- Test - lists.nanog.org

FW: Blackholes and IXs and Completing the Attack.
by Ben Butler 03 Feb '08

03 Feb '08

Hi, Agreed, but when you have >100 peers that is still a fair bit of work. I know technically how to do it and am doing this with transits but then there are only seven of those. It is not a question of how or can, but should / is it valuable / constructive? The starting point in the thought process having just done it for transits was right ok, now how do we sensibly scale this to apply it at IXes without everyone having to run round contacting everyone else and to see if there was an easier way of doing things, hence the suggestion. Plus it keeps things nice and separated, your IX peering sessions announce just the main prefixes, the session to the "blackhole reflector" can be in a separate peer-group and you only send the /32s to the reflector. You don't have to worry about who uses which communities as each member that chooses to peer with the reflector is able to apply an inbound routemap of their own choosing to any prefixes they receive from this reflector at each individual IX. Given that an ISP has elected to Complete the attack on a host that is being DoSed, for whatever reason, and they have chosen to send blackhole announcements to transit the logical extension seems to be to automate the sending of them to IXs to try to further cut down on traffic. I guess the alernative is that if your IX interconnect is getting hammered the only other option is to admin down all the sesions over the IX and let all the traffic flow into transit and let them blackhole it. But this also seems like there might be a better way that was less disruptive. And this seems like a easy way, internally you just community tag on the trigger box for where you want the announcement to go, transit, internal, customers, IX all,1 2 not 3 - whatever - and BGP sends it out. Easy, and a single system to send out all updates when you choose to and easy to remove when you want to take it out again. If you subscribe to completing the attack as a strategy, then the suggestion seemed like an easy way of rolling it out to the next logical point after transit. Kind Regards Ben ________________________________ From: Rick Astley [mailto:jnanog@gmail.com] Sent: 03 February 2008 01:02 To: Ben Butler Cc: nanog(a)merit.edu Subject: Re: Blackholes and IXs and Completing the Attack. While I am not sure I fully understand your suggestion, I don't think it would be that hard to set up manually. Sure it would require asking the individual peers for their black hole communities, but of they don't have one they are unlikely to honor the infrastructure you describe anyway. Assume your network is set up to discard packets marked with community 13005:666 Get a list of your peers blackhole communities, when you announce the route from a location on your network, tag it with community 13005:666 but also 1111:777, 2222:888 etc. for the individual peers from the source. This prevents you from having to update multiple policies in multiple locations for each attack. As long as they accept the /32 announced to them with their black hole community, they should discard the traffic without sending it to you. Not all peers will have a blackhole community, but you need some way to know when the attack is over to know when to withdraw the route, and they are useful for this. If you are real lazy, on the router you announce the black hole from, add an export policy that says from community 13005:666, then community add 1111:777, 2222:888 etc. This way you only need to: 1. Update one policy in one place when peers change 2. Announce the route from one location adding one community to it.

1 0

RE: Blackholes and IXs and Completing the Attack.
by Paul Ferguson 03 Feb '08

03 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Ben Butler" <ben.butler(a)c2internet.net> wrote: >The effect of this would be that any BotNet controlled hosts in the >other member network would now be able to drop any attack traffic in >their network on destination at their customer aggregation routers. > >I think you might have thought I was suggesting we blackhole sources in >other peoples networks - this is definatly not what I was saying. > >So, given we all now understand each other - why is no one doing the >above? We (Trend Micro) do something similar to this -- a black-hole BGP feed of known botnet C&Cs, such that the C&C channel is effectively black-holed. At least that way, people can deal with cleaning up the end-systems in their own way, at their own pace, while the amount of malicious activity is effectively "crippled". - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHpOWyq1pz9mNUZTMRAhtLAJwLNH9Ie+mE0106NlY6Qdy43uag1gCgv7wq le4yfSlaa2kUHtchC2X+bbQ= =4P1g -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Sicily to Egypt undersea cable disruption
by Martin Hannigan 02 Feb '08

02 Feb '08

On Feb 1, 2008 2:25 PM, Ahmed Maged (amaged) <amaged(a)cisco.com> wrote: > > > > "Does look normal to me" is far from a global conspiracy theory. > > > Thank you for the translation but I think you got it wrong. > I agree, there should be a sanity check as I understand that they are within close proximity of each other. Two ships slipping anchors and causing cable breaks in the same area is odd, but if there's a storm in the area, that would not be that much of a surprise. There should be some logic to the madness. I think that the moral of the story is that "more" operators should try to better understand what diversity means beyond the metro. The challenge is getting the information. The Teleography series of internet/sub maps are interesting. They don't demonstrate diversity though, since they show figurative routing. Those nice and straight lines are a pipe dream. -M< -M<

11 14

Re: Another cablecut - sri lanka to suez Re: Sicily to Egypt undersea cable disruption
by Robert Bonomi 02 Feb '08

02 Feb '08

> Date: Fri, 1 Feb 2008 14:21:00 -0800 > From: "Scott Francis" <darkuncle(a)gmail.com> > Subject: Re: Another cablecut - sri lanka to suez Re: Sicily to Egypt undersea cable disruption > > > On Feb 1, 2008 6:37 AM, Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > http://www.marketwatch.com/news/story/third-undersea-cable-reportedly-cut/s… > > > > "We had another cut today between Dubai and Muscat three hours back. > > The cable was about 80G capacity, it had telephone, Internet data, > > everything," one Flag official, who declined to be named, told Zawya > > Dow Jones. > > The cable, known as Falcon, delivers services to countries in the > > Mediterranean and Gulf region, he added. > > this (3 undersea cables in about a week, serving the same geographic > area, with two of the cuts happening on the same day!) is leaving the > realm of improbability and approaching the realm of conspiracy ... "Never ascribe to malice that which can be explained by incompetence" comes to mind.

2 1

RE: Another cablecut - sri lanka to suez Re: Sicily to Egypt undersea cable disruption
by Neil J. McRae 02 Feb '08

02 Feb '08

Really? What cable is that?! -----Original Message----- From: Rubens Kuhl Jr. <rubensk(a)gmail.com> Sent: 02 February 2008 11:33 To: nanog(a)merit.edu Subject: Re: Another cablecut - sri lanka to suez Re: Sicily to Egypt undersea cable disruption > "NEW YORK (AP) -- The lines that tie the globe together by carrying > phone calls and Internet traffic are just two-thirds of an inch thick > where they lie on the ocean floor." And AFAIK not all kilometers of cables lie on the ocean floor; if the ocean has high depth on a given part of the cable route, the cable simply floats on the water on that run. It's just a matter of having enough pressure to lift it up. Rubens

1 0

Re: Sicily to Egypt undersea cable disruption
by Paul Ferguson 02 Feb '08

02 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Steven M. Bellovin <smb(a)cs.columbia.edu> wrote: >I hope you're right. As I noted, by profession I'm paranoid. I've >even contemplated the uses of deliberate cable cuts; see >http://www.cs.columbia.edu/~smb/papers/reroute.pdf for some thoughts >from five years ago. > >But I hope you're right. > Oddly enough, the same sort of "discussion" is going on over on Defense Tech: http://www.defensetech.org/archives/003979.html FYI, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHo/TMq1pz9mNUZTMRAgrmAJ4/y+8eY5gCFdtfybKT2HQxJUxqdgCcD9fQ 9cvUgVDPm2L0o4xg+4iN/wc= =bBJC -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Another cablecut - sri lanka to suez Re: Sicily to Egypt undersea cable disruption
by Scott Weeks 02 Feb '08

02 Feb '08

: bubba driving his backhoe ship Now that'd make a great NANOG shirt! :-) scott --- ops.lists(a)gmail.com wrote: From: "Suresh Ramasubramanian" <ops.lists(a)gmail.com> To: "Steven M. Bellovin" <smb(a)cs.columbia.edu> Cc: "Scott Francis" <darkuncle(a)gmail.com>, nanog(a)merit.edu Subject: Re: Another cablecut - sri lanka to suez Re: Sicily to Egypt undersea cable disruption Date: Sat, 2 Feb 2008 07:09:50 +0530 On Feb 2, 2008 4:07 AM, Steven M. Bellovin <smb(a)cs.columbia.edu> wrote: > Yah. I'm a security guy, and hence suspicious by nature -- our slogan > is "Paranoia is our Profession" -- and I'm getting very concerned. The > old saying comes to mind: "once is happenstance, twice is coincidence, > but the third time is enemy action". The alternative some common mode > failure -- perhaps the storm others have noted. Quite a few other lists I look at (especially those with a "critical infrastructure protection" type focus - seem to feel the same as you do. And at least one list has already started the "maybe al qaeda is behind this" idea running. The fun part is that quite a lot of these cables are in international waters, so it just might turn into a high level multiple UN agency conference, sooner or later with ideas like a bunch of navy or coast guard cutters tasked to patrol on the borders of cable landing areas and head off shipping that wants to anchor, trawlers that want to drag nets across the ocean floor, bubba driving his backhoe ship .. [and that still doesnt keep away sharks that want to sharpen their teeth on undersea cables...] srs

1 0

RE: Sicily to Egypt undersea cable disruption
by Rod Beck 01 Feb '08

01 Feb '08

Of course, we all know the Mossad (Israeli secret services) and CIA did it as part of the global conspiracy against the Middle East and Third World ... In recent years I have restrained myself, but from time to time the 'old Rod Beck' manages to evade the supervision of the Super Ego (presumably you know your Freudian psychology). But seriously, double failures occur all the time. TAT-14 went dark for over 24 hours on December 28, 2003 when one cable was damaged and the switch of traffic to the other cable caused the second cable to experience a repeater failure. Probability dictates that the improbable will happen given enough time. The improbable is unlikely, not impossible. Roderick S. Beck Director of European Sales Hibernia Atlantic 1, Passage du Chantier, 75012 Paris http://www.hiberniaatlantic.com Wireless: 1-212-444-8829. Landline: 33-1-4346-3209. French Wireless: 33-6-14-33-48-97. AOL Messenger: GlobalBandwidth rod.beck(a)hiberniaatlantic.com rodbeck(a)erols.com ``Unthinking respect for authority is the greatest enemy of truth.'' Albert Einstein. -----Original Message----- From: Ahmed Maged (amaged) [mailto:amaged@cisco.com] Sent: Fri 2/1/2008 6:05 PM To: Steven M. Bellovin; Martin Hannigan Cc: Rod Beck; Hank Nussbacher; Sean Donelan; nanog(a)merit.edu Subject: RE: Sicily to Egypt undersea cable disruption Doesn't look normal to me that both cables were cut 'accidently' -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Steven M. Bellovin Sent: Thursday, January 31, 2008 6:49 PM To: Martin Hannigan Cc: Rod Beck; Hank Nussbacher; Sean Donelan; nanog(a)merit.edu Subject: Re: Sicily to Egypt undersea cable disruption Today's NY Times reports that the problem was caused by two near-simultaneous cable failures: http://www.nytimes.com/2008/01/31/business/worldbusiness/31cable.html

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 01 Feb '08

01 Feb '08

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 02 Feb, 2008 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 243583 Prefixes after maximum aggregation: 124880 Deaggregation factor: 1.95 Unique aggregates announced to Internet: 119568 Total ASes present in the Internet Routing Table: 27234 Prefixes per ASN: 8.94 Origin-only ASes present in the Internet Routing Table: 23738 Origin ASes announcing only one prefix: 11535 Transit ASes present in the Internet Routing Table: 3496 Transit-only ASes present in the Internet Routing Table: 69 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 19 Max AS path prepend of ASN (29642) 15 Prefixes from unregistered ASNs in the Routing Table: 37 Unregistered ASNs in the Routing Table: 14 Number of 32-bit ASNs allocated by the RIRs: 46 Prefixes from 32-bit ASNs in the Routing Table: 10 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 870 Number of addresses announced to Internet: 1825248736 Equivalent to 108 /8s, 203 /16s and 21 /24s Percentage of available address space announced: 49.2 Percentage of allocated address space announced: 61.1 Percentage of available address space allocated: 80.5 Percentage of address space in use by end-sites: 69.9 Total number of prefixes smaller than registry allocations: 114737 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 55577 Total APNIC prefixes after maximum aggregation: 21145 APNIC Deaggregation factor: 2.63 Prefixes being announced from the APNIC address blocks: 53070 Unique aggregates announced from the APNIC address blocks: 23817 APNIC Region origin ASes present in the Internet Routing Table: 3112 APNIC Prefixes per ASN: 17.05 APNIC Region origin ASes announcing only one prefix: 818 APNIC Region transit ASes present in the Internet Routing Table: 463 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 17 Number of APNIC addresses announced to Internet: 327917984 Equivalent to 19 /8s, 139 /16s and 161 /24s Percentage of available APNIC address space announced: 75.2 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 114927 Total ARIN prefixes after maximum aggregation: 65329 ARIN Deaggregation factor: 1.76 Prefixes being announced from the ARIN address blocks: 83837 Unique aggregates announced from the ARIN address blocks: 33406 ARIN Region origin ASes present in the Internet Routing Table: 12107 ARIN Prefixes per ASN: 6.92 ARIN Region origin ASes announcing only one prefix: 4669 ARIN Region transit ASes present in the Internet Routing Table: 1150 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 15 Number of ARIN addresses announced to Internet: 356357248 Equivalent to 21 /8s, 61 /16s and 148 /24s Percentage of available ARIN address space announced: 78.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 51395 Total RIPE prefixes after maximum aggregation: 32577 RIPE Deaggregation factor: 1.58 Prefixes being announced from the RIPE address blocks: 46737 Unique aggregates announced from the RIPE address blocks: 31450 RIPE Region origin ASes present in the Internet Routing Table: 10829 RIPE Prefixes per ASN: 4.32 RIPE Region origin ASes announcing only one prefix: 5686 RIPE Region transit ASes present in the Internet Routing Table: 1661 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 339381504 Equivalent to 20 /8s, 58 /16s and 141 /24s Percentage of available RIPE address space announced: 77.8 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 18505 Total LACNIC prefixes after maximum aggregation: 4650 LACNIC Deaggregation factor: 3.98 Prefixes being announced from the LACNIC address blocks: 16898 Unique aggregates announced from the LACNIC address blocks: 9215 LACNIC Region origin ASes present in the Internet Routing Table: 898 LACNIC Prefixes per ASN: 18.82 LACNIC Region origin ASes announcing only one prefix: 295 LACNIC Region transit ASes present in the Internet Routing Table: 151 Average LACNIC Region AS path length visible: 3.9 Max LACNIC Region AS path length visible: 19 Number of LACNIC addresses announced to Internet: 48028928 Equivalent to 2 /8s, 220 /16s and 221 /24s Percentage of available LACNIC address space announced: 47.7 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 3148 Total AfriNIC prefixes after maximum aggregation: 1159 AfriNIC Deaggregation factor: 2.72 Prefixes being announced from the AfriNIC address blocks: 3450 Unique aggregates announced from the AfriNIC address blocks: 1707 AfriNIC Region origin ASes present in the Internet Routing Table: 218 AfriNIC Prefixes per ASN: 15.83 AfriNIC Region origin ASes announcing only one prefix: 67 AfriNIC Region transit ASes present in the Internet Routing Table: 37 Average AfriNIC Region AS path length visible: 4.1 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 9763328 Equivalent to 0 /8s, 148 /16s and 250 /24s Percentage of available AfriNIC address space announced: 29.1 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4755 1558 384 75 Videsh Sanchar Nigam Ltd. Aut 9498 1147 533 60 BHARTI BT INTERNET LTD. 9583 1116 82 435 Sify Limited 17488 961 62 87 Hathway IP Over Cable Interne 4134 861 11849 310 CHINANET-BACKBONE 4766 843 5495 342 Korea Telecom (KIX) 23577 815 34 694 Korea Telecom (ATM-MPLS) 9829 570 449 11 BSNL National Internet Backbo 4812 549 940 84 China Telecom (Shanghai) 1221 547 1952 422 Telstra Pty Ltd Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1436 6020 982 AT&T WorldNet Services 4323 1386 1012 366 Time Warner Telecom 2386 1354 634 832 AT&T Data Communications Serv 11492 1216 136 19 Cable One 18566 1041 296 10 Covad Communications 7011 1035 301 597 Citizens Utilities 6197 1034 739 512 BellSouth Network Solutions, 174 970 6834 811 Cogent Communications 6478 909 234 104 AT&T Worldnet Services 701 895 6575 686 UUNET Technologies, Inc. Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 3292 395 1650 358 TDC Tele Danmark 3301 332 1458 303 TeliaNet Sweden 3320 322 6020 267 Deutsche Telekom AG 8866 280 78 24 Bulgarian Telecommunication C 8551 279 267 42 Bezeq International 680 275 2046 256 DFN-IP service G-WiN 8708 272 420 242 Romania Data Systems S.A. 3215 271 2591 93 France Telecom Transpac 6746 271 128 249 Dynamic Network Technologies, 8220 250 422 226 COLT Telecommunications Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1165 2421 213 UniNet S.A. de C.V. 11830 547 299 9 Instituto Costarricense de El 7303 436 212 59 Telecom Argentina Stet-France 16814 428 27 11 NSS, S.A. 6471 394 85 39 ENTEL CHILE S.A. 11172 394 115 62 Servicios Alestra S.A de C.V 10620 352 92 26 TVCABLE BOGOTA 14117 351 23 16 Telefonica del Sur S.A. 22047 323 270 14 VTR PUNTO NET S.A. 10481 301 120 10 Prima S.A. Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 337 52 84 LINKdotNET AS number 3741 279 869 225 The Internet Solution 6713 143 135 11 Itissalat Al-MAGHRIB 24835 143 48 7 RAYA Telecom - Egypt 2018 142 268 114 Tertiary Education Network 33783 129 9 15 EEPAD TISP TELECOM & INTERNET 5536 124 8 10 Internet Egypt Network 15475 101 84 4 Nile Online 33776 99 6 7 Starcomms Nigeria Limited 23889 78 24 16 MAURITIUS TELECOM Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4755 1558 384 75 Videsh Sanchar Nigam Ltd. Aut 7018 1436 6020 982 AT&T WorldNet Services 4323 1386 1012 366 Time Warner Telecom 2386 1354 634 832 AT&T Data Communications Serv 11492 1216 136 19 Cable One 8151 1165 2421 213 UniNet S.A. de C.V. 9498 1147 533 60 BHARTI BT INTERNET LTD. 9583 1116 82 435 Sify Limited 18566 1041 296 10 Covad Communications 7011 1035 301 597 Citizens Utilities Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 11492 1216 1197 Cable One 9498 1147 1087 BHARTI BT INTERNET LTD. 18566 1041 1031 Covad Communications 4323 1386 1020 Time Warner Telecom 8151 1165 952 UniNet S.A. de C.V. 17488 961 874 Hathway IP Over Cable Interne 6478 909 805 AT&T Worldnet Services 22773 845 787 Cox Communications, Inc. 19262 878 728 Verizon Global Networks 9583 1116 681 Sify Limited Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 15190 UNALLOCATED 63.98.176.0/24 701 UUNET Technologies, 18506 UNALLOCATED 63.107.123.0/24 33286 Turlock Irrigation D 14699 UNALLOCATED 63.238.252.0/24 30517 Great Lakes Comnet, 14699 UNALLOCATED 63.238.253.0/24 30517 Great Lakes Comnet, 14699 UNALLOCATED 64.85.144.0/22 30517 Great Lakes Comnet, 33526 UNALLOCATED 64.128.26.0/24 4323 Time Warner Telecom 14699 UNALLOCATED 65.112.79.0/24 30517 Great Lakes Comnet, 21624 UNALLOCATED 65.163.176.0/24 701 UUNET Technologies, 14699 UNALLOCATED 72.35.42.0/24 30517 Great Lakes Comnet, 14699 UNALLOCATED 72.35.43.0/24 30517 Great Lakes Comnet, Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.48.10.0/23 19548 Adelphia Business Solutions 24.48.12.0/22 19548 Adelphia Business Solutions 24.48.80.0/21 19548 Adelphia Business Solutions 24.49.32.0/22 19548 Adelphia Business Solutions 24.54.224.0/19 19548 Adelphia Business Solutions 24.142.40.0/21 7018 AT&T WorldNet Services 24.142.160.0/19 7018 AT&T WorldNet Services 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 60.253.0.0/18 27572 Connexion by Boeing Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:9 /10:15 /11:39 /12:137 /13:277 /14:491 /15:976 /16:9749 /17:4219 /18:7037 /19:14993 /20:17152 /21:16168 /22:20452 /23:21553 /24:127654 /25:873 /26:1095 /27:561 /28:96 /29:9 /30:1 /31:0 /32:8 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 11492 1205 1216 Cable One 2386 1054 1354 AT&T Data Communications Serv 18566 1022 1041 Covad Communications 9583 963 1116 Sify Limited 4755 919 1558 Videsh Sanchar Nigam Ltd. Aut 7011 919 1035 Citizens Utilities 6478 908 909 AT&T Worldnet Services 9498 822 1147 BHARTI BT INTERNET LTD. 23577 806 815 Korea Telecom (ATM-MPLS) 7018 786 1436 AT&T WorldNet Services Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 8:98 12:1954 13:2 15:21 16:3 17:6 18:13 20:35 22:1 24:1017 25:1 31:1 32:61 33:4 38:383 40:65 41:444 44:2 47:8 52:3 55:3 56:3 57:22 58:511 59:416 60:407 61:981 62:1025 63:1976 64:3362 65:2359 66:3626 67:1063 68:638 69:2081 70:469 71:107 72:1489 73:7 74:805 75:170 76:205 77:525 78:408 79:72 80:868 81:789 82:607 83:346 84:445 85:1021 86:385 87:633 88:311 89:1100 90:43 91:972 92:108 93:54 95:1 96:8 97:9 98:38 114:1 115:1 116:498 117:239 118:69 119:109 121:416 122:667 123:285 124:777 125:1108 128:308 129:198 130:133 131:389 132:68 133:9 134:188 135:37 136:217 137:85 138:156 139:63 140:497 141:107 142:378 143:263 144:282 145:51 146:336 147:132 148:485 149:178 150:121 151:139 152:95 153:130 154:11 155:286 156:198 157:250 158:163 159:216 160:219 161:102 162:199 163:190 164:558 165:419 166:295 167:309 168:564 169:131 170:432 171:28 172:3 173:1 189:149 190:1356 192:5761 193:4097 194:3252 195:2316 196:936 198:3786 199:3209 200:5436 201:1275 202:7390 203:7744 204:3968 205:2064 206:2420 207:2734 208:3131 209:3621 210:2524 211:1020 212:1281 213:1587 214:439 215:41 216:4124 217:1181 218:337 219:401 220:970 221:408 222:308 End of report

1 0

Blackholing traffic by ASN
by Justin Shore 01 Feb '08

01 Feb '08

I'm sure all of us have parts of the Internet that we block for one reason or another. I have existing methods for null routing traffic from annoying hosts and subnets on our border routers today (I'm still working on a network blackhole). However I've never tackled the problem by targeting a bad guy's ASN. What's the best option for null routing traffic by ASN? I could always add another deny statement in my inbound eBGP route-maps to match a new as-path ACL for _BAD-ASN_ to keep from accepting their routes to begin with. Are there any other good tricks that I can employ? I have another question along those same lines. Once I do have my blackhole up and running I can easily funnel hosts or subnets into the blackhole. What about funneling all routes to a particular ASN into the blackhole? Are there any useful tricks here? The ASN I'm referring to is that of the Russian Business Network. A Google search should turn up plenty of info for those that haven't heard of them. Thanks Justin

7 7