- Test - lists.nanog.org

what can be done with botnet C&C's?
by Gadi Evron 12 Aug '06

12 Aug '06

In my last email message I addressed some of the issues related to botnet C&C's and their mitigation. As mentioned, I waited to see what other experiences told other people, as well as glimpse the opinion of others here. In this message I will try and address some of the questions asked, but once again limiting myself mostly to JUST networking rather than the whole realm of botnet fighting. "I work on this [C&C] for 30 days, only to find out one of you took it down." -- US Federal Agent, two days ago, ISOI (DA Workshop). And still, sticking to networking issues, as obviously we cannot yet depend on law enforcement to protect our networks for us, how do we handle C&C's? When we kill them (and by "kill" I naturally mean "report our suspicion to the responsible authority so they can investigate, confirm and proceed according to their AUP") we kill them, but only to our knowledge. They immediately move elsewhere we do not know about in our space or someone else's, maybe misplacing an extremely smallish percentage of their population while they are at it. Okay, say I am right... What *can* we do? We can take advantage: 1. QoS and traffic limiting tools. Many tools created in recent years, and used exstensively by many ISP's, regardless of any Net Neutrality legislation, are at our disposal and already implemented on our networks. Much like, for business reasons, many of us would limit P2P, how about limiting the traffic to compromised users? How, what and when is up to you. You can know who your compromised users are by watching flows to C&C's. 2. Blocking communication to C&C's. Watch the flows, block the users from communicating out to them. Watch these users and see where else they are communicating in comparison to other users, en-masse. It's a matter of doing the same thing, for a different purpose. 3. Walled garden and tech support costs. Obviously, if any of these users call you (and they VERY OFTEN do), you lose money on them for a long time to come.. only they will call again. A combination of quarantine, complete or partial, might work. Combine that with what some already do, such as sell users Anti Virus products, and you get a nice deal. Add to that a support company to lend help to users, unrelated to tech support, by subscription, and you may just have more business avenues to explore. 4. Stop internal network infections. It is unbelievable how the networks with the most bots are the networks that allow internal users to connect wherever they want within the network. All these come to show that although responsiveness to C&C's is important (rather than shutting them down), on the scale of the Internet, what will actually help the Internet is if you take care of it on your own network. You don't have to do any of these, or all of these. Just to wake up to the fact that killing C&C's will mostly not help anyone, and if anything, will do harm. Using them to deal with problematic users, even if only to block them from acessing that C&C is more to the point. You can choose how to handle these issues, but if you want to stop harming the Internet, stop your users from participating, DDoSing, etc. while not harming your business (no one can handle that tech support load). Monitor the C&C's running on your network - contact law enforcement. These are compromises that will keep happening, you are aware of, and cause millions of dollars in damages. "So, are we supposed to leave these compromised boxes up?" My answer is this, if you fail to remove a spy, as another would just take his place, wouldn't you rather know where that spy is and work to take him down for good? The answer to that is NO, as most of us won't and can't. That said, if you must kill the C&C, be aware, it is nothing more than sweeping the problem, localy on your network, as well as on your friends', under the rag. Do you know who your local fed is? See if he can help, he most likely can't and if he could, without a much wider cooperation between everybody, he or she would be extremely limited by looking just at your C&C's. That said, I doubt you would want that fed's attension. You can limit P2P traffic yet you won't limit scanning traffic? Outgoing email traffic from port 25 on dynamic hosts? Bandwidth to compromised users? Port 80, or sny, traffic not through your proxy? Consider what other tools are in your arsenal. My ideas may be completely wrong for you, yet that does not change the fact that killing the C&C will just mean you are kept in the dark. Some large carriers do many of these already, run honey-nets, and what not. Do you? I would like to hear some opinions on what networks can do, ecnomically, from people here. Please stick to network operations issues. Gadi. This is being X-posted to the botnets list.

1 0

RE: ISP wants to stop outgoing web based spam
by Hank Nussbacher 12 Aug '06

12 Aug '06

On Wed, 9 Aug 2006, Mills, Charles wrote: I guess I wasn't clear enough in my first posting. I am not interested in smtp (port 25 spam). We have that covered. I am only interested in blocking outgoing web based spam. A user sits and sends out spam via automated tools via Hotmail, Yahoo, Gmail, or whatever Webmail system where they have set up thousands of throwaway users. An antispam proxy (that I want to install and manage) has to be able to come between the user on his/her PC and the Hotmail system and scan the http posts and page templates for things like number of receipents and other tricks like keeping track of the number of http posts. It has to maintain a list of known free webmail systems that are abused. Based on my stats from Spamcop, 60% of all outgoing spam is http based rather than smtp based. Others may have slightly higher or lower numbers. So, is there any magic fu out there to solve this? Thanks, Hank Nussbacher http://www.interall.co.il > Seems like all mail would have to go through the same server at that > point or at least every server would have to run the software. Probably > not practical for an ISP if you have multiple customers with their own > mail servers? I assume you're looking for something that would sit on > your egress point to your upstream providers? I would think that the > Packeteer box would almost be there to do this if you could have it or a > box like it inspect all traffic destined for port 25. Compare it > against a database of known spammers, known spam keywords, etc.? > > > > > > Charles L. Mills > > Senior Network Engineer > > Access Data Corporation > > 90 Beta Drive > > Pittsburgh, PA 15238 > > (412) 968-4024 > > cmills(a)accessdc.com > > http://www.accessdc.com <http://www.accessdc.com/> > > Hosting, Colocation and Disaster Recovery > > ________________________________ > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Michael K. Smith - Adhost > Sent: Wednesday, August 09, 2006 9:11 AM > To: Hank Nussbacher; Nanog > Subject: Re: ISP wants to stop outgoing web based spam > > > > Hello Hank: > > > On 8/9/06 3:28 AM, "Hank Nussbacher" <hank(a)efes.iucc.ac.il> wrote: > >> >> Back in 2002 I asked if anyone had a solution to block or rate limit >> outgoing web based spam. Nothing came about from that thread. I have > an >> ISP that *wants* to stop the outgoing spam on an automatic basis and > be >> a good netizen. I would have hoped that 4 years later there would be >> some technical solution from some hungry startup. Perhaps I have > missed >> it. What I have found so far is: >> >> Detecting Outgoing Spam and Mail Bombing >> http://www.brettglass.com/spam/paper.html >> SMTP based mitigation - thing on HTTP/HTTPS >> >> Stopping Outgoing Spam >> http://research.microsoft.com/~joshuago/outgoingspam-final-submit.pdf >> Research paper - nothing practical >> >> Throttling Outgoing SPAM for Webmail Services >> http://www.ceas.cc/papers-2005/164.pdf >> Research paper - nothing practical >> >> ISPs look inward to stop spam - Network World >> http://www.networkworld.com/news/2004/071204carrispspam.html >> Bottom line - no solution >> >> So I am trying once again. Hopefully someone has some magic dust >> this time around. >> >> Thanks, >> Hank Nussbacher >> http://www.interall.co.il >> > > My answer is based on the word "startup" so I'm assuming "no money" but > I > could be "wrong". :-) We use the standard SpamAssassin, ClamAV setup > both > on ingress and egress. On egress we set the detection levels and divert > and > save anything that is marked as Spam rather than sending it on with > headers > and subject modifications. > > We've found this to be very effective in reducing our scores with > Comcast > and AOL in particular and it's pretty much stopped our being blocked by > those services, even using a fairly loose setting for SpamAssassin. As > a > service provider that forwards tons of mail to addresses on those > networks > (previously un-scanned so we forwarded everything, including Spam) we've > found it essential to put these filters in place to guarantee (as much > as > anyone can) service for our email customers. > > Regards, > > Mike > > > > +++++++++++++++++++++++++++++++++++++++++++ > This Mail Was Scanned By Mail-seCure System > at the Tel-Aviv University CC.

14 30

mpls gear for outside plant?
by Christian Kuhtz 12 Aug '06

12 Aug '06

Anyone know of vendors who make low density MPLS edge (IPVPN, VPLS, VPWS) gear, which can survive in outside plant? There doesn't seem to be much out there that can, most stuff that is data center type tops out at 40C. I'm looking for 45C or higher operating temp. Please respond directly to me unless you think it's of interest to the rest of the list. ;-) Thanks in advance. Best regards, Christian

1 0

Re: SORBS Contact
by Michael Nicks 11 Aug '06

11 Aug '06

Don't forget racketeering. "A person who commits crimes such as extortion, loansharking, bribery, and obstruction of justice in furtherance of illegal business activities." I think most network operators have learned about the ultra-liberal listing activities of RBLs these days. -Michael -- Michael Nicks Network Engineer KanREN e: mtnicks(a)kanren.net o: +1-785-856-9800 x221 m: +1-913-378-6516 Dean Anderson wrote: > SORBS is a well-known abusive/defamatory blacklist. In the US, that > violates a number of state and federal laws: > > 1. defamation > 2. illegal group boycott in violation of antitrust act > 3. (usually) unauthorized blocking by ISP in violation of its > contract with its customer, which is a violation of the > electronic communications privacy act. > 4. There are frequently state laws that apply to electronic > communications that are even more broad. > > You _can_ make the US based ISP not use SORBS. Most ISPs know better, > already. > > --Dean > > > See also http://www.iadl.org. > > --Dean > > On Mon, 7 Aug 2006, Brian Boles wrote: >> Can someone from SORBS contact me offlist if they are on here.... > > On Tue, 8 Aug 2006, Stefan Hegger wrote: >> We have the same problem. We are blacklisted and I filled out the webform. I >> got an email regarding ticket number and account/password to track the >> ticket. But it seems that nobody is working on it. > >>> There has been extensive discussion on NANAE and NANABl newsgroups on >>> this issue. The bottom line: The SORBS ticket queue is handled by a >>> group of unpaid volunteers, and there is quite a backlog. >>> >>> That's why there is the automatic de-listing system in place, which >>> requires proper host names and longer time-to-live (TTL) values in >>> rDNS. >>> >>> Yes, it's a bit of work, but it beats waiting for someone to get around >>> to your ticket. >>> >>> No, I'm not associated in any way with SORBS, just an interested >>> observer and system administrator who has had to deal with listings myself. > > > > > On Tue, 8 Aug 2006, Michael Nicks wrote: >> Sad state of affairs when looney people dictate which IPs are "good" and >> "bad". > > > On Tue, 8 Aug 2006, S. Ryan wrote: > >> Even worse if your ISP uses it and demands you ask the 'offender' to get >> 'themselves' removed. > >

26 48

Fedex Contact?
by Dennis Dayman 11 Aug '06

11 Aug '06

Does anyone have a Fedex.com contact that can help troubleshoot an email issues?

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 11 Aug '06

11 Aug '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 12 Aug, 2006 Analysis Summary ---------------- BGP routing table entries examined: 194755 Prefixes after maximum aggregation: 107004 Unique aggregates announced to Internet: 95222 Total ASes present in the Internet Routing Table: 22854 Origin-only ASes present in the Internet Routing Table: 19885 Origin ASes announcing only one prefix: 9517 Transit ASes present in the Internet Routing Table: 2969 Transit-only ASes present in the Internet Routing Table: 68 Average AS path length visible in the Internet Routing Table: 3.5 Max AS path length visible: 24 Max AS path prepend of ASN (24076) 20 Prefixes from unregistered ASNs in the Routing Table: 22 Unregistered ASNs in the Routing Table: 2 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 9 Number of addresses announced to Internet: 1562847660 Equivalent to 93 /8s, 39 /16s and 41 /24s Percentage of available address space announced: 42.2 Percentage of allocated address space announced: 61.0 Percentage of available address space allocated: 69.1 Total number of prefixes smaller than registry allocations: 96812 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 42607 Total APNIC prefixes after maximum aggregation: 17466 Prefixes being announced from the APNIC address blocks: 40293 Unique aggregates announced from the APNIC address blocks: 18723 APNIC Region origin ASes present in the Internet Routing Table: 2669 APNIC Region origin ASes announcing only one prefix: 755 APNIC Region transit ASes present in the Internet Routing Table: 400 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 24 Number of APNIC addresses announced to Internet: 244848480 Equivalent to 14 /8s, 152 /16s and 23 /24s Percentage of available APNIC address space announced: 76.6 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 98560 Total ARIN prefixes after maximum aggregation: 58685 Prefixes being announced from the ARIN address blocks: 72285 Unique aggregates announced from the ARIN address blocks: 27310 ARIN Region origin ASes present in the Internet Routing Table: 10883 ARIN Region origin ASes announcing only one prefix: 4096 ARIN Region transit ASes present in the Internet Routing Table: 1012 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 18 Number of ARIN addresses announced to Internet: 299087360 Equivalent to 17 /8s, 211 /16s and 182 /24s Percentage of available ARIN address space announced: 77.5 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 39164 Total RIPE prefixes after maximum aggregation: 26205 Prefixes being announced from the RIPE address blocks: 36138 Unique aggregates announced from the RIPE address blocks: 24344 RIPE Region origin ASes present in the Internet Routing Table: 8363 RIPE Region origin ASes announcing only one prefix: 4386 RIPE Region transit ASes present in the Internet Routing Table: 1372 Average RIPE Region AS path length visible: 3.9 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 261444932 Equivalent to 15 /8s, 149 /16s and 85 /24s Percentage of available RIPE address space announced: 82.0 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-41983 RIPE Address Blocks 62/8, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 12153 Total LACNIC prefixes after maximum aggregation: 3732 Prefixes being announced from the LACNIC address blocks: 10247 Unique aggregates announced from the LACNIC address blocks: 5896 LACNIC Region origin ASes present in the Internet Routing Table: 711 LACNIC Region origin ASes announcing only one prefix: 235 LACNIC Region transit ASes present in the Internet Routing Table: 131 Average LACNIC Region AS path length visible: 4.2 Max LACNIC Region AS path length visible: 24 Number of LACNIC addresses announced to Internet: 31927040 Equivalent to 1 /8s, 231 /16s and 43 /24s Percentage of available LACNIC address space announced: 47.6 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2249 Total AfriNIC prefixes after maximum aggregation: 916 Prefixes being announced from the AfriNIC address blocks: 1543 Unique aggregates announced from the AfriNIC address blocks: 976 AfriNIC Region origin ASes present in the Internet Routing Table: 160 AfriNIC Region origin ASes announcing only one prefix: 45 AfriNIC Region transit ASes present in the Internet Routing Table: 24 Average AfriNIC Region AS path length visible: 3.5 Max AfriNIC Region AS path length visible: 11 Number of AfriNIC addresses announced to Internet: 4202496 Equivalent to 0 /8s, 64 /16s and 32 /24s Percentage of available AfriNIC address space announced: 12.5 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1290 7930 240 CHINANET-BACKBONE 4755 966 255 68 Videsh Sanchar Nigam Ltd. Aut 9583 936 109 15 Sify Limited 9498 779 211 70 BHARTI BT INTERNET LTD. 4766 702 4435 303 Korea Telecom (KIX) 1221 610 1779 467 Telstra Pty Ltd 7545 553 124 72 TPG Internet Pty Ltd 17488 522 32 18 Hathway IP Over Cable Interne 17676 491 7109 111 Softbank BB Corp. 9443 450 111 83 Primus Telecommunications 18101 436 85 22 Reliance Infocom Ltd Internet 4812 412 739 59 China Telecom (Shanghai) 17849 410 30 122 Telecommunications Technology 17974 377 129 12 PT TELEKOMUNIKASI INDONESIA 4802 370 81 158 Wantree Development 17557 358 29 169 Pakistan Telecom 2907 336 1733 311 SINET Japan 4837 307 3468 132 chinanet IDC center beijing n 7474 295 211 229 SingTel Optus Pty Ltd 10139 282 23 6 Meridian Telekoms ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1482 6259 956 AT&T WorldNet Services 6197 1016 635 477 BellSouth Network Solutions, 721 1002 21942 311 DLA Systems Automation Center 4323 980 747 278 Time Warner Telecom 701 963 6782 788 UUNET Technologies, Inc. 18566 954 272 8 Covad Communications 2386 940 559 710 AT&T Data Communications Serv 174 937 5769 887 Cogent Communications 1239 842 2797 595 Sprint 20115 730 651 380 Charter Communications 19262 726 2216 185 Verizon Global Networks 11492 723 90 16 Cable One 209 688 3661 542 Qwest 22773 685 1742 44 Cox Communications, Inc. 7011 676 221 431 Citizens Utilities 6198 595 554 236 BellSouth Network Solutions, 852 582 1068 382 Telus Advanced Communications 855 568 247 74 Canadian Research Network 19916 563 49 54 OLM LLC 5668 539 147 28 CenturyTel Internet Holdings, RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 560 1947 441 UUNET - Commercial IP service 3301 315 1186 300 TeliaNet Sweden 3320 295 5013 239 Deutsche Telekom AG 8220 280 471 266 COLT Telecommunications 24863 249 42 11 LINKdotNET AS number 680 247 2041 244 DFN-IP service G-WiN 6746 243 91 221 Dynamic Network Technologies, 3246 230 462 220 Song Networks 8708 215 278 203 Romania Data Systems S.A. 3215 204 1760 97 France Telecom Transpac 8551 202 182 27 Bezeq International 3269 201 2246 72 TELECOM ITALIA 30890 200 18 83 SC Kappa Invexim SRL 1257 195 742 167 SWIPnet Swedish IP Network 6830 195 879 43 UPC Distribution Services 8866 191 37 15 Bulgarian Telecommunication C 5416 180 12 11 BATELCO-BH 786 171 1778 171 The JANET IP Service 3300 171 171 98 AUCS Communications Services 9121 168 931 31 TTnet Autonomous System LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 784 1811 226 UniNet S.A. de C.V. 22047 458 206 11 VTR PUNTO NET S.A. 11172 359 112 86 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 6147 273 134 22 Telefonica Del Peru 6471 255 74 30 ENTEL CHILE S.A. 14117 217 13 7 Telefonica del Sur S.A. 6503 183 151 83 AVANTEL, S.A. 7303 182 85 29 Telecom Argentina Stet-France 10481 181 72 8 Prima S.A. 7910 136 9 22 ANDINET ON LINE 21826 134 17 23 INTERCABLE 11556 132 80 4 Cable-Wireless Panama 18822 129 8 10 TELEFONICA MANQUEHUE 19169 128 8 25 Telconet 19429 123 80 40 E.T.B. 14522 121 18 9 SatNet S.A. 7738 114 410 20 Telecomunicacoes da Bahia S.A 23216 113 21 9 RAMtelecom Telecomunicaciones 14259 112 10 15 GTD Internet S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 284 803 231 The Internet Solution 8452 169 60 7 TEDATA 6713 144 135 11 Itissalat Al-MAGHRIB 15475 140 84 4 Nile Online 2018 134 298 111 Tertiary Education Network 5536 121 8 18 Internet Egypt Network 24835 116 48 6 RAYA Telecom - Egypt 33783 106 6 2 EEPAD TISP TELECOM & INTERNET 2905 79 159 70 The Internetworking Company o 15706 44 8 3 Sudatel Internet Exchange Aut 5713 38 294 34 Telkom SA Ltd 33774 31 7 21 AS Number for Telecom Algeria 23889 25 8 11 MAURITIUS TELECOM 10798 23 1 14 Standard Bank of South Africa 16637 23 18 21 Johnnic e-Ventures 8524 22 1 5 AUCEGYPT Autonomous System 21280 21 4 4 Swift Global Kenya Ltd.Is an 33766 21 2 1 Nyala Communications Pty Ltd 21491 20 17 2 UTL On-line is RF broadband I 2561 19 6 2 Egyptian Universities Network Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4134 1290 1050 CHINANET-BACKBONE 18566 954 946 Covad Communications 9583 936 921 Sify Limited 4755 966 898 Videsh Sanchar Nigam Ltd. Aut 9498 779 709 BHARTI BT INTERNET LTD. 11492 723 707 Cable One 4323 980 702 Time Warner Telecom 721 1002 691 DLA Systems Automation Center 22773 685 641 Cox Communications, Inc. 8151 784 558 UniNet S.A. de C.V. 19262 726 541 Verizon Global Networks 6197 1016 539 BellSouth Network Solutions, 5668 539 511 CenturyTel Internet Holdings, 19916 563 509 OLM LLC 17488 522 504 Hathway IP Over Cable Interne 855 568 494 Canadian Research Network 7545 553 481 TPG Internet Pty Ltd 22047 458 447 VTR PUNTO NET S.A. 3602 527 422 Sprint Canada, Inc. 15270 455 422 PaeTec.net -a division of Pae List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65350 PRIVATE 124.236.0.0/19 17672 asn for Hebei Provin 65350 PRIVATE 124.236.240.0/20 17672 asn for Hebei Provin 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com 65350 PRIVATE 219.148.0.0/22 17672 asn for Hebei Provin 65350 PRIVATE 219.148.4.0/23 17672 asn for Hebei Provin 65350 PRIVATE 219.148.8.0/21 17672 asn for Hebei Provin 65350 PRIVATE 219.148.24.0/21 17672 asn for Hebei Provin 65350 PRIVATE 219.148.32.0/19 17672 asn for Hebei Provin 65350 PRIVATE 222.222.0.0/21 17672 asn for Hebei Provin 65350 PRIVATE 222.222.8.0/21 17672 asn for Hebei Provin 65350 PRIVATE 222.222.16.0/20 17672 asn for Hebei Provin 65350 PRIVATE 222.222.32.0/20 17672 asn for Hebei Provin 65350 PRIVATE 222.222.48.0/20 17672 asn for Hebei Provin 65350 PRIVATE 222.222.208.0/21 17672 asn for Hebei Provin 65350 PRIVATE 222.222.216.0/21 17672 asn for Hebei Provin 65350 PRIVATE 222.223.187.0/24 17672 asn for Hebei Provin 65350 PRIVATE 222.223.188.0/22 17672 asn for Hebei Provin 65350 PRIVATE 222.223.192.0/22 17672 asn for Hebei Provin 65350 PRIVATE 222.223.196.0/23 17672 asn for Hebei Provin 65350 PRIVATE 222.223.200.0/22 17672 asn for Hebei Provin 65350 PRIVATE 222.223.206.0/23 17672 asn for Hebei Provin 65350 PRIVATE 222.223.224.0/19 17672 asn for Hebei Provin Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.249.0.0/20 3450 University of Tennessee, Knox Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:9 /10:11 /11:28 /12:97 /13:205 /14:375 /15:733 /16:8950 /17:3412 /18:5563 /19:12087 /20:13638 /21:11960 /22:15121 /23:16321 /24:105108 /25:384 /26:308 /27:196 /28:66 /29:40 /30:80 /31:0 /32:46 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 937 954 Covad Communications 6197 796 1016 BellSouth Network Solutions, 7018 777 1482 AT&T WorldNet Services 9583 769 936 Sify Limited 11492 711 723 Cable One 2386 658 940 AT&T Data Communications Serv 7011 582 676 Citizens Utilities 19916 557 563 OLM LLC 4766 513 702 Korea Telecom (KIX) 9498 460 779 BHARTI BT INTERNET LTD. 855 442 568 Canadian Research Network 6198 441 595 BellSouth Network Solutions, 15270 424 455 PaeTec.net -a division of Pae 5668 421 539 CenturyTel Internet Holdings, 4755 402 966 Videsh Sanchar Nigam Ltd. Aut 1239 398 842 Sprint 17849 397 410 Telecommunications Technology 6517 383 416 Yipes Communications, Inc. 18101 371 436 Reliance Infocom Ltd Internet 22773 363 685 Cox Communications, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 8:50 12:1613 13:1 15:15 16:3 17:3 18:4 20:41 24:811 25:1 32:61 38:239 40:52 41:9 44:3 45:12 47:6 52:4 55:1 56:3 57:26 58:211 59:248 60:185 61:932 62:830 63:1889 64:3091 65:2259 66:2991 67:638 68:676 69:1567 70:390 71:87 72:874 74:71 75:5 80:753 81:674 82:644 83:410 84:393 85:574 86:396 87:462 88:154 89:394 91:1 121:13 122:3 123:1 124:348 125:595 128:148 129:188 130:118 131:315 132:34 133:8 134:164 135:48 136:178 137:85 138:213 139:48 140:491 141:135 142:376 143:189 144:239 145:40 146:318 147:140 148:354 149:187 150:114 151:97 152:71 153:117 154:5 155:213 156:179 157:169 158:167 159:172 160:94 161:83 162:217 163:164 164:236 165:222 166:182 167:242 168:486 169:125 170:352 171:14 190:125 192:5732 193:3404 194:2701 195:2024 196:853 198:3901 199:3300 200:4633 201:1035 202:6781 203:7045 204:3900 205:2009 206:2425 207:2906 208:2218 209:3447 210:2174 211:836 212:1258 213:1444 214:367 215:41 216:4018 217:1158 218:324 219:235 220:744 221:379 222:228 End of report Report Website: http://thyme.apnic.net

1 0

Re: New Laptop Polices
by Randy Bush 11 Aug '06

11 Aug '06

> randy, why not invite the new/etc... guy who probably never posted > before to come to a nanog instead of being so mean to the poor guy? >> you have sent a message to me which seems to contain a legal >> warning on who can read it, or how it may be distributed, or >> ... apologies to all. i hacked my .vm and .procmailrc [0] last night, and mashed elsewhere meaning my message went to list as opposed to just the sender of the silliness. randy [0] - to repent, here is an interesting .procmailrc hack to reduce backscatter. credit goes to rob austein for the equivalent maildrop hack from which i stole : * ^(From:.*(postmaster|mailer[\- ]daemon)|Return-Path:.*<>) { :B * !^Message-ID:.*@.*(psg|iij|bogus)\.com $TRASH }

1 0

Re: ISP wants to stop outgoing web based spam
by Ken Simpson 11 Aug '06

11 Aug '06

Alexander Harrowell [11/08/06 17:09 +0100]: > Holding the geek snobbery for a moment, I don't think I've ever worked > anywhere where the e-mail wasn't MSExchange...so that would kill 100% of > "e-mail containing actual financially meaningful information". Yes it would if host type was the only factor you used to decide whether to block a connection. It would be silly and unwise to block based on host type alone. However in the absence of any other information about an IP, it's at least a good and safe way to trigger rate limiting or throttling of a connection. Once the sender gets a few good mails through and proves its worthiness, its good reputation will vastly outweight the host type. Legitimate senders don't move around a lot, so their positive reputation has time to build. Spammers on the other hand use very short-lived IPs which do not have a chance to build reputation. The next iteration for spammers will be to move in a big way toward sending via legitimate outbound mail servers. A previous thread was already discussing a variant of this technique, where webmail accounts are automatically plundered from cafes in Nigeria to exploit the good reputation of ISPs. Regards, Ken > On 8/11/06, Ken Simpson <ksimpson(a)mailchannels.com> wrote: > > > > > >> On 10 Aug 2006, at 22:07, Barry Shein wrote: > >> [...] > >> >The vector for these has been almost purely Microsoft Windows. > >> > >> I wonder. From the point of view of a MX host (as opposed to a > >> customer-facing smarthost), would TCP fingerprinting to identify the > >> OS and apply a weighting to the spam score be a viable technique? > > > >We have been doing that in our traffic shaping SMTP transport for a > >while now. We have found a 95% correlation between spam sources and > >Windows hosts. If you drill down to specific versions of Windows, the > >correlation is even higher. > > > >For _blocking_ connections (as opposed to, say, just slowing them > >down), you must combine host type with reputation information. > > > >Regards, > >Ken > > > >-- > >MailChannels: Reliable Email Delivery (TM) | http://mailchannels.com > > > >-- > >Suite 203, 910 Richards St. > >Vancouver, BC, V6B 3C1, Canada > >Direct: +1-604-729-1741 > > -- MailChannels: Reliable Email Delivery (TM) | http://mailchannels.com -- Suite 203, 910 Richards St. Vancouver, BC, V6B 3C1, Canada Direct: +1-604-729-1741

1 0

BGP Update Report
by cidr-report＠potaroo.net 11 Aug '06

11 Aug '06

BGP Update Report Interval: 29-Jul-06 -to- 10-Aug-06 (12 days) Observation Point: BGP Peering with AS4637 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS6147 21658 1.6% 79.9 -- Telefonica del Peru S.A.A. 2 - AS17974 19202 1.5% 47.1 -- TELKOMNET-AS2-AP PT TELEKOMUNIKASI INDONESIA 3 - AS39308 16871 1.3% 1054.4 -- ASK-AS Andishe Sabz Khazar Autonomous System 4 - AS30890 13172 1.0% 62.4 -- EVOLVA Evolva Telecom 5 - AS33783 11359 0.9% 107.2 -- EEPAD 6 - AS7018 10056 0.8% 6.6 -- ATT-INTERNET4 - AT&T WorldNet Services 7 - AS9121 10048 0.8% 60.2 -- TTNET TTnet Autonomous System 8 - AS16322 9902 0.8% 104.2 -- PARSONLINE PARSONLINE Autonomous System 9 - AS702 9389 0.7% 12.7 -- AS702 MCI EMEA - Commercial IP service provider in Europe 10 - AS8685 8461 0.6% 180.0 -- DORUKNET DorukNet Istanbul / Turkey 11 - AS701 8434 0.6% 8.7 -- ALTERNET-AS - UUNET Technologies, Inc. 12 - AS2018 7447 0.6% 55.2 -- TENET-1 13 - AS15464 7211 0.6% 300.5 -- IHLASNET IHLASNET Autonomous System 14 - AS4855 6921 0.5% 111.6 -- PI-ID-AS-AP Pacific Link Indonesia 15 - AS8386 6764 0.5% 211.4 -- KOCNET KOCNET-AS 16 - AS8708 6636 0.5% 30.4 -- RDSNET Romania Data Systems S.A. 17 - AS855 6461 0.5% 11.4 -- CANET-ASN-4 - Aliant Telecom 18 - AS174 6428 0.5% 2.9 -- COGENT Cogent/PSI 19 - AS23918 6302 0.5% 47.0 -- CBB-BGP-IBARAKI Connexion By Boeing Ibaraki AS 20 - AS15611 6266 0.5% 59.1 -- Iranian Research Organisation TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS21042 3099 0.2% 1549.5 -- GULFSAT-AS Gulfsat Autonomous System 2 - AS27407 1484 0.1% 1484.0 -- FRISCHS-INC - Frisch's Restaurants, Inc. 3 - AS7013 5694 0.4% 1423.5 -- NETSELECT - Health Sciences Libraries Consortium 4 - AS39308 16871 1.3% 1054.4 -- ASK-AS Andishe Sabz Khazar Autonomous System 5 - AS34378 799 0.1% 799.0 -- RUG-AS Razguliay-UKRROS Group 6 - AS14169 2772 0.2% 693.0 -- MEAD - MEAD CORPORATION 7 - AS15755 604 0.1% 604.0 -- ISPRO Autonomous System Izmir,TURKEY 8 - AS12408 548 0.0% 548.0 -- BIKENT-AS Bikent Ltd. Autonomous system 9 - AS35080 537 0.0% 537.0 -- OYAK-TELEKOM-AS Oyak Telekom Hizm. BGP AS 10 - AS34984 529 0.0% 529.0 -- BITEL-AS BILISIM TELEKOM 11 - AS14410 2609 0.2% 521.8 -- DALTON - MCM, Inc., DBA: Internet@Dalton 12 - AS8389 510 0.0% 510.0 -- STVOICE Sabanci Telekom A.S. 13 - AS3043 2760 0.2% 460.0 -- AMPHIB-AS - Amphibian Media Corporation 14 - AS26897 450 0.0% 450.0 -- INVISION-TECH - INVISION TECHNOLOGIES, INC. 15 - AS29666 441 0.0% 441.0 -- TRHENKEL Turk Henkel Kimya Sanayi 16 - AS39410 430 0.0% 430.0 -- TEDAS-AS Turkiye Elektrik Dagitim A.S. 17 - AS39080 392 0.0% 392.0 -- SIMETRI-AS SIMETRI YAZILIM 18 - AS39348 774 0.1% 387.0 -- TYACHIV-AS Initiativa Ltd. 19 - AS35474 345 0.0% 345.0 -- MGI-TR-AS MGI METRO Group 20 - AS29549 1352 0.1% 338.0 -- ZIRAATBANK-AS T.C. Ziraat Bankasi A.S. TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 208.28.80.0/21 2956 0.2% AS7013 -- NETSELECT - Health Sciences Libraries Consortium 2 - 209.140.24.0/24 2755 0.2% AS3043 -- AMPHIB-AS - Amphibian Media Corporation 3 - 159.124.160.0/19 2704 0.2% AS14169 -- MEAD - MEAD CORPORATION 4 - 208.0.225.0/24 2670 0.2% AS11139 -- CWRIN CW BARBADOS 5 - 208.1.152.0/21 2590 0.2% AS7013 -- NETSELECT - Health Sciences Libraries Consortium 6 - 206.251.163.0/24 2427 0.2% AS4314 -- I-55-INTERNET-SERVICES-INC - I-55 INTERNET SERVICES 7 - 209.160.56.0/22 1705 0.1% AS14361 -- HOPONE-DCA - HopOne Internet Corporation 8 - 41.204.96.0/24 1562 0.1% AS21042 -- GULFSAT-AS Gulfsat Autonomous System 9 - 41.204.127.0/24 1537 0.1% AS21042 -- GULFSAT-AS Gulfsat Autonomous System 10 - 66.117.207.0/24 1484 0.1% AS27407 -- FRISCHS-INC - Frisch's Restaurants, Inc. 11 - 202.125.147.0/24 1456 0.1% AS17557 -- PKTELECOM-AS-AP Pakistan Telecom 12 - 89.144.128.0/21 1445 0.1% AS39308 -- ASK-AS Andishe Sabz Khazar Autonomous System 13 - 143.81.0.0/21 1305 0.1% AS6034 -- DDN-ASNBLK - DoD Network Information Center 14 - 198.92.192.0/21 1281 0.1% AS16559 -- REALCONNECT-01 - RealConnect, Inc 15 - 89.144.134.0/24 1271 0.1% AS39308 -- ASK-AS Andishe Sabz Khazar Autonomous System 16 - 89.144.129.0/24 1256 0.1% AS39308 -- ASK-AS Andishe Sabz Khazar Autonomous System 17 - 89.144.130.0/24 1255 0.1% AS39308 -- ASK-AS Andishe Sabz Khazar Autonomous System 18 - 89.144.132.0/24 1255 0.1% AS39308 -- ASK-AS Andishe Sabz Khazar Autonomous System 19 - 89.144.128.0/24 1255 0.1% AS39308 -- ASK-AS Andishe Sabz Khazar Autonomous System 20 - 89.144.133.0/24 1255 0.1% AS39308 -- ASK-AS Andishe Sabz Khazar Autonomous System Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

The Cidr Report
by cidr-report＠potaroo.net 11 Aug '06

11 Aug '06

This report has been generated at Fri Aug 11 21:47:29 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 04-08-06 191781 125425 05-08-06 192161 125422 06-08-06 191969 125424 07-08-06 192032 125356 08-08-06 192051 125384 09-08-06 192156 125482 10-08-06 192348 125554 11-08-06 192373 125204 AS Summary 22758 Number of ASes in routing system 9515 Number of ASes announcing only one prefix 1469 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91537920 Largest address span announced by an AS (/32s) AS721 : DISA-ASNBLK - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 11Aug06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 192392 125566 66826 34.7% All ASes AS4134 1261 264 997 79.1% CHINANET-BACKBONE No.31,Jin-rong Street AS4755 960 72 888 92.5% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS18566 954 181 773 81.0% COVAD - Covad Communications Co. AS721 1003 316 687 68.5% DISA-ASNBLK - DoD Network Information Center AS4323 968 281 687 71.0% TWTC - Time Warner Telecom, Inc. AS22773 682 51 631 92.5% CCINET-2 - Suddenlink Communications AS9498 780 183 597 76.5% BBIL-AP BHARTI BT INTERNET LTD. AS6197 1016 490 526 51.8% BATI-ATL - BellSouth Network Solutions, Inc AS7018 1469 954 515 35.1% ATT-INTERNET4 - AT&T WorldNet Services AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS19262 681 184 497 73.0% VZGNI-TRANSIT - Verizon Internet Services Inc. AS855 568 88 480 84.5% CANET-ASN-4 - Aliant Telecom AS17488 520 41 479 92.1% HATHWAY-NET-AP Hathway IP Over Cable Internet AS11492 723 283 440 60.9% CABLEONE - CABLE ONE AS3602 526 106 420 79.8% AS3602-RTI - Rogers Telecom Inc. AS18101 436 27 409 93.8% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS15270 450 57 393 87.3% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS17676 491 111 380 77.4% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS812 416 42 374 89.9% ROGERS-CABLE - Rogers Cable Inc. AS22047 458 85 373 81.4% VTR BANDA ANCHA S.A. AS4766 669 306 363 54.3% KIXS-AS-KR Korea Telecom AS4812 412 59 353 85.7% CHINANET-SH-AP China Telecom (Group) AS6198 596 243 353 59.2% BATI-MIA - BellSouth Network Solutions, Inc AS6467 392 47 345 88.0% ESPIRECOMM - Xspedius Communications Co. AS9583 934 602 332 35.5% SIFY-AS-IN Sify Limited AS16852 362 52 310 85.6% FOCAL-CHICAGO - Focal Data Communications of Illinois AS8151 784 494 290 37.0% Uninet S.A. de C.V. AS16814 329 46 283 86.0% NSS S.A. AS6517 415 138 277 66.7% YIPESCOM - Yipes Communications, Inc. AS19115 362 93 269 74.3% CHARTER-LEBANON - Charter Communications Total 20180 5961 14219 70.5% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.163.96.0/20 AS25767 WAVEFORM - Waveform Technology, LLC 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 71.7.0.0/17 AS30160 IOWA-TELECOM - Iowa Telecom 87.76.0.0/16 AS39525 SPRITELINK SpriteLink Autonomous System 89.18.64.0/19 AS31458 SMARTTELECOM-AS Smart Telecom Autonomous System 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.192.0.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DISA-ASNBLK - DoD Network Information Center 132.0.0.0/10 AS721 DISA-ASNBLK - DoD Network Information Center 137.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 138.136.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 139.56.0.0/19 AS14956 BROADVISION-ASN - Broadvision Inc. 139.56.64.0/19 AS14956 BROADVISION-ASN - Broadvision Inc. 139.56.72.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS12582 TSF-DATANET-NGD-AS TSF MPLS VPN Services 192.69.107.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.108.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.177.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 SAIX-NET 192.96.37.0/24 AS10474 NETACTIVE 192.96.135.0/24 AS2018 TENET-1 192.96.136.0/23 AS2018 TENET-1 192.96.140.0/24 AS2018 TENET-1 192.96.143.0/24 AS2018 TENET-1 192.96.145.0/24 AS2018 TENET-1 192.96.177.0/24 AS6083 POSIX-AFRICA 192.96.250.0/24 AS2018 TENET-1 192.107.104.0/24 AS6458 Telgua 192.122.212.0/24 AS209 ASN-QWEST - Qwest 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.153.144.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 192.172.0.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 192.188.208.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.156.206.0/24 AS4589 EASYNET Easynet Group Plc 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.35.104.0/24 AS12445 SPIDERNET-AS Selene s.p.a. 196.6.108.0/24 AS5713 SAIX-NET 196.6.175.0/24 AS3741 IS 196.6.176.0/23 AS3741 IS 196.6.183.0/24 AS3741 IS 196.6.196.0/24 AS3741 IS 196.6.199.0/24 AS3741 IS 196.6.208.0/24 AS3741 IS 196.6.211.0/24 AS3741 IS 196.6.212.0/23 AS3741 IS 196.6.212.0/24 AS3741 IS 196.6.222.0/23 AS3741 IS 196.6.237.0/24 AS3741 IS 196.10.119.0/24 AS2018 TENET-1 196.10.122.0/23 AS2018 TENET-1 196.10.136.0/22 AS3741 IS 196.10.140.0/22 AS3741 IS 196.10.231.0/24 AS3741 IS 196.10.251.0/24 AS2018 TENET-1 196.10.252.0/23 AS2018 TENET-1 196.10.254.0/24 AS2018 TENET-1 196.11.0.0/20 AS3741 IS 196.11.40.0/21 AS3741 IS 196.11.135.0/24 AS3741 IS 196.11.188.0/23 AS3741 IS 196.11.190.0/24 AS3741 IS 196.11.251.0/24 AS3741 IS 196.13.101.0/24 AS2018 TENET-1 196.13.102.0/23 AS2018 TENET-1 196.13.104.0/24 AS2018 TENET-1 196.13.108.0/24 AS3741 IS 196.13.116.0/22 AS2018 TENET-1 196.13.121.0/24 AS2018 TENET-1 196.13.125.0/24 AS2018 TENET-1 196.13.126.0/24 AS2018 TENET-1 196.13.127.0/24 AS3741 IS 196.13.128.0/22 AS3741 IS 196.13.144.0/22 AS2905 TICSA-ASN 196.13.152.0/21 AS2905 TICSA-ASN 196.13.160.0/24 AS2905 TICSA-ASN 196.13.169.0/24 AS2018 TENET-1 196.13.174.0/23 AS2018 TENET-1 196.13.176.0/21 AS2018 TENET-1 196.13.188.0/22 AS2018 TENET-1 196.13.192.0/22 AS2018 TENET-1 196.13.196.0/24 AS2018 TENET-1 196.13.252.0/22 AS2018 TENET-1 196.98.17.0/24 AS1257 TELE2 AB 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET-1 198.54.92.0/24 AS2018 TENET-1 198.54.222.0/24 AS2018 TENET-1 198.54.249.0/24 AS2018 TENET-1 198.54.250.0/24 AS2018 TENET-1 198.54.251.0/24 AS2018 TENET-1 198.97.72.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.80.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.96.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.240.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.101.4.0/22 AS721 DISA-ASNBLK - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.199.198.0/24 AS13671 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.128.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.130.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.132.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.150.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.0.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.16.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.80.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 199.249.233.0/24 AS1239 SPRINTLINK - Sprint 199.249.234.0/24 AS1239 SPRINTLINK - Sprint 199.249.235.0/24 AS174 COGENT Cogent/PSI 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.9.224.0/19 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.224.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.225.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.226.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.227.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.228.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.230.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.232.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.233.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.236.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.237.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.238.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.240.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.241.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.242.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.243.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.251.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.9.252.0/24 AS7584 TCR-AS-AP TCR Holdings Limted. 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.94.65.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 202.94.70.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.94.74.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 202.94.75.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 202.94.77.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 202.94.83.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 202.94.85.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 202.94.87.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 202.94.95.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 202.124.192.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.193.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.194.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.196.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.197.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.198.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.199.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.200.0/22 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.204.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.205.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.206.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.207.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 202.137.224.0/24 AS9942 COMINDICO-AP COMindico Australia 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.160.146.0/24 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.160.152.0/22 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.160.158.0/23 AS9837 POWERTEL-AP Powertel Ltd 202.164.100.0/24 AS18101 RIL-IDC Reliance Infocom Ltd Internet Data Centre, 202.169.96.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 202.169.97.0/24 AS4802 ASN-IINET iiNet Limited 202.169.98.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 202.169.102.0/24 AS13700 CAPITAL-NETWORKS - Capital Networks Pty Ltd 202.182.128.0/24 AS9627 TCR-AP TCR Holdings Ltd 202.182.129.0/24 AS9627 TCR-AP TCR Holdings Ltd 202.182.130.0/24 AS9627 TCR-AP TCR Holdings Ltd 202.182.131.0/24 AS9519 BRAENET Braenet Pty Ltd 202.182.132.0/24 AS9627 TCR-AP TCR Holdings Ltd 202.182.133.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.182.134.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.182.135.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.182.136.0/24 AS9627 TCR-AP TCR Holdings Ltd 202.182.140.0/24 AS9627 TCR-AP TCR Holdings Ltd 202.182.144.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.182.145.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.182.146.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.182.147.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.182.157.0/24 AS9627 TCR-AP TCR Holdings Ltd 202.182.158.0/24 AS9627 TCR-AP TCR Holdings Ltd 202.182.159.0/24 AS9519 BRAENET Braenet Pty Ltd 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 204.48.58.0/24 AS4323 TWTC - Time Warner Telecom, Inc. 204.48.60.0/24 AS4323 TWTC - Time Warner Telecom, Inc. 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.153.104.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.153.106.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.153.107.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 209.159.128.0/19 AS209 ASN-QWEST - Qwest 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 221.121.128.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 221.121.129.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 221.121.130.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 221.121.131.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 221.121.132.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 221.121.133.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 221.121.157.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 221.121.158.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd 221.121.159.0/24 AS9723 ISEEK-AS-AP ISEEK Ltd Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0