- Test - lists.nanog.org

The Cidr Report
by cidr-report＠potaroo.net 21 Apr '06

21 Apr '06

This report has been generated at Fri Apr 21 21:48:06 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 14-04-06 182852 120413 15-04-06 182821 120427 16-04-06 182885 120468 17-04-06 182923 120429 18-04-06 182914 120565 19-04-06 183166 120479 20-04-06 183035 120600 21-04-06 183285 120840 AS Summary 21893 Number of ASes in routing system 9103 Number of ASes announcing only one prefix 1497 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91439872 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 21Apr06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 183351 120836 62515 34.1% All ASes AS4323 1260 256 1004 79.7% TWTC - Time Warner Telecom, Inc. AS18566 935 186 749 80.1% COVAD - Covad Communications Co. AS4134 1064 320 744 69.9% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1008 311 697 69.1% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 645 48 597 92.6% CCINET-2 - Cox Communications Inc. AS6197 1010 483 527 52.2% BATI-ATL - BellSouth Network Solutions, Inc AS7018 1497 980 517 34.5% ATT-INTERNET4 - AT&T WorldNet Services AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 553 63 490 88.6% CANET-ASN-4 - Aliant Telecom AS7757 477 19 458 96.0% CCCH-AS4 - Comcast Cable Communications Holdings, Inc AS17488 501 50 451 90.0% HATHWAY-NET-AP Hathway IP Over Cable Internet AS4755 766 337 429 56.0% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS3602 537 109 428 79.7% AS3602-RTI - Rogers Telecom Inc. AS9498 572 156 416 72.7% BBIL-AP BHARTI BT INTERNET LTD. AS17676 484 107 377 77.9% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS15270 398 39 359 90.2% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS11492 627 275 352 56.1% CABLEONE - CABLE ONE AS6198 591 242 349 59.1% BATI-MIA - BellSouth Network Solutions, Inc AS812 371 28 343 92.5% ROGERS-CABLE - Rogers Cable Inc. AS4766 650 307 343 52.8% KIXS-AS-KR Korea Telecom AS6467 374 47 327 87.4% ESPIRECOMM - Xspedius Communications Co. AS22047 400 81 319 79.8% VTR BANDA ANCHA S.A. AS18101 340 22 318 93.5% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS19262 631 313 318 50.4% VZGNI-TRANSIT - Verizon Internet Services Inc. AS6167 342 64 278 81.3% CELLCO-PART - Cellco Partnership AS3352 309 32 277 89.6% TELEFONICA-DATA-ESPANA Internet Access Network of TDE AS5668 534 257 277 51.9% AS-5668 - CenturyTel Internet Holdings, Inc. AS14654 290 14 276 95.2% WAYPORT - Wayport AS16814 313 45 268 85.6% NSS S.A. AS19115 346 83 263 76.0% CHARTER-LEBANON - Charter Communications Total 18388 5339 13049 71.0% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.90.128.0/20 AS6971 ESCH - Eschelon Telecommunications, Inc. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.163.96.0/20 AS25767 WAVEFORM - Waveform Technology, LLC 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.31.151.0/24 AS26627 AS-PILOSOFT - Pilosoft, Inc. 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 89.186.160.0/19 AS16245 NGDC NetGroup DataCenter A/S - ngdc.net 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 183.206.196.0/24 AS2188 FR-RENATER-ASTER Reseau Regional ASTER 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.69.107.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.108.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.177.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.122.212.0/24 AS209 ASN-QWEST - Qwest 192.124.252.0/22 AS680 DFN-IP DFN-IP service X-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.168.255.255/32 AS4637 REACH Reach Network Border AS 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.50.177.0/24 AS31669 ITSS-AS IT - SOLID SOLUTIONS 194.50.178.0/24 AS13030 INIT7 Init Seven AG, Zurich, Switzerland 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.246.216.0/22 AS15622 MEOCOM old meocom Autonomous System 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.199.198.0/24 AS13671 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS3542 ITSDN-U5 - DISA/UNRRA 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.45.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.74.32.0/19 AS9315 CWN-AS-AP Chomanan WorldNet Co., Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 204.29.185.0/24 AS7268 ATHENET - Athenet Internet Services 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Tools for LARTing large nets of compromised boxen?
by Michael Loftis 20 Apr '06

20 Apr '06

One of our customers is (has been) under concerted attempt at a DDoS attack against their web server off and on for a while. I've lists of IPs, lots of them, many hundreds. I'd like to know if anyone has a tool that will take and match these lists of IPs into abuse contacts and fire off a LART to the appropriate RP for the IP, but only one per full set, IE if RP-A has IP A.B.C.D and A.B.C.C he should get one mail clue-batting him for both IPs. Any help? TIA! -- "Genius might be described as a supreme capacity for getting its possessors into trouble of all kinds." -- Samuel Butler

2 3

Network Tool recomendations
by Mike Flanagan 20 Apr '06

20 Apr '06

Hello all, If anyone has any recommendations for different tools for operations, configuration management, capacity management and trending .. etc. Preferably vendor neutral tools that can work across different router vendor platforms. Thanks,

2 1

Re: data center space
by Martin Hannigan 20 Apr '06

20 Apr '06

At 11:06 AM 4/19/2006, jim bartus wrote: >They claim to be full too, at least from a power perspective. They >won't run us more power until the city council aproves them running >more power to the building. > >-jim There are likely to be sub leases available from tenants in existing. desirable, colocation and a good way to find them is via brokers. Be aware of a few things that have recently transpired. On many of the public colo houses earnings calls, they told analysts that they are trying to keep contracts to one year so they can raise prices year over year, that power pricing is fluid and many facilities are being expanded both space and environmental, that most locations really are full or being held down by lack of cooling for existing dense rack space. Basically get ready to hold out your wallet. I'd try Internap as a last resort (but a great one). Internap presence is not always facilities based (they own) but they tend to take inventory in good colo, place PNAP's, and sublet adjoining cabinets as Internap space. The catch is that if the facility is out of power, Internap is subjected to the same issues by default. I'm suggesting Internap because they have a good footprint and there's bound to be something somewhere. -M< -- Martin Hannigan (c) 617-388-2663 Renesys Corporation (w) 617-395-8574 Member of Technical Staff Network Operations hannigan(a)renesys.com

4 4

UltraDNS -> Neustar (xoxoxo)
by Martin Hannigan 20 Apr '06

20 Apr '06

Hello Neustar: http://www.tradingmarkets.com/tm.site/news/BREAKING%20NEWS/227044/ -M< -- Martin Hannigan (c) 617-388-2663 Renesys Corporation (w) 617-395-8574 Member of Technical Staff Network Operations hannigan(a)renesys.com

1 0

Cisco Security Advisory: Cisco IOS XR MPLS Vulnerabilities
by Cisco Systems Product Security Incident Response Team 19 Apr '06

19 Apr '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS XR MPLS Vulnerabilities Advisory ID: cisco-sa-20060419-xr http://www.cisco.com/warp/public/707/cisco-sa-20060419-xr.shtml Revision 1.0 For Public Release 2006 April 19 1500 UTC (GMT) - --------------------------------------------------------------------- Contents ======== Summary Affected Products Details Impact Software Version and Fixes Workarounds Obtaining Fixed Software Exploitation and Public Announcements Status of this Notice: FINAL Distribution Revision History Cisco Security Procedures - --------------------------------------------------------------------- Summary ======= Multiple Multi Protocol Label Switching (MPLS) related vulnerabilities exist on Cisco IOS XR. Only systems that are running Cisco IOS XR and configured for MPLS are affected by these vulnerabilities. Upon successful exploitation a Modular Services Card (MSC) on a Cisco Carrier Routing System 1 (CRS-1) or a Line Card (LC) on a Cisco 12000 series router may reload affecting switched traffic. Cisco has made free software available to address this vulnerability for affected customers. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20060419-xr.shtml. Affected Products ================= Vulnerable Products +------------------ Only systems that are running Cisco IOS XR and configured for MPLS are affected by this vulnerability. Systems that are running Cisco IOS XR and configured for MPLS can be identified by the show mpls interfaces command. A sample output of this command on a CRS-1 that is configured for MPLS is given below. RP/0/RP1/CPU0:crs1#show mpls interfaces Interface LDP Tunnel Enabled -------------------------- -------- -------- -------- POS0/2/0/0 Yes Yes Yes POS0/2/0/1 No Yes Yes POS0/2/0/2 Yes No Yes POS0/2/0/3 Yes Yes Yes GigabitEthernet0/3/1/0 Yes No Yes GigabitEthernet0/3/1/3 Yes No Yes POS0/3/0/1 Yes Yes Yes TenGigE0/6/0/0 Yes No Yes RP/0/RP1/CPU0:crs# In the above output, the fourth column labeled Enabled identifies MPLS enabled interfaces. Products Confirmed Not Vulnerable +-------------------------------- Cisco IOS XR only runs on CRS-1 or Cisco 12000 series routers. Other Cisco products, including systems that run Cisco IOS are not affected. Details ======= Cisco IOS XR Software is a member of the Cisco IOS Software Family that uses a microkernel based distributed operating system infrastructure. Cisco IOS XR runs both on Cisco CRS-1 and Cisco 12000 series routers. More information on Cisco IOS XR can be found at the following URL: http://www.cisco.com/en/US/products/ps5845/index.html Modular Services Cards (MSC), also called the line cards are Layer-3 forwarding engines on Cisco CRS-1. An MSC is paired with a physical layer interface module (PLIM) which provides layer-1 and layer-2 services. More information on Cisco CRS-1 architecture can be found at the following URL: http://www.cisco.com/en/US/products/ps5763/index.html Specific MPLS packets that are switched by a Cisco CRS-1 or a 12000 series system will restart the NetIO process. If the NetIO process is restarted several times consecutively, the line card will reload causing a Denial of Service (DoS) condition for the traffic that is being switched on that line card. MPLS packets will be forwarded through the MPLS network. Therefore, packets that can trigger this vulnerability can be sent from remote systems that are in the MPLS network. Such packets can not be received on interfaces that are not configured for MPLS. This vulnerability is addressed by the following Cisco bug IDs: * CSCsd15970 -- MSC crash upon receipt of specific MPLS packets This bug only affects CRS-1 and does not affect Cisco 12000 series routers that are running Cisco IOS XR. * CSCsd55531 -- MPLS packet handling problems This bug only affects CRS-1 and does not affect Cisco 12000 series routers that are running Cisco IOS XR. * CSCsc77475 -- Line card crash upon receipt of specific MPLS packets This bug affects both CRS-1 and Cisco 12000 series routers that are running Cisco IOS XR. Impact ====== Successful exploitation of the vulnerability may result in a reload of the Modular Services Card (MSC) on a CRS-1 or the line cards on a Cisco 12000 series router. Repeated exploitation could result in a sustained DoS attack. Software Version and Fixes ========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance. +---------------------------------------+ | Cisco IOS XR | SMU ID | | Version | | |---------------+-----------------------| | 3.2.0 | AA01447 | |---------------+-----------------------| | 3.2.1 | AA01446 | |---------------+-----------------------| | 3.2.2 | AA01448 | |---------------+-----------------------| | 3.2.3 for | AA01444 | | CRS-1 | | |---------------+-----------------------| | 3.2.3 for PRP | AA01451 | |---------------+-----------------------| | 3.2.4 | AA01449 | |---------------+-----------------------| | 3.2.50 | AA01450 | |---------------+-----------------------| | 3.3 | Cisco IOS XR 3.3 is | | | not vulnerable | +---------------------------------------+ Workarounds =========== There is no workaround to mitigate the effects of these vulnerabilities. Obtaining Fixed Software ======================== Cisco will make free software available to address this vulnerability for affected customers. This advisory will be updated as fixed software becomes available. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html , or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com . Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was reported to Cisco by a customer. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20060419-xr.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2006-April-19 | public | | | | release. | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFERlGr8NUAbBmDaxQRAppAAJ42LNGn372gHS9SfYlEN6jpBbmzGgCggNEj PP87m68j7oZ0Lf+Hk8aYM7k= =WdI4 -----END PGP SIGNATURE-----

1 0

RE: Determine difference between 2 BGP feeds
by Mike Walter 19 Apr '06

19 Apr '06

Sounds to me like one of your providers is not feeding you the full internet routing table. Have you checked with them to see if they are providing you that? Mike Walter Systems Administrator -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Scott "Tuc" Ellentuch at T-B-O-H Sent: Tuesday, April 18, 2006 4:13 PM To: nanog(a)merit.edu Subject: Determine difference between 2 BGP feeds Hi, We receive a BGP feed from different providers on two different routers. While one seems to be a reasonable amount of feeds after reviewing the CIDR report, the other is anywhere from 3K to 10K more routes. Is there a utility that I can use that will pull the routes off each router (Foundry preferred), and then compare them as best it can to see why there is such a difference? I can understand a handful of routes over what CIDR says, but a minimum of 3K more? Thanks, Tuc/TBOH

4 3

Determine difference between 2 BGP feeds
by Scott Tuc Ellentuch at T-B-O-H 18 Apr '06

18 Apr '06

Hi, We receive a BGP feed from different providers on two different routers. While one seems to be a reasonable amount of feeds after reviewing the CIDR report, the other is anywhere from 3K to 10K more routes. Is there a utility that I can use that will pull the routes off each router (Foundry preferred), and then compare them as best it can to see why there is such a difference? I can understand a handful of routes over what CIDR says, but a minimum of 3K more? Thanks, Tuc/TBOH

7 9

RE: Determine difference between 2 BGP feeds
by Lasher, Donn 18 Apr '06

18 Apr '06

On Apr 18, Scott Tuc Ellentuch at T-B-O-H <ml(a)t-b-o-h.net> wrote: > Is there a utility that I can use that will pull the routes off each > router (Foundry preferred), and then compare them as best it can to > see why there is such a difference? I have one, but it's cisco-specific: > http://www.bofh.it/~md/software/cisco-tools-0.2.tgz (the dumppeers script) Actually, found here: http://www.linux.it/~md/software/cisco-tools-0.2.tgz

1 0

RIPE @ Istanbul , Turkey
by Mehmet Akcin 18 Apr '06

18 Apr '06

Dear Nanogers, If you will be attending to RIPE Meeting @ Istanbul Next week, it would be really cool to meet with you and go around (I am going to be in the meeting) actually I am not living in Turkey, but I was born and raised there so, I can help you guys to go around, etc. I Know many EU folks read here so if you need help, let me know. Mehmet Akcin

1 0