- Test - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 24 Nov '06

24 Nov '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 25 Nov, 2006 Analysis Summary ---------------- BGP routing table entries examined: 204725 Prefixes after maximum aggregation: 110922 Unique aggregates announced to Internet: 99440 Total ASes present in the Internet Routing Table: 23764 Origin-only ASes present in the Internet Routing Table: 20720 Origin ASes announcing only one prefix: 9995 Transit ASes present in the Internet Routing Table: 3044 Transit-only ASes present in the Internet Routing Table: 80 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 29 Max AS path prepend of ASN (36728) 27 Prefixes from unregistered ASNs in the Routing Table: 3 Unregistered ASNs in the Routing Table: 3 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 8 Number of addresses announced to Internet: 1640986796 Equivalent to 97 /8s, 207 /16s and 120 /24s Percentage of available address space announced: 44.3 Percentage of allocated address space announced: 62.8 Percentage of available address space allocated: 70.5 Total number of prefixes smaller than registry allocations: 104033 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 45291 Total APNIC prefixes after maximum aggregation: 18408 Prefixes being announced from the APNIC address blocks: 42852 Unique aggregates announced from the APNIC address blocks: 18850 APNIC Region origin ASes present in the Internet Routing Table: 2772 APNIC Region origin ASes announcing only one prefix: 779 APNIC Region transit ASes present in the Internet Routing Table: 411 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 270228320 Equivalent to 16 /8s, 27 /16s and 91 /24s Percentage of available APNIC address space announced: 84.5 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 101595 Total ARIN prefixes after maximum aggregation: 60080 Prefixes being announced from the ARIN address blocks: 74852 Unique aggregates announced from the ARIN address blocks: 28417 ARIN Region origin ASes present in the Internet Routing Table: 11180 ARIN Region origin ASes announcing only one prefix: 4263 ARIN Region transit ASes present in the Internet Routing Table: 1028 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 29 Number of ARIN addresses announced to Internet: 310956928 Equivalent to 18 /8s, 136 /16s and 211 /24s Percentage of available ARIN address space announced: 68.6 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 96/6, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 41995 Total RIPE prefixes after maximum aggregation: 27533 Prefixes being announced from the RIPE address blocks: 38892 Unique aggregates announced from the RIPE address blocks: 25856 RIPE Region origin ASes present in the Internet Routing Table: 8815 RIPE Region origin ASes announcing only one prefix: 4660 RIPE Region transit ASes present in the Internet Routing Table: 1412 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 22 Number of RIPE addresses announced to Internet: 278168708 Equivalent to 16 /8s, 148 /16s and 132 /24s Percentage of available RIPE address space announced: 75.4 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-41983 RIPE Address Blocks 62/8, 77/8, 78/7, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 13394 Total LACNIC prefixes after maximum aggregation: 3964 Prefixes being announced from the LACNIC address blocks: 11369 Unique aggregates announced from the LACNIC address blocks: 6961 LACNIC Region origin ASes present in the Internet Routing Table: 747 LACNIC Region origin ASes announcing only one prefix: 244 LACNIC Region transit ASes present in the Internet Routing Table: 132 Average LACNIC Region AS path length visible: 4.1 Max LACNIC Region AS path length visible: 17 Number of LACNIC addresses announced to Internet: 35070464 Equivalent to 2 /8s, 23 /16s and 34 /24s Percentage of available LACNIC address space announced: 52.3 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2447 Total AfriNIC prefixes after maximum aggregation: 937 Prefixes being announced from the AfriNIC address blocks: 1683 Unique aggregates announced from the AfriNIC address blocks: 1059 AfriNIC Region origin ASes present in the Internet Routing Table: 170 AfriNIC Region origin ASes announcing only one prefix: 49 AfriNIC Region transit ASes present in the Internet Routing Table: 27 Average AfriNIC Region AS path length visible: 3.5 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 4489984 Equivalent to 0 /8s, 68 /16s and 131 /24s Percentage of available AfriNIC address space announced: 13.4 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1230 8525 248 CHINANET-BACKBONE 4755 1038 384 69 Videsh Sanchar Nigam Ltd. Aut 9583 960 97 71 Sify Limited 9498 887 212 62 BHARTI BT INTERNET LTD. 23577 777 35 707 KRNIC 4766 742 4945 304 Korea Telecom (KIX) 1221 583 1698 448 Telstra Pty Ltd 17488 553 34 19 Hathway IP Over Cable Interne 7545 549 126 74 TPG Internet Pty Ltd 17676 501 10934 65 Softbank BB Corp. 18101 485 86 21 Reliance Infocom Ltd Internet 9443 443 111 74 Primus Telecommunications 9942 441 82 133 COMindico Australia 4812 440 751 64 China Telecom (Shanghai) 17849 423 36 126 Telecommunications Technology 4802 410 86 150 Wantree Development 17557 369 32 179 Pakistan Telecom 17974 369 129 12 PT TELEKOMUNIKASI INDONESIA 2907 333 1749 310 SINET Japan 4837 324 3620 140 chinanet IDC center beijing n ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1548 6188 983 AT&T WorldNet Services 2386 1104 571 734 AT&T Data Communications Serv 4323 1044 805 297 Time Warner Telecom 6197 1025 629 498 BellSouth Network Solutions, 18566 979 272 8 Covad Communications 701 952 6707 776 UUNET Technologies, Inc. 174 938 6820 863 Cogent Communications 721 843 21921 301 DLA Systems Automation Center 1239 834 2731 582 Sprint 11492 810 98 15 Cable One 19262 783 2452 177 Verizon Global Networks 20115 766 685 411 Charter Communications 22773 714 1743 41 Cox Communications, Inc. 209 708 3762 553 Qwest 7011 692 213 432 Citizens Utilities 852 595 1087 388 Telus Advanced Communications 19916 567 48 57 OLM LLC 5668 552 161 19 CenturyTel Internet Holdings, 6198 548 526 255 BellSouth Network Solutions, 855 539 250 73 Canadian Research Network RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 546 1928 425 UUNET - Commercial IP service 3301 308 1199 292 TeliaNet Sweden 3320 297 4992 245 Deutsche Telekom AG 24863 286 44 27 LINKdotNET AS number 8220 275 472 265 COLT Telecommunications 6746 259 92 236 Dynamic Network Technologies, 680 250 2041 246 DFN-IP service G-WiN 9116 228 134 23 Goldenlines main autonomous s 3246 225 409 214 Song Networks 8708 221 279 208 Romania Data Systems S.A. 3215 220 1972 94 France Telecom Transpac 1257 218 1073 172 SWIPnet Swedish IP Network 8551 210 198 31 Bezeq International 3269 208 2357 75 TELECOM ITALIA 5416 204 13 13 BATELCO-BH 30890 202 18 82 SC Kappa Invexim SRL 6830 184 823 39 UPC Distribution Services 3300 176 171 95 AUCS Communications Services 786 171 1779 171 The JANET IP Service 3352 170 1735 32 Ibernet, Internet Access Netw LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 759 1921 208 UniNet S.A. de C.V. 11830 484 299 19 Instituto Costarricense de El 11172 402 101 91 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 22047 307 206 11 VTR PUNTO NET S.A. 6471 267 74 31 ENTEL CHILE S.A. 14117 254 16 13 Telefonica del Sur S.A. 7303 220 98 37 Telecom Argentina Stet-France 6147 215 150 20 Telefonica Del Peru 6503 205 170 93 AVANTEL, S.A. 11556 196 97 5 Cable-Wireless Panama 10481 181 72 8 Prima S.A. 21826 150 20 39 INTERCABLE 7910 147 10 33 ANDINET ON LINE 23216 144 19 43 RAMtelecom Telecomunicaciones 19169 139 9 22 Telconet 19429 135 84 34 E.T.B. 14522 130 20 13 SatNet S.A. 18822 129 8 10 TELEFONICA MANQUEHUE 7738 116 442 21 Telecomunicacoes da Bahia S.A AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 291 804 232 The Internet Solution 8452 220 60 7 TEDATA 15475 147 84 4 Nile Online 6713 145 136 12 Itissalat Al-MAGHRIB 2018 133 297 111 Tertiary Education Network 5536 122 8 17 Internet Egypt Network 24835 116 48 6 RAYA Telecom - Egypt 33783 110 6 4 EEPAD TISP TELECOM & INTERNET 2905 78 173 71 The Internetworking Company o 2561 56 6 2 Egyptian Universities Network 15706 56 12 4 Sudatel Internet Exchange Aut 5713 40 294 33 Telkom SA Ltd 12455 40 6 3 Jambonet Autonomous system 33774 34 8 21 AS Number for Telecom Algeria 16637 33 21 25 Johnnic e-Ventures 23889 32 10 14 MAURITIUS TELECOM 8524 31 2 5 AUCEGYPT Autonomous System 15804 27 2 1 AS of The Way Out Internet So 10798 23 1 14 Standard Bank of South Africa 21280 23 4 4 Swift Global Kenya Ltd.Is an Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4134 1230 982 CHINANET-BACKBONE 18566 979 971 Covad Communications 4755 1038 969 Videsh Sanchar Nigam Ltd. Aut 9583 960 889 Sify Limited 9498 887 825 BHARTI BT INTERNET LTD. 11492 810 795 Cable One 4323 1044 747 Time Warner Telecom 22773 714 673 Cox Communications, Inc. 19262 783 606 Verizon Global Networks 8151 759 551 UniNet S.A. de C.V. 721 843 542 DLA Systems Automation Center 17488 553 534 Hathway IP Over Cable Interne 5668 552 533 CenturyTel Internet Holdings, 6197 1025 527 BellSouth Network Solutions, 19916 567 510 OLM LLC 7545 549 475 TPG Internet Pty Ltd 855 539 466 Canadian Research Network 11830 484 465 Instituto Costarricense de El 18101 485 464 Reliance Infocom Ltd Internet 15270 487 453 PaeTec.net -a division of Pae List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65101 PRIVATE 202.133.56.0/24 9498 BHARTI BT INTERNET L 65101 PRIVATE 202.133.57.0/24 9498 BHARTI BT INTERNET L 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 198.18.0.0/15 8895 KACST/ISU Riyadh Autonomous S Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.33.1.0/24 7018 AT&T WorldNet Services 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:10 /10:13 /11:30 /12:111 /13:222 /14:397 /15:794 /16:9077 /17:3625 /18:5826 /19:12664 /20:14281 /21:12838 /22:16203 /23:17682 /24:109219 /25:658 /26:468 /27:364 /28:69 /29:44 /30:80 /31:0 /32:31 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 962 979 Covad Communications 2386 826 1104 AT&T Data Communications Serv 7018 822 1548 AT&T WorldNet Services 6197 802 1025 BellSouth Network Solutions, 11492 796 810 Cable One 9583 791 960 Sify Limited 23577 763 777 KRNIC 7011 597 692 Citizens Utilities 19916 562 567 OLM LLC 4766 553 742 Korea Telecom (KIX) 9498 539 887 BHARTI BT INTERNET LTD. 4755 464 1038 Videsh Sanchar Nigam Ltd. Aut 15270 457 487 PaeTec.net -a division of Pae 855 436 539 Canadian Research Network 5668 428 552 CenturyTel Internet Holdings, 1239 421 834 Sprint 18101 418 485 Reliance Infocom Ltd Internet 17849 409 423 Telecommunications Technology 6198 388 548 BellSouth Network Solutions, 33588 388 409 Bresnan Communications, LLC. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 8:66 9:1 12:1648 13:1 15:15 16:3 17:3 18:4 20:39 24:834 25:1 32:56 38:268 40:57 41:31 44:2 47:8 52:4 53:1 55:1 56:3 57:26 58:262 59:336 60:209 61:940 62:1054 63:1882 64:3180 65:2289 66:3113 67:666 68:656 69:1707 70:396 71:112 72:1018 74:110 75:32 76:14 80:829 81:762 82:651 83:373 84:476 85:755 86:420 87:423 88:253 89:625 91:84 97:1 121:74 122:31 123:3 124:459 125:730 128:285 129:205 130:125 131:323 132:46 133:9 134:177 135:42 136:179 137:113 138:187 139:50 140:525 141:134 142:346 143:199 144:252 145:67 146:322 147:140 148:367 149:175 150:108 151:118 152:82 153:121 154:5 155:261 156:148 157:162 158:152 159:138 160:97 161:86 162:217 163:161 164:238 165:235 166:244 167:272 168:487 169:123 170:394 171:11 172:1 190:307 192:5737 193:3576 194:2797 195:2133 196:893 198:3777 199:3294 200:4595 201:963 202:6946 203:7124 204:3944 205:2100 206:2400 207:2906 208:2317 209:3554 210:2215 211:873 212:1425 213:1479 214:383 215:39 216:4118 217:1165 218:349 219:256 220:811 221:357 222:251 End of report Report Website: http://thyme.apnic.net

1 0

RE: BGP analyzing tool
by Jim McBurnett 22 Nov '06

22 Nov '06

I guess this would be a good time to ask if anyone knows the status of the netlantis project. That would be a goo tool as maybe: http://bgplay.routeviews.org/bgplay/ Later, Jim -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Roland Dobbins Sent: Wednesday, November 22, 2006 1:22 AM To: NANOG Subject: Re: BGP analyzing tool On Nov 21, 2006, at 10:08 PM, Doug Marschke wrote: > I need > this > info to understand why a certain upstream is being more prefered than > the others. Thanks. I believe that PacketDesign's Route Explorer may be helpful in answering questions of this type: http://www.packetdesign.com ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)cisco.com> // 408.527.6376 voice All battles are perpetual. -- Milton Friedman

2 1

more on passports for Toronto NANOG...
by Robert E. Seastrom 22 Nov '06

22 Nov '06

Very little here that we don't already know: http://news.yahoo.com/s/ap/20061122/ap_on_go_ot/passports_air_travel *except* for the bit in the third from last paragraph about the startlingly large percentages (between 25 and 42%) of Americans traveling to Canada, Mexico, and the Caribbean who don't have passports. While the article doesn't come right out and say it, I won't be surprised if there's a big backlog at the passport office due to people suddenly realizing they need something they've never had to have before. Toronto NANOG is only about 70 days away. If you're planning on going and don't yet have a passport, getting your paperwork in ASAP would be a Good Plan. ---Rob

1 0

Re: BGP analyzing tool
by Kanagaraj Krishna 21 Nov '06

21 Nov '06

Hi, Are there any available BGP analyzing tool that can be used to identify details on best chosen path based on the BGP algorithm? NTOP can capture the traffic info, but to analyze each destination to find the reason for selection (local preference, no of AS hops, iBGP vs eBGP etc) would be hard. I need this info to understand why a certain upstream is being more prefered than the others. Thanks. Regards, Kana

1 0

RE: How to get a list of research and academic ISP ?
by Maciej Kurant 21 Nov '06

21 Nov '06

Dear All, Thank you very much for numerous and quick replies for my email. I must say that nanog list is really highly responsive. I needed some time to digest your comments and try some new ideas. I share the preliminary results with you now, begging for further comments. The problem was (and still is) to find a good heuristic to distinguish between commercial (COM) and educational/research/academic (EDU) ASes. *EDU_Abilene* My first approach (see my original email) was to extract a list of all destinations announced by Abilene. (The assumption is that Abilene generally does not announce commercial prefixes.) This results in a list, call it "EDU_Abilene", of 1333 ASes. *EDU_description* Some of you suggested looking at the names and descriptions of ASes. I used the AS list available at: <http://www.multicasttech.com/status/asn_expand.txt> http://www.multicasttech.com/status/asn_expand.txt and searched the last column ("Organization") for the following strings: "Universit|Univerz|Universida|research|education|science|scientif|academic|c ollege|institut|laborator|school|ecole| edu|R&D|library|academy|Etudes" This approach finds 1796 "educational" ASes, call this set "EDU_description". Of course, these two lists overlap, but less than I expected. In particular: len(EDU_Abilene)=1333 len(EDU_description)=1796 union(EDU_Abilene, EDU_description)=2269 intersection(EDU_Abilene, EDU_description)=860 For many reasons, these lists are far from being very precise. For instance EDU_Abilene contains AS 7132 (AT&T) and AS 8075 (Microsoft). Therefore I need further data sets or filtering methodology. This raises some questions: 1) What other EDU networks (preferably with BGP tables available in the web) can I take as examples of ASes that (generally) do not announce commercial prefixes? Based on them I could construct lists similar in spirit to EDU_Abilene. I guess, the more the better. 2) Do you know of other lists, similar to <http://www.multicasttech.com/status/asn_expand.txt> http://www.multicasttech.com/status/asn_expand.txt ? Maybe a longer description or a www related to an AS would help the method I use to create EDU_description. Do you think the strings I use in my search are appropriate? *AS relationships* Another approach is to exploit the AS relationships. Most of you agree that usually EDU ASes are not providers for COM customers. This suggests a way to detect false positives in EDU_Abilene and EDU_description (or in their union). For every EDU node check how many COM customers it has, i.e., EDU provider --- COM customer relationship. I used the AS graphs with inferred relationships provided by CAIDA ( <http://as-rank.caida.org/data/2006/> http://as-rank.caida.org/data/2006/) This method works well to find good candidates for false positive, but they should not be blindly accepted. For instance AS 7132 (AT&T) has the highest number of COM customers (615) and should obviously belong to COM (it is a member of EDU_Abilene). In contrast, a big component of the EDU backbone, AS 11537 (Abilene) has 66 COM customers! In general there are about 50 EDU nodes with more than 10 COM customers each. 3) What other "automatic" or "manual" approaches would you suggest? Or improvements of the ones just described? I will appreciate even the briefest comments and suggestions, Maciej Kurant _____ From: Maciej Kurant [mailto:maciej.kurant@epfl.ch] Sent: mercredi, 15. novembre 2006 18:46 To: 'nanog(a)merit.edu' Subject: How to get a list of research and academic ISP ? Dear all, I am a PhD student at EPFL, Switzerland. My recent research interest is in large scale differences between the commercial and academic parts of the Internet. Of course, in order to perform this kind of studies I need a way to distinguish between these two worlds. I've learnt that Abilene does not provide commercial connectivity. This means that BGP prefixes and AS paths announced by Abilene BGP routers should lead only to research and academic destinations. I have extracted (from the BGP tables at http://abilene.internet2.edu/observatory) a list of all such destinations and obtained 1333 ASes (for data form July 2006). The number looks reasonable, but I would like to be sure that I am not making a mistake. Therefore I would be grateful if you could answer the following questions: 1) Is this approach to obtain a list of research and academic ISPs correct? 2) Do you maybe know of such lists compiled before? 3) If I keep not only the destination ASes, but also all ASes on the AS paths towards these destination I obtain a list of about 1400 ASes. How should I understand this? Does it mean that some research and academic destinations are reachable from Abilene only by traversing the commercial Internet? 4) Of course, research and academic ASes are often well connected to the commercial Internet. My guess is that in most cases their peering relationship is "customer-provider", where commercial ASes are providers. Is it possible that an academic AS is a provider for some commercial ASes? If so, does it happen often? Thank you in advance for your comments. Maciej Kurant ============================================= EPFL IC ISC LCA3 Maciej Kurant PhD Student CH-1015 Lausanne, Switzerland web site: <http://lcawww.epfl.ch/kurant> http://lcawww.epfl.ch/kurant =============================================

3 2

FYI - IPv6 filter document
by Masaru MUKAI 21 Nov '06

21 Nov '06

Hi all, We have made a document about IPv6 route/packet filtering. It's based on a discussion at xSP operators' workshop in Japan. "Packet Filter and Route Filter Recommendation for IPv6 at xSP routers" http://www.cymru.com/Bogons/ http://www.cymru.com/Bogons/ipv6.txt If you have any question or comment, please feel free to contact 6bogon(a)inetcore.com or nanog(a)nanog.org. Best regards, -- Masaru MUKAI / KDDI

1 0

Request for comments on MAAWG Email Senders’ Best Communications Practices draft
by Dave Crocker 20 Nov '06

20 Nov '06

Folks, Howdy. I am writing to you on behalf of the Messaging Anti-Abuse Working Group <http://maawg.org>. The purpose of this note is to solicit Nanog participant's comments on our recent, draft Email Senders’ Best Communications Practices document, prior to its official release. The draft is located at <http://www.maawg.org/about/MAAWG_Senders_BCP>. We want to revise the draft, based on insights from a broad range of interested and knowledgeable parties. We also are interested in exploring the document’s being co-sponsored under the auspices of MAAWG and RIPE. If you were not aware of MAAWG, the group’s focus is on preserving electronic messaging from online exploits and abuse, with the goal of enhancing usertrust and confidence, while ensuring the deliverability of legitimate messages.The Senders BCP effort is one of the initiatives that MAAWG is pursuing, to reduce messaging abuse while enabling legitimate messages to obtain unimpeded delivery. MAAWG membership is diverse and the referenced content reflects the perspectives of both leading email senders and receivers. We believe that conformance with the Senders BCP will improve deliverability for legitimate messages, yet lay a substantial foundation for successful dispute resolution. We believe this document reflects a global perspective on successful messaging and welcome any insights that can further detail or delineate best practices for bulk senders. At your convenience, but prior to our comments deadline of 12/22/06, please provide specific edits and comments about the BCP to: senderbcp(a)maawg.org. Thank you for your consideration of this important effort. I look forward to your feedback. /d ps. You will no doubt guess that the above is a standardized letter. We wanted to give a consistent message to those we are soliciting for comment. On reflection, I note that a) it is unsolicited, b) it is being sent in bulk, and c) it requests readers to take action. With any luck, it won't be classed as spam, and the reason will be more than "Dave is a good guy" or the like. But I do find myself wondering about boundary conditions... -- Dave Crocker Brandenburg InternetWorking bbiw.net

1 0

Drone Armies C&C Report - 17 Nov 2006
by c2report＠isotf.org 18 Nov '06

18 Nov '06

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 4189 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 13405 reported C&Cs. Of the suspect C&Cs surveyed, 649 reported as Open, 947 reported as closed, and 755 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 5847 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 19318 NJIIX-AS-1 - NEW JERSEY INTERN 117 27 77 13301 UNITEDCOLO-AS Autonomous System of 102 30 71 16265 LEASEWEB AS 55 38 31 23522 CIT-FOONET 46 33 28 8560 SCHLUND-AS 40 25 38 30058 FDCSE FDCservers.net LLC 38 12 68 4766 KIXS-AS-KR 33 5 85 15083 IIS-129 Infolink Information Servic 31 0 100 174 Cogent Communications 30 25 17 33597 InfoRelay Online Systems, Inc. 29 0 100 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 26 0 100 9318 HANARO-AS 25 7 72 12832 Lycos Europe 24 0 100 1659 ERX-TANET-ASN1 24 6 75 24611 AS24611 Datacenter Luxembourg S.A. 23 0 100 7132 SBC Internet Services 23 4 83 30083 Server4You Inc. 22 8 64 4314 IIS-64 I-55 INTERNET SERVICES 22 2 91 19166 Alpha Red, INC 19 5 74 30407 Velcom.com 19 3 84 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 16265 LEASEWEB AS 55 38 31 23522 CIT-FOONET 46 33 28 13301 UNITEDCOLO-AS Autonomous System of 102 30 71 19318 NJIIX-AS-1 - NEW JERSEY INTERN 117 27 77 8560 SCHLUND-AS 40 25 38 174 Cogent Communications 30 25 17 30058 FDCSE FDCservers.net LLC 38 12 68 30315 Everyones Internet 13 8 38 15516 DK-ARROWHEAD 9 8 11 9800 UNICOM 19 8 58 30083 Server4You Inc. 22 8 64 12322 PROXAD AS for Proxad ISP 10 8 20 28753 NETDIRECT AS NETDIRECT Frankfurt 13 8 38 3786 ERX-DACOMNET 14 8 43 36263 forona. 11 7 36 9318 HANARO-AS 25 7 72 3462 HINET 13 7 46 34305 EUROACCESS Euroaccess 9 7 22 6140 ImpSat 8 6 25 1659 ERX-TANET-ASN1 24 6 75 A version of this report with addition rankings can be found via the isotf.org home page. Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

problem with BGP or I am an Idiot
by Philip Lavine 18 Nov '06

18 Nov '06

To all, Probabaly the the latter; however here is the situation. I am advertising a rte 1.1.1.1 via BGP to the Internet via ISP_A via my location in NJ. At my other location in CA where I am advertising another rte 2.2.2.2 via BGP to the Internet via the same ISP_A. I am using the same AS for both routes. For some reason on my rtr advertising the 2.2.2.2 rte I am unable to see the 1.1.1.1 rte "% Network not in table". I know 1.1.1.1 rte is valid it shows up in looking glass and ISP_A has it on the peer 2.2.2.2 recevies full Internet rtes from. Further verification: I add a static rte on 2.2.2.2 rtr to 1.1.1.1 and its routable??? How is this possible? I have the following filters but I removed them and it seems to not make a diff. OUTBOUND - ip as-path access-list 1 permit ^$ ip as-path access-list 1 deny .* INBOUND - ip as-path access-list 2 permit .* Philip ____________________________________________________________________________________ Sponsored Link $420k for $1,399/mo. Think You Pay Too Much For Your Mortgage? Find Out! www.LowerMyBills.com/lre

6 5

Cogent now peering with Sprint?
by Ed Ray 17 Nov '06

17 Nov '06

I never thought Sprint would ever renew its relationship with Sprint: Tracing the route to portus.netsecdesign.com (66.6.208.6) 1 sl-bb24-rly-9-0.sprintlink.net (144.232.14.122) 0 msec 0 msec 0 msec 2 sl-st22-ash-6-0.sprintlink.net (144.232.20.189) 0 msec 4 msec 0 msec 3 p15-2.core01.iad01.atlas.cogentco.com (154.54.13.61) [AS 174] 4 msec 4 msec 0 msec 4 v3492-mpd01.iad01.atlas.cogentco.com (154.54.3.222) [AS 174] 16 msec 80 msec 196 msec 5 v3497.mpd01.dca01.atlas.cogentco.com (154.54.5.65) [AS 174] 4 msec 4 msec 4 msec 6 t9-3.mpd01.iah01.atlas.cogentco.com (154.54.2.222) [AS 174] 44 msec 44 msec 48 msec 7 t2-3.mpd01.lax01.atlas.cogentco.com (154.54.3.186) [AS 174] 72 msec 72 msec 72 msec 8 g2-0-0.core01.lax01.atlas.cogentco.com (154.54.2.101) [AS 174] 72 msec 72 msec 72 msec 9 g49.ba01.b002698-1.lax01.atlas.cogentco.com (66.250.12.130) [AS 174] 72 msec 72 msec 72 msec 10 PAJO-Networks.demarc.cogentco.com (38.112.9.190) [AS 174] 72 msec 76 msec 72 msec 11 dcap04.pcap.lax01.tierzero.net (216.31.128.14) [AS 11509] 72 msec 76 msec 72 msec 12 mmic-gw.dcap6.lax.us.tierzero.net (216.31.188.94) [AS 11509] 76 msec 80 msec 80 msec 13 dazedandconfused.netsecdesign.com (66.6.208.4) [AS 11509] 84 msec 84 msec 88 msec 14 portus.netsecdesign.com (66.6.208.6) [AS 11509] 84 msec 84 msec 88 msec Next I will see pigs flying :) Wonder how long it will last based on Cogent's past behavior as noted here. Edward Ray ------------------------------------------------------------- This mail was scanned by BitDefender For more informations please visit http://www.bitdefender.com -------------------------------------------------------------

3 2