- Test - lists.nanog.org

Huricane Electric having problems in Chicago?
by Brandon Galbraith 27 Feb '07

27 Feb '07

Anyone having problems with Hurricane Electric in Chicago? I'm seeing all my packets through them dropped at gsr12012.chi.he.net [ 206.223.138.5]. Just wanted to see if I'm the only one. We're utilizing Hurricane Electric via the Equinix Direct service. -brandon

2 1

RBL for bots?
by Drew Weaver 27 Feb '07

27 Feb '07

Has anyone created an RBL, much like (possibly) the BOGON list which includes the IP addresses of hosts which seem to be "infected" and are attempting to brute-force SSH/HTTP, etc? It would be fairly easy to setup a dozen or more honeypots and examine the logs in order to create an initial list. Anyone know of anything like this? -Drew

13 24

L3 outage
by David Lesher 27 Feb '07

27 Feb '07

I'm told {by atlantech.net} that L3 is wounded in the east-central region; i.e. DC-NYC at least... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Looking for someone clueful from NetNation
by David Temkin 24 Feb '07

24 Feb '07

Please contact me off-list about an abuse concern involving one of your customers. Thanks, -Dave

1 0

Fwd: Impending publication: draft-iab-iwout-report-03.txt
by Fergie 24 Feb '07

24 Feb '07

I thought that many of you on the list might actually be interested in this... FYI. - ferg [snip] To: IETF Announcement list <ietf-announce(a)ietf.org> From: Leslie Daigle <leslie(a)thinkingcat.com> Date: Fri, 23 Feb 2007 14:56:39 -0500 Cc: iab(a)ietf.org Subject: Impending publication: draft-iab-iwout-report-03.txt The IAB is ready to ask the RFC-Editor to publish Report from the IAB workshop on Unwanted Traffic March 9-10, 2006 <draft-iab-iwout-report-03.txt> as an Informational RFC. This document is a report from an invitational workshop convened by the IAB. As such, it represents the opinions of the attendees expressed at the time of the workshop. Please direct any comments to improve the clarity of the report to the IAB (iab(a)iab.org) by March 23, 2007. The document can be found at http://www.ietf.org/internet-drafts/draft-iab-iwout-report-03.txt From the Abstract: This document reports the outcome of a workshop held by the Internet Architecture Board (IAB) on Unwanted Internet Traffic. The workshop was held on March 9-10, 2006 at USC/ISI in Marina del Rey, CA, USA. The primary goal of the workshop was to foster interchange between the operator, standards, and research communities on the topic of unwanted traffic, as manifested in, for example, Distributed Denial of Service (DDoS) attacks, spam, and phishing, to gain understandings on the ultimate sources of these unwanted traffic, and to assess their impact and the effectiveness of existing solutions. It was also a goal of the workshop to identify engineering and research topics that could be undertaken by the IAB, the IETF, the IRTF, and the network research and development community at large to develop effective countermeasures against the unwanted traffic. Leslie Daigle, For the IAB. _______________________________________________ IETF-Announce mailing list IETF-Announce(a)ietf.org https://www1.ietf.org/mailman/listinfo/ietf-announce [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Possible Level3 Fibre Cut
by John van Oppen 24 Feb '07

24 Feb '07

Cogent's network is built mostly on wiltel fiber. For those who don't recall, wiltel was bought by level 3. I bet that is what he was referring to. John :) -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of virendra rode // Sent: Thursday, February 22, 2007 6:49 AM To: Rob Baxter Cc: nanog(a)merit.edu Subject: Re: Possible Level3 Fibre Cut -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Rob Baxter wrote: > I mean exactly what I said. I grabbed that info from > http://status.cogentco.com/ after seeing a few complaints from users. > > Rob - ------------------------ Sorry I meant your subject? regards, /virendra > > virendra rode // wrote: > Rob Baxter wrote: >>>> ** Cogent Network Status Report Last Updated Wed Feb 21 16:35:00 2007 ** >>>> >>>> Cogent Network Status/DNS Server Status Description: >>>> We currently have a possible fiber cut between Stamford, CT and New York >>>> City, NY. This may cause some latency for some of our customers between >>>> Boston and New York. We are working to correct the situation and >>>> currently do not have an ETA. Thank you. >>>> >>>> >>>> Rob Baxter > ----------------------- > You mean cogent, correct? I'm not seeing anything on level3 side. I know > there's level3 maintenance scheduled to occur within 36 hours. > > > regards, > /virendra > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF3a1gpbZvCIJx1bcRAm9TAKC2Qcvo64irbLU9sznkOv6YslAjRQCeLWRJ zZhUdN4mM/W6i0j11Kqmp14= =J0dD -----END PGP SIGNATURE-----

2 1

Re: Counting tells you if you are making progress
by Sean Donelan 24 Feb '07

24 Feb '07

On Wed, 21 Feb 2007, Todd Vierling wrote: > I'd say it's severely biased in the overestimation direction -- but > that's not to say it isn't a problem, because zombies Suck. People with access to the ppp, dhcp or nat logs for a network can de-dup the counts based on IP addresses to come up with better surveys of infected computers. They can further correlate the reports with contact with the computer owners of how many computers were found with known or unknown malware. But we rarely hear data from them. Although I disagree with some of the survey counts, finding zombies isn't a problem. Figuring out if a computer is actually fixed and stays fixed is still the problem. Sometimes it feels like an episode of "House." Except House wraps up the case in 60 minutes.

2 1

Possible Level3 Fibre Cut
by Rob Baxter 24 Feb '07

24 Feb '07

** Cogent Network Status Report Last Updated Wed Feb 21 16:35:00 2007 ** Cogent Network Status/DNS Server Status Description: We currently have a possible fiber cut between Stamford, CT and New York City, NY. This may cause some latency for some of our customers between Boston and New York. We are working to correct the situation and currently do not have an ETA. Thank you. Rob Baxter

4 5

broadband routers security issues
by Gadi Evron 23 Feb '07

23 Feb '07

Hi guys. A guy named Sid recently wrote on securiteam (where I write as well) on an accidental discovery he made on the security of his home broadband router with its default settings. Apparently, he started by discovering he had port 23 open (which was telnet for the router rather than for him - we have all been there before). He researched it a bit further and came up with a disturbing analysis on how these routers can be easily compromised and a rough number on how many of these exist at his ISP. The subject of broadband routers/modems security has been bothering some of us for a while, as they'd make scary botnets, not to mention in some cases, as had been noted also here before, open recursive name servers. Public discussion of this has been limited up to now, but with the recent releases of exploits for such home routers and several public advisories on the issue, I figure it is time for us to see if we can start working to a change in how we do things in coming years (at least with new devices we give out). Here is his text. You can also find it and the discussion on it at: http://blogs.securiteam.com/index.php/archives/826 Accidental backdoor by ISP February 22nd, 2007 by Sid, Filed under: Privacy, Full Disclosure, Corporate Security I.ve been a happy customer of my ISP BeThere for a few months now. Overall they.re great, they are quick to sort you out with your connection, their emails and other communications are very humerous and actually make good reading (I remember the routers documentation CD has a warning label reading something like .warning: geeky content inside.). When I signed up I managed to get the username root, this pleased me no end and I thought I.d finally found an ISP I want to stay with forever. Finding the hole Recently though a friend of mine was extremely bored and decided to nmap my IP address. He found, and told me, that I seemed to be listening on port 23, telnet. I was extremely puzzled by this, I haven.t port forwarded port 23, I would never use a telnet daemon for anything. It occured to me that it must be the router itself running the daemon. I telnetted to 192.168.1.254 and lo and behold it asked me to log in. I log in with default credentials (yes, I had never gotten around to changing those), which are Administrator:null I get welcomed by some neat looking ASCII art and command line access to my router. I didn.t even know my router had telnet access but I quickly log out and set a password via the web interface. Now I should be secure. Wondering if others could telnet to my router from a remote location I ssh to a remote machine I have access to then telnet back to my router from there and try logging in. I.m reassuringly told that this account can not log in through the WAN interface (so thankfully I can only log in from within my LAN). I log back in to the telnet daemon from my LAN to see what.s there, I find this: {Administrator}[user]=>list User Flags Role .- .. .- Administrator U Administrator tech R TechnicalSupport BeTech TechnicalSupport bebox root Keep in mind that according to the web interface only the Administrator account even exists. What the hell are all these other accounts? Thinking back to the error I got when trying to log in from a remote location I wonder if any of these accounts are capable of logging in from remote locations. I try logging in as BeTech from the remote connection (guessing it to have a blank password), it gives me an incorrect password error. How can I find the password to these 3 anomalous accounts? Time to look through the configuration. Like most routers it.s possible to back up the settings file, in the case of this router you ftp to the router, browse to /dl/ and download user.ini. This file has all the settings in it. I copy that file to my home directory and search for the word BeTech of it. Here.s the output: [ mlpuser.ini ] add name=Administrator password=_CYP_removed role=Administrator hash2=removed defuser=enabled add name=tech password=_CYP_bde1d7887b5852ff5c3c853c0ffbc413 role=TechnicalSupport hash2=bb80a4cf4f721b0fe42f24581479bebe defremadmin=enabled add name=BeTech password=_CYP_d8b5399c8b961eca15a56b659c2ee622 role=TechnicalSupport hash2=cd4f202f8e92f7c11f40bc86fe66443a add name=bebox password=_CYP_0fbd2e7e6dc947c44def9053fb79e8c8 role=root hash2=90960596e9eec3d017b31f6efb8892ea A short time later I had the password of the BeTech account to be RemAcc (for some reason I didn.t bother looking at the other accounts). I don.t know what the hash2 value stands for, wasn.t interested. I try logging in with BeTech:RemAcc from my remote connection and lo and behold it works. I figuratively crap myself. First things first; I look for ways to change this. Sure I could change the password but there.s got to be a way to stop the telnet daemon from listening on the WAN. Sure enough, I find the line ifadd name=TELNET group=wan I simply remove the line. Slightly below I see ifadd name=FTP group=wan I remove that too. I upload the user.ini file replacing the existing one and reboot the router. I.m safe. Exploiting others Time to see if I can log in to others. routers using this. I run nmap -p T:23 87.194.204.0/24. This gives me a list of people who are probably running the same router. I FTP to those IPs and grab /dl/user.ini. Most of these people have changed their Administrator password, but my money says none of them knew about the other accounts. Now I have full access to FTP in to their routers even if they have changed their passwords, I have full read and write access to things from DNS details to DMZ settings, from Wifi passwords to VPN keys. I can then upload the new file back to their router, log into it.s telnet daemon and load the new settings file. >From the account name I.m going to guess that it was made as a technical support account by my ISP so if I call them up saying I have connectivity problems and all the normal stuff is ruled out they can connect straight to my router themselves and peek around. In a way it makes sense for them not to use SSH as that of course requries more stuff, and it may just be that stuff which is broken. There are better ways to do this though, one would be to have an ID printed on the router which I would give to their tech support which they use to calculate the BeTech account.s password. Alternatively let us easily turn off this setting and if we need tech support and we can.t enable it we.d just hit the reset to factory settings button. Pretty much all the customers of my ISP are now vulnerable to this. The only ones who aren.t are people who.ve fixed this, people who have port forwarded port 23 and 21 (as port forwarded ports take priority over daemons) and of course people who don.t use the router the ISP supplies. Kuza55 of sla.ckers.org scanned a much larger number of users; nmap -oG bewhole.txt -vv -sS -p23 -P0 87.194.0.0/16 He got 14716 potentially vulnerable routers but he couldn.t reliably check which were actually vulnerable and so dropped his research. Feel free to try to finish what he started. Securing yourself Incase you are running the router BeThere supplied, here.s how to fix it. FTP to 192.168.1.254/dl/ and download user.ini. That is the default IP, I assume you know how to find the IP if that.s not what it is. If user.ini isn.t there, telnet to the router (same IP). Type: config save It.ll ask for the username, type user.ini and hit return FTP to the router as I said earlier and grab the file. Back up your user.ini file just incase, then open it. Find the heading [ servmgr.ini ] which is around line 771 (though it won.t be exactly there for you). Scroll down another few lines and you.ll find four lines: ifadd name=FTP group=lan ifadd name=FTP group=wan ifadd name=TELNET group=lan ifadd name=TELNET group=wan Remove the two ending in wan. Connect again with your FTP client and upload this new user.ini file replacing the old one. Either reboot your router through it.s web interface or log back into the telnet daemon and type: config load The telnet connection will die, that.s fine, in 30 seconds or so you.ll be online again with a safe router. Check with nmap-online that you.re still not listening on FTP or Telnet.

3 2

Weekly Routing Table Report
by Routing Analysis Role Account 23 Feb '07

23 Feb '07

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 24 Feb, 2007 Analysis Summary ---------------- BGP routing table entries examined: 213209 Prefixes after maximum aggregation: 114369 Deaggregation factor: 1.86 Unique aggregates announced to Internet: 103733 Total ASes present in the Internet Routing Table: 24455 Origin-only ASes present in the Internet Routing Table: 21287 Origin ASes announcing only one prefix: 10288 Transit ASes present in the Internet Routing Table: 3168 Transit-only ASes present in the Internet Routing Table: 79 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 32 Max AS path prepend of ASN (20858) 18 Prefixes from unregistered ASNs in the Routing Table: 4 Unregistered ASNs in the Routing Table: 6 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1686392460 Equivalent to 100 /8s, 132 /16s and 78 /24s Percentage of available address space announced: 45.5 Percentage of allocated address space announced: 62.5 Percentage of available address space allocated: 72.8 Total number of prefixes smaller than registry allocations: 110162 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 48367 Total APNIC prefixes after maximum aggregation: 19418 APNIC Deaggregation factor: 2.49 Prefixes being announced from the APNIC address blocks: 45460 Unique aggregates announced from the APNIC address blocks: 20397 APNIC Region origin ASes present in the Internet Routing Table: 2879 APNIC Region origin ASes announcing only one prefix: 786 APNIC Region transit ASes present in the Internet Routing Table: 426 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 290428416 Equivalent to 17 /8s, 79 /16s and 150 /24s Percentage of available APNIC address space announced: 71.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 116/6, 120/6, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 104152 Total ARIN prefixes after maximum aggregation: 61221 ARIN Deaggregation factor: 1.70 Prefixes being announced from the ARIN address blocks: 76195 Unique aggregates announced from the ARIN address blocks: 29518 ARIN Region origin ASes present in the Internet Routing Table: 11365 ARIN Region origin ASes announcing only one prefix: 4368 ARIN Region transit ASes present in the Internet Routing Table: 1052 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 21 Number of ARIN addresses announced to Internet: 318945408 Equivalent to 19 /8s, 2 /16s and 184 /24s Percentage of available ARIN address space announced: 70.4 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 96/6, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 44023 Total RIPE prefixes after maximum aggregation: 28723 RIPE Deaggregation factor: 1.53 Prefixes being announced from the RIPE address blocks: 40698 Unique aggregates announced from the RIPE address blocks: 27121 RIPE Region origin ASes present in the Internet Routing Table: 9190 RIPE Region origin ASes announcing only one prefix: 4827 RIPE Region transit ASes present in the Internet Routing Table: 1492 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 32 Number of RIPE addresses announced to Internet: 291725572 Equivalent to 17 /8s, 99 /16s and 97 /24s Percentage of available RIPE address space announced: 79.0 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-43007 RIPE Address Blocks 62/8, 77/8, 78/7, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 14093 Total LACNIC prefixes after maximum aggregation: 4042 LACNIC Deaggregation factor: 3.49 Prefixes being announced from the LACNIC address blocks: 12154 Unique aggregates announced from the LACNIC address blocks: 7009 LACNIC Region origin ASes present in the Internet Routing Table: 761 LACNIC Region origin ASes announcing only one prefix: 247 LACNIC Region transit ASes present in the Internet Routing Table: 133 Average LACNIC Region AS path length visible: 4.2 Max LACNIC Region AS path length visible: 20 Number of LACNIC addresses announced to Internet: 37685504 Equivalent to 2 /8s, 63 /16s and 9 /24s Percentage of available LACNIC address space announced: 56.2 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2571 Total AfriNIC prefixes after maximum aggregation: 963 AfriNIC Deaggregation factor: 2.67 Prefixes being announced from the AfriNIC address blocks: 1891 Unique aggregates announced from the AfriNIC address blocks: 1182 AfriNIC Region origin ASes present in the Internet Routing Table: 180 AfriNIC Region origin ASes announcing only one prefix: 59 AfriNIC Region transit ASes present in the Internet Routing Table: 37 Average AfriNIC Region AS path length visible: 3.6 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 5415424 Equivalent to 0 /8s, 82 /16s and 162 /24s Percentage of available AfriNIC address space announced: 16.1 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1275 8720 276 CHINANET-BACKBONE 4755 1123 383 77 Videsh Sanchar Nigam Ltd. Aut 9583 1077 77 369 Sify Limited 9498 964 468 66 BHARTI BT INTERNET LTD. 23577 777 35 705 Korea Telecom (ATM-MPLS) 4766 768 4942 309 Korea Telecom (KIX) 17488 598 39 24 Hathway IP Over Cable Interne 7545 586 142 76 TPG Internet Pty Ltd 1221 580 1686 442 Telstra Pty Ltd 18101 522 103 23 Reliance Infocom Ltd Internet 17676 503 10935 65 Softbank BB Corp. 4812 498 763 72 China Telecom (Shanghai) 4668 461 68 10 LG-EDS Systems Inc. 9443 444 111 75 Primus Telecommunications 7474 381 216 259 SingTel Optus Pty Ltd 17849 370 35 94 Telecommunications Technology 4802 360 86 149 Wantree Development 17974 358 129 14 PT TELEKOMUNIKASI INDONESIA 17557 353 34 169 Pakistan Telecom 2907 336 1749 309 SINET Japan ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1498 6125 985 AT&T WorldNet Services 4323 1331 1005 351 Time Warner Telecom 6478 1125 443 193 AT&T Worldnet Services 2386 1113 570 738 AT&T Data Communications Serv 6197 1024 667 499 BellSouth Network Solutions, 18566 992 288 9 Covad Communications 11492 978 101 15 Cable One 174 944 6792 868 Cogent Communications 701 941 6695 748 UUNET Technologies, Inc. 1239 814 2713 572 Sprint 20115 801 706 421 Charter Communications 7011 798 229 476 Citizens Utilities 19262 757 2591 178 Verizon Global Networks 22773 732 1872 41 Cox Communications, Inc. 209 712 3743 569 Qwest 721 633 21787 274 DLA Systems Automation Center 852 595 1088 381 Telus Advanced Communications 5668 571 160 16 CenturyTel Internet Holdings, 19916 568 49 54 OLM LLC 855 566 250 70 Canadian Research Network RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 541 1895 419 UUNET - Commercial IP service 24863 328 45 22 LINKdotNET AS number 3301 311 1199 290 TeliaNet Sweden 3320 298 4993 249 Deutsche Telekom AG 8220 271 469 262 COLT Telecommunications 6746 270 95 248 Dynamic Network Technologies, 680 257 2044 251 DFN-IP service G-WiN 8708 242 284 228 Romania Data Systems S.A. 3215 239 2224 92 France Telecom Transpac 1257 223 1116 172 SWIPnet Swedish IP Network 5416 219 14 15 BATELCO-BH 3269 213 2423 71 TELECOM ITALIA 3246 207 354 196 Song Networks 30890 206 17 96 SC Kappa Invexim SRL 8551 204 196 28 Bezeq International 3352 201 1783 33 Ibernet, Internet Access Netw 20858 197 34 3 EgyNet 3300 182 171 89 AUCS Communications Services 12479 177 578 6 Uni2 Autonomous System 786 173 1779 173 The JANET IP Service LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1043 2038 211 UniNet S.A. de C.V. 11830 482 299 19 Instituto Costarricense de El 11172 348 109 85 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 22047 307 206 11 VTR PUNTO NET S.A. 6471 253 74 30 ENTEL CHILE S.A. 7303 251 142 30 Telecom Argentina Stet-France 14117 239 16 13 Telefonica del Sur S.A. 11556 237 128 4 Cable-Wireless Panama 6147 229 182 20 Telefonica Del Peru 6503 200 172 83 AVANTEL, S.A. 10481 181 72 8 Prima S.A. 20299 175 25 26 NEWCOM AMERICAS 21826 153 27 57 INTERCABLE 23216 153 19 42 RAMtelecom Telecomunicaciones 7910 152 11 32 ANDINET ON LINE 19429 146 91 37 E.T.B. 18822 145 9 10 TELEFONICA MANQUEHUE 19169 143 9 25 Telconet 14522 140 22 9 SatNet S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 290 868 232 The Internet Solution 8452 244 60 6 TEDATA 15475 155 84 4 Nile Online 6713 144 135 11 Itissalat Al-MAGHRIB 2018 138 309 113 Tertiary Education Network 5536 123 8 15 Internet Egypt Network 2905 121 178 94 The Internetworking Company o 33783 111 6 5 EEPAD TISP TELECOM & INTERNET 24835 86 48 6 RAYA Telecom - Egypt 2561 64 6 2 Egyptian Universities Network 15706 55 12 4 Sudatel Internet Exchange Aut 23889 50 16 13 MAURITIUS TELECOM 5713 44 294 34 Telkom SA Ltd 33774 42 12 22 AS Number for Telecom Algeria 16637 33 21 25 Johnnic e-Ventures 33766 33 2 1 Nyala Communications Pty Ltd 8524 30 2 6 AUCEGYPT Autonomous System 12455 27 6 3 Jambonet Autonomous system 21280 27 4 4 Swift Global Kenya Ltd.Is an 33776 27 2 5 Starcomms Nigeria Limited Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4755 1123 1046 Videsh Sanchar Nigam Ltd. Aut 4134 1275 999 CHINANET-BACKBONE 18566 992 983 Covad Communications 4323 1331 980 Time Warner Telecom 11492 978 963 Cable One 6478 1125 932 AT&T Worldnet Services 9498 964 898 BHARTI BT INTERNET LTD. 8151 1043 832 UniNet S.A. de C.V. 9583 1077 708 Sify Limited 22773 732 691 Cox Communications, Inc. 19262 757 579 Verizon Global Networks 17488 598 574 Hathway IP Over Cable Interne 5668 571 555 CenturyTel Internet Holdings, 6197 1024 525 BellSouth Network Solutions, 19916 568 514 OLM LLC 7545 586 510 TPG Internet Pty Ltd 18101 522 499 Reliance Infocom Ltd Internet 855 566 496 Canadian Research Network 15270 507 473 PaeTec.net -a division of Pae 11830 482 463 Instituto Costarricense de El List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65332 PRIVATE 63.166.106.192/27 1803 SPRINT 24410 UNALLOCATED 203.119.28.0/24 4134 CHINANET-BACKBONE 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com 22895 UNALLOCATED 216.174.38.0/24 19094 Adelphia Business So Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 7.1.1.0/24 1239 Sprint 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.33.1.0/24 7018 AT&T WorldNet Services 180.190.0.0/16 24003 JUBILANT ORGANOSYS LTD., INDI 192.0.10.0/24 9498 BHARTI BT INTERNET LTD. 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.153.136.0/21 721 DLA Systems Automation Center 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:20 /9:9 /10:12 /11:33 /12:117 /13:226 /14:426 /15:822 /16:9253 /17:3748 /18:6173 /19:13193 /20:14894 /21:13424 /22:17227 /23:18503 /24:113186 /25:718 /26:537 /27:438 /28:68 /29:42 /30:104 /31:0 /32:36 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6478 1077 1125 AT&T Worldnet Services 18566 974 992 Covad Communications 11492 964 978 Cable One 9583 913 1077 Sify Limited 2386 837 1113 AT&T Data Communications Serv 7018 810 1498 AT&T WorldNet Services 6197 795 1024 BellSouth Network Solutions, 23577 763 777 Korea Telecom (ATM-MPLS) 7011 697 798 Citizens Utilities 9498 617 964 BHARTI BT INTERNET LTD. 4766 577 768 Korea Telecom (KIX) 19916 563 568 OLM LLC 4755 529 1123 Videsh Sanchar Nigam Ltd. Aut 4323 527 1331 Time Warner Telecom 15270 475 507 PaeTec.net -a division of Pae 855 465 566 Canadian Research Network 18101 453 522 Reliance Infocom Ltd Internet 4668 452 461 LG-EDS Systems Inc. 5668 441 571 CenturyTel Internet Holdings, 17488 420 598 Hathway IP Over Cable Interne Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 7:1 8:62 9:1 12:1797 13:1 15:16 16:3 17:3 18:5 20:36 24:901 25:1 32:53 38:282 40:57 41:92 44:2 47:7 52:4 55:1 56:3 57:25 58:306 59:391 60:211 61:943 62:1028 63:1920 64:3153 65:2320 66:3149 67:733 68:652 69:1729 70:455 71:98 72:1222 73:1 74:174 75:80 76:5 77:35 80:828 81:782 82:656 83:363 84:509 85:731 86:442 87:492 88:247 89:804 90:3 91:175 97:1 116:1 117:1 118:1 119:1 120:1 121:141 122:301 123:49 124:596 125:843 128:313 129:218 130:131 131:347 132:49 133:9 134:188 135:38 136:181 137:92 138:195 139:52 140:502 141:142 142:371 143:210 144:269 145:43 146:314 147:147 148:376 149:187 150:114 151:116 152:94 153:118 154:5 155:246 156:151 157:176 158:168 159:151 160:99 161:88 162:231 163:163 164:446 165:383 166:245 167:281 168:512 169:119 170:380 171:15 172:1 189:197 190:425 192:5747 193:3729 194:2992 195:2198 196:958 198:3740 199:3284 200:4608 201:985 202:7196 203:7370 204:3971 205:2057 206:2412 207:2848 208:2483 209:3591 210:2384 211:928 212:1296 213:1422 214:407 215:39 216:4033 217:1166 218:349 219:271 220:851 221:374 222:264 End of report Report Website: http://thyme.apnic.net

1 0