN Region transit ASes present in the Internet Routing Table: 1149 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 15 Number of ARIN addresses announced to Internet: 356278656 Equivalent to 21 /8s, 60 /16s and 97 /24s Percentage of available ARIN address space announced: 73.2 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 173/8, 174/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 52449 Total RIPE prefixes after maximum aggregation: 32857 RIPE Deaggregation factor: 1.60 Prefixes being announced from the RIPE address blocks: 47511 Unique aggregates announced from the RIPE address blocks: 31891 RIPE Region origin ASes present in the Internet Routing Table: 10944 RIPE Prefixes per ASN: 4.34 RIPE Region origin ASes announcing only one prefix: 5730 RIPE Region transit ASes present in the Internet Routing Table: 1652 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 346376192 Equivalent to 20 /8s, 165 /16s and 72 /24s Percentage of available RIPE address space announced: 79.4 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 18675 Total LACNIC prefixes after maximum aggregation: 4729 LACNIC Deaggregation factor: 3.95 Prefixes being announced from the LACNIC address blocks: 17075 Unique aggregates announced from the LACNIC address blocks: 9357 LACNIC Region origin ASes present in the Internet Routing Table: 908 LACNIC Prefixes per ASN: 18.81 LACNIC Region origin ASes announcing only one prefix: 302 LACNIC Region transit ASes present in the Internet Routing Table: 153 Average LACNIC Region AS path length visible: 3.9 Max LACNIC Region AS path length visible: 19 Number of LACNIC addresses announced to Internet: 48446720 Equivalent to 2 /8s, 227 /16s and 61 /24s Percentage of available LACNIC address space announced: 48.1 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 3417 Total AfriNIC prefixes after maximum aggregation: 1133 AfriNIC Deaggregation factor: 3.02 Prefixes being announced from the AfriNIC address blocks: 3860 Unique aggregates announced from the AfriNIC address blocks: 1806 AfriNIC Region origin ASes present in the Internet Routing Table: 229 AfriNIC Prefixes per ASN: 16.86 AfriNIC Region origin ASes announcing only one prefix: 73 AfriNIC Region transit ASes present in the Internet Routing Table: 45 Average AfriNIC Region AS path length visible: 3.7 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 10006016 Equivalent to 0 /8s, 152 /16s and 174 /24s Percentage of available AfriNIC address space announced: 29.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4755 1580 386 81 Videsh Sanchar Nigam Ltd. Aut 9583 1148 109 21 Sify Limited 9498 1130 550 63 BHARTI BT INTERNET LTD. 17488 992 64 89 Hathway IP Over Cable Interne 4766 854 5495 345 Korea Telecom (KIX) 4134 853 12089 313 CHINANET-BACKBONE 23577 811 34 696 Korea Telecom (ATM-MPLS) 18101 712 128 65 Reliance Infocom Ltd Internet 9829 584 449 11 BSNL National Internet Backbo 4812 553 940 85 China Telecom (Shanghai) Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1427 5988 992 AT&T WorldNet Services 4323 1375 1011 363 Time Warner Telecom 2386 1362 634 839 AT&T Data Communications Serv 11492 1206 138 30 Cable One 7011 1060 308 613 Citizens Utilities 18566 1042 296 10 Covad Communications 6197 1034 754 511 BellSouth Network Solutions, 174 984 6835 815 Cogent Communications 6478 927 237 112 AT&T Worldnet Services 20115 887 808 484 Charter Communications Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8452 398 188 7 TEDATA 3292 396 1778 361 TDC Tele Danmark 3301 335 1443 305 TeliaNet Sweden 3320 325 7045 269 Deutsche Telekom AG 8866 289 78 24 Bulgarian Telecommunication C 8551 279 267 42 Bezeq International 680 275 2046 256 DFN-IP service G-WiN 3215 273 2607 94 France Telecom Transpac 8708 271 420 241 Romania Data Systems S.A. 6746 269 128 247 Dynamic Network Technologies, Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1170 2438 218 UniNet S.A. de C.V. 11830 555 299 9 Instituto Costarricense de El 7303 444 216 58 Telecom Argentina Stet-France 16814 426 27 10 NSS, S.A. 11172 400 115 66 Servicios Alestra S.A de C.V 6471 396 85 40 ENTEL CHILE S.A. 10620 366 96 49 TVCABLE BOGOTA 14117 352 25 15 Telefonica del Sur S.A. 22047 323 270 14 VTR PUNTO NET S.A. 10481 301 120 10 Prima S.A. Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 411 60 31 LINKdotNET AS number 3741 282 869 224 The Internet Solution 20858 210 34 3 EgyNet 2018 158 276 117 Tertiary Education Network 6713 143 135 11 Itissalat Al-MAGHRIB 33783 129 9 15 EEPAD TISP TELECOM & INTERNET 5536 121 8 16 Internet Egypt Network 33776 99 6 7 Starcomms Nigeria Limited 24835 90 48 7 RAYA Telecom - Egypt 29571 80 13 7 Ci Telecom Autonomous system Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4755 1580 386 81 Videsh Sanchar Nigam Ltd. Aut 7018 1427 5988 992 AT&T WorldNet Services 4323 1375 1011 363 Time Warner Telecom 2386 1362 634 839 AT&T Data Communications Serv 11492 1206 138 30 Cable One 8151 1170 2438 218 UniNet S.A. de C.V. 9583 1148 109 21 Sify Limited 9498 1130 550 63 BHARTI BT INTERNET LTD. 7011 1060 308 613 Citizens Utilities 18566 1042 296 10 Covad Communications Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 11492 1206 1176 Cable One 9583 1148 1127 Sify Limited 9498 1130 1067 BHARTI BT INTERNET LTD. 18566 1042 1032 Covad Communications 4323 1375 1012 Time Warner Telecom 8151 1170 952 UniNet S.A. de C.V. 17488 992 903 Hathway IP Over Cable Interne 6478 927 815 AT&T Worldnet Services 22773 874 809 Cox Communications, Inc. 19262 884 733 Verizon Global Networks Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 15190 UNALLOCATED 63.98.176.0/24 701 UUNET Technologies, 18506 UNALLOCATED 63.107.123.0/24 33286 Turlock Irrigation D 16886 UNALLOCATED 63.109.3.0/24 1239 Sprint 16886 UNALLOCATED 63.167.139.0/24 1239 Sprint 33526 UNALLOCATED 64.128.26.0/24 4323 Time Warner Telecom 21624 UNALLOCATED 65.163.176.0/24 701 UUNET Technologies, 65000 PRIVATE 92.62.240.0/20 24750 Cable Internet Syste 64601 PRIVATE 118.232.77.0/24 9924 Taiwan Fixed Network 64601 PRIVATE 118.232.78.0/24 9924 Taiwan Fixed Network 64601 PRIVATE 118.232.224.0/21 9924 Taiwan Fixed Network Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.48.10.0/23 19548 Adelphia Business Solutions 24.48.12.0/22 19548 Adelphia Business Solutions 24.48.80.0/21 19548 Adelphia Business Solutions 24.54.224.0/19 20001 HoldCo LLC - Road Runner 24.142.40.0/21 7018 AT&T WorldNet Services 24.142.160.0/19 7018 AT&T WorldNet Services 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 62.61.220.0/24 24974 Tachyon Europe BV - Wireless 62.72.160.0/19 24896 IntellCOM Provider LIR, Kiev, Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:9 /10:16 /11:39 /12:134 /13:276 /14:494 /15:985 /16:9773 /17:4253 /18:7119 /19:15160 /20:17298 /21:16433 /22:20813 /23:21929 /24:129455 /25:877 /26:1109 /27:568 /28:95 /29:9 /30:1 /31:0 /32:8 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 11492 1194 1206 Cable One 2386 1068 1362 AT&T Data Communications Serv 18566 1023 1042 Covad Communications 9583 984 1148 Sify Limited 7011 943 1060 Citizens Utilities 4755 932 1580 Videsh Sanchar Nigam Ltd. Aut 6478 926 927 AT&T Worldnet Services 17488 807 992 Hathway IP Over Cable Interne 9498 803 1130 BHARTI BT INTERNET LTD. 23577 802 811 Korea Telecom (ATM-MPLS) Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 8:101 12:1983 13:1 15:21 16:3 17:6 18:13 20:35 24:1027 25:1 32:61 33:4 38:390 40:65 41:597 44:2 47:8 52:3 55:3 56:3 57:22 58:522 59:422 60:407 61:988 62:1079 63:1950 64:3357 65:2363 66:3635 67:1131 68:629 69:2104 70:483 71:123 72:1452 73:6 74:842 75:236 76:258 77:556 78:499 79:80 80:892 81:824 82:586 83:355 84:522 85:1006 86:393 87:650 88:295 89:1166 90:12 91:1033 92:134 93:79 95:2 96:13 97:10 98:74 99:3 114:1 115:1 116:534 117:262 118:78 119:154 121:439 122:706 123:289 124:804 125:1097 128:310 129:198 130:132 131:399 132:69 133:9 134:188 135:37 136:220 137:117 138:156 139:63 140:489 141:108 142:377 143:265 144:340 145:53 146:335 147:131 148:486 149:178 150:124 151:148 152:95 153:131 154:11 155:290 156:201 157:250 158:162 159:217 160:230 161:100 162:203 163:197 164:567 165:425 166:292 167:307 168:583 169:133 170:432 171:28 172:3 189:155 190:1399 192:5765 193:4100 194:3254 195:2332 196:997 198:3770 199:3191 200:5458 201:1277 202:7584 203:7794 204:3971 205:2059 206:2413 207:2728 208:3146 209:3557 210:2529 211:1032 212:1284 213:1585 214:445 215:47 216:4155 217:1200 218:337 219:399 220:1099 221:402 222:308 End of report

8 7

Power outages in Florida
by John van Oppen 26 Feb '08

26 Feb '08

Major media outlets have been reporting massive power outages in Florida. Given the scope it seems interesting nobody has commented. >From the news reports it sounds like everyone in Miami just got an unscheduled generator test. The SIP proxies I deal with there are still up, so that is good, anyone having issues. Anyone got more info? Thanks, John

3 2

Re: Power outages in Florida
by Paul Ferguson 26 Feb '08

26 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "John van Oppen" <john(a)vanoppen.com> wrote: >Major media outlets have been reporting massive power outages in >Florida. Given the scope it seems interesting nobody has commented. > >From the news reports it sounds like everyone in Miami just got an >unscheduled generator test. The SIP proxies I deal with there are >still up, so that is good, anyone having issues. > >Anyone got more info? Some discussion over on the "outages" list: http://isotf.org/mailman/listinfo/outages - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHxIICq1pz9mNUZTMRAntAAKCnxeezXAauoI+ASRG5NyYUXOpVDACdHBuz 6SaAUHXVWNg7EjWSIeyX97M= =GZum -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

NANOG42 Program Committee Meeting Minutes have been posted
by Ren Provo 26 Feb '08

26 Feb '08

Hi folks, The minutes from the NANOG PC lunch meeting on Tuesday the 19th of February during NANOG42 in San Jose, CA have been posted: http://www.nanog.org/pc.nanog42_minutes.html Minutes from NANOG43 planning calls will be linked from http://www.nanog.org/pc.html Cheers, -Ren Provo, on behalf of the NANOG Program Committee

1 0

hijack chronology: was [ YouTube IP Hijacking ]
by Martin A. Brown 26 Feb '08

26 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, Late last night, after poring through our data, I posted a detailed chronology of the hijack as seen from our many peering sessions. I would add to this that the speed of YouTube's response to this subprefix hijack impressed me. As discussed earlier in this thread, this is really the same old song--it simply has a new verse now. (How many of our troubadors know all of the verses since AS 7007?) Best, - -Martin [0] http://www.renesys.com/blog/2008/02/pakistan_hijacks_youtube.shtml - -- Martin A. Brown --- Renesys Corporation --- mabrown(a)renesys.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: pgf-0.72 (http://linux-ip.net/sw/pine-gpg-filter/) iD8DBQFHwtYodXQGngQsWbkRAv1PAKDB0w1OjRmKjF7027ccZJzuzyboKQCgwxFt V8CNr0Nzw2lqx0O5vk3uHKo= =GUic -----END PGP SIGNATURE-----

2 1

Re: YouTube IP Hijacking
by Paul Wall 26 Feb '08

26 Feb '08

On Sun, 24 Feb 2008, Sargun Dhillon wrote: > I don't know how large Pakistani Telecom is, but it I bet its not large > enough that PCCW should be allowing it to advertise anything. I think you're failing to take into account how multihoming generally works. The real fallacy here is that PCCW/BTN refuses to prefix-list filter their customers, as evidenced by this and past leaks. If something productive can come from today's outage, it would be PCCW beginning to do their part as responsible Internet citizens, given (excuse the pun) "peer" pressure. I'd also focus on the lessons learned from the un-official "IP Hijacking BOF" held in San Jose, during which engineers and researchers studied the extent to which obviously-bogus route advertisements propagated across the public Internet. At these events, prefixes such as 1/8 and 100/7 were advertised, and, by Renesys/bgplay/route-views/etc data, accepted by >99% (?) of the internet. IP blocks that were hijacked before (like 146.20/16) were announced with similar outcome. Results were planned to be presented at the next NANOG, but they shouldn't be a surprise to anyone in the industry: nobody filters. Paul Wall

3 2