- Test - lists.nanog.org

recommendations regarding IPS
by Hegger, Stefan 01 Apr '06

01 Apr '06

Hi, hope not bothering you but I'm looking for some experiences with IPS systems. There are several vendors but is there a recommandation or some tests? As Service provider we need a system which handles the scanning in hardware and it should work as a layer2 bridge (no IP). Stefan -- Stefan Hegger Lycos Europe GmbH Carl-Bertelsmann Str. 21 Postfach 315 33311 Guetersloh email:Stefan.Hegger@lycos-europe.com Tel: +49 5241 80 71334 FAX:+49 5241 80671334 Mob:+49 170 1892720

5 6

Re: recommendations regarding IPS
by Fergie 01 Apr '06

01 Apr '06

I sent a reply privately earlier to original request, about my own personal preferences, but Gadi's reply prompted me to respond publicly. :-) All-in-all, I find that an IDS (NFR-style) has a quite useful utility. Your choice of such a utility is, of ourse, another matter entirely. :-) - ferg -- Gadi Evron <ge(a)linuxbox.org> wrote: Edward W. Ray wrote: > Tipping Point IPS is the gold standard these days. Signature-based, which > annual fee to get the signatures. Signatures are usually weekly at a > minimum. I use the Unity 50, but they do have Gbps IPS. All of their IPSes > are "bump-in-the-wire" which means that you do not have to assign an address > (operates at layer2 instead of layer 3). Not to say anything about Edward, but this thread is going to be mostly full of commercial injections. Except for one network I have been in charge with I have never found the need for any I[DP]S product and find them an almost complete waste of time and money. Gadi. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: recommendations regarding IPS
by Fergie 01 Apr '06

01 Apr '06

Very. That (several sensors), and honeypots. You need to have tiered security posture... an IDS is not an 'end-all-be all' sort of thing -- it's just another tool. Personal experience and opinion, of course. :-) $.02, - ferg ps. I don't believe in 'self-defending' IPS autocracy stuff; you usually end up sepnding more time clearing auto traps as you do setting them up. :-) -- Gadi Evron <ge(a)linuxbox.org> wrote: Fergie wrote: Hi Ferg, :) > All-in-all, I find that an IDS (NFR-style) has a quite useful > utility. How is it useful for your network? -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Weekly Routing Table Report
by Routing Table Analysis 31 Mar '06

31 Mar '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 01 Apr, 2006 Analysis Summary ---------------- BGP routing table entries examined: 186219 Prefixes after maximum aggregation: 102731 Unique aggregates announced to Internet: 90330 Total ASes present in the Internet Routing Table: 21863 Origin-only ASes present in the Internet Routing Table: 19007 Origin ASes announcing only one prefix: 9047 Transit ASes present in the Internet Routing Table: 2856 Transit-only ASes present in the Internet Routing Table: 66 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 20 Prefixes from unregistered ASNs in the Routing Table: 6 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1499840864 Equivalent to 89 /8s, 101 /16s and 193 /24s Percentage of available address space announced: 40.5 Percentage of allocated address space announced: 59.7 Percentage of available address space allocated: 67.8 Total number of prefixes smaller than registry allocations: 91766 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 39000 Total APNIC prefixes after maximum aggregation: 16352 Prefixes being announced from the APNIC address blocks: 36703 Unique aggregates announced from the APNIC address blocks: 17853 APNIC Region origin ASes present in the Internet Routing Table: 2529 APNIC Region origin ASes announcing only one prefix: 718 APNIC Region transit ASes present in the Internet Routing Table: 389 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 219775456 Equivalent to 13 /8s, 25 /16s and 129 /24s Percentage of available APNIC address space announced: 68.7 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 97060 Total ARIN prefixes after maximum aggregation: 57257 Prefixes being announced from the ARIN address blocks: 76151 Unique aggregates announced from the ARIN address blocks: 29023 ARIN Region origin ASes present in the Internet Routing Table: 10614 ARIN Region origin ASes announcing only one prefix: 3969 ARIN Region transit ASes present in the Internet Routing Table: 975 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 19 Number of ARIN addresses announced to Internet: 293489920 Equivalent to 17 /8s, 126 /16s and 77 /24s Percentage of available ARIN address space announced: 72.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 36776 Total RIPE prefixes after maximum aggregation: 24644 Prefixes being announced from the RIPE address blocks: 33826 Unique aggregates announced from the RIPE address blocks: 22840 RIPE Region origin ASes present in the Internet Routing Table: 7823 RIPE Region origin ASes announcing only one prefix: 4094 RIPE Region transit ASes present in the Internet Routing Table: 1300 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 19 Number of RIPE addresses announced to Internet: 243039872 Equivalent to 14 /8s, 124 /16s and 126 /24s Percentage of available RIPE address space announced: 72.4 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 11300 Total LACNIC prefixes after maximum aggregation: 3596 Prefixes being announced from the LACNIC address blocks: 9453 Unique aggregates announced from the LACNIC address blocks: 5293 LACNIC Region origin ASes present in the Internet Routing Table: 682 LACNIC Region origin ASes announcing only one prefix: 221 LACNIC Region transit ASes present in the Internet Routing Table: 126 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 20 Number of LACNIC addresses announced to Internet: 26291712 Equivalent to 1 /8s, 145 /16s and 46 /24s Percentage of available LACNIC address space announced: 39.2 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2074 Total AfriNIC prefixes after maximum aggregation: 882 Prefixes being announced from the AfriNIC address blocks: 1404 Unique aggregates announced from the AfriNIC address blocks: 915 AfriNIC Region origin ASes present in the Internet Routing Table: 151 AfriNIC Region origin ASes announcing only one prefix: 45 AfriNIC Region transit ASes present in the Internet Routing Table: 25 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 3951872 Equivalent to 0 /8s, 60 /16s and 77 /24s Percentage of available AfriNIC address space announced: 11.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1010 6917 212 CHINANET-BACKBONE 4755 891 259 69 Videsh Sanchar Nigam Ltd. Aut 9583 874 109 16 Sify Limited 4766 679 3924 304 Korea Telecom (KIX) 1221 619 1555 473 Telstra Pty Ltd 9498 560 211 71 BHARTI BT INTERNET LTD. 7545 530 108 70 TPG Internet Pty Ltd 17488 513 31 7 Hathway IP Over Cable Interne 17676 484 6997 107 Softbank BB Corp. 9443 416 95 82 Primus Telecommunications 4802 376 91 171 Wantree Development 17974 337 90 38 PT TELEKOMUNIKASI INDONESIA 2907 336 1749 312 SINET Japan 18101 325 69 24 Reliance Infocom Ltd Internet 17557 321 27 165 Pakistan Telecom 17849 318 20 104 Telecommunications Technology 9929 316 218 54 China Netcom Corp. 7474 307 211 233 SingTel Optus Pty Ltd 4780 281 226 16 Digital United Inc. 9837 269 77 165 Powertel Ltd ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1510 6264 967 AT&T WorldNet Services 4323 1249 714 248 Time Warner Telecom 6197 1008 615 471 BellSouth Network Solutions, 721 1004 21962 306 DLA Systems Automation Center 174 958 5783 905 Cogent Communications 701 942 8049 779 UUNET Technologies, Inc. 18566 925 272 8 Covad Communications 2386 873 521 666 AT&T Data Communications Serv 1239 852 2804 602 Sprint 19029 784 152 112 New Edge Networks 209 700 3607 543 Qwest 20115 672 590 361 Charter Communications 19262 665 1968 156 Verizon Global Networks 22773 643 1480 40 Cox Communications, Inc. 11492 627 86 20 Cable One 7011 619 213 400 Citizens Utilities 852 585 1089 389 Telus Advanced Communications 6198 583 518 233 BellSouth Network Solutions, 19916 563 49 54 OLM LLC 855 546 244 64 Canadian Research Network RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 586 1951 459 UUNET - Commercial IP service 3301 308 1071 292 TeliaNet Sweden 3352 307 1564 31 Ibernet, Internet Access Netw 8220 287 473 266 COLT Telecommunications 3320 282 3478 234 Deutsche Telekom AG 680 245 2025 242 DFN-IP service G-WiN 6746 230 89 204 Dynamic Network Technologies, 3246 229 472 219 Song Networks 8708 215 275 200 Romania Data Systems S.A. 8551 203 198 24 Bezeq International 24863 200 40 9 LINKdotNET AS number 1257 198 711 173 SWIPnet Swedish IP Network 3269 197 2086 76 TELECOM ITALIA 3215 191 1598 89 France Telecom Transpac 9121 174 931 26 TTnet Autonomous System 786 171 1778 171 The JANET IP Service 8866 171 37 15 Bulgarian Telecommunication C 5400 168 329 137 BT Ignite European Backbone 6830 167 765 35 UPC Distribution Services 5515 161 839 120 Sonera Solution Autonomous Sy LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1268 1083 230 UniNet S.A. de C.V. 22047 386 142 10 VTR PUNTO NET S.A. 11172 319 110 82 Servicios Alestra S.A de C.V 16814 280 18 7 NSS, S.A. 14117 185 12 6 Telefonica del Sur S.A. 7303 159 75 20 Telecom Argentina Stet-France 6147 154 126 22 Telefonica Del Peru 11556 132 80 4 Cable-Wireless Panama 5639 127 12 9 Telecommunications Services o 19169 123 8 32 Telconet 21826 123 16 20 INTERCABLE 6503 122 149 75 AVANTEL, S.A. 10481 121 48 8 Prima S.A. 6505 106 88 78 Global One Communicaoes Ltda 23216 100 20 7 RAMtelecom Telecomunicaciones 18822 99 8 10 TELEFONICA MANQUEHUE 7315 96 6 3 Grupo Rey Moreno 25620 96 6 3 COTAS LTDA 4270 94 17 9 Red de Interconexion Universi 14522 94 13 5 SatNet S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 277 803 232 The Internet Solution 8452 167 60 7 TEDATA 6713 145 135 11 Itissalat Al-MAGHRIB 15475 131 84 4 Nile Online 2018 123 314 104 Tertiary Education Network 5536 121 8 18 Internet Egypt Network 24835 83 50 7 RAYA Telecom - Egypt 2905 74 155 67 The Internetworking Company o 20928 57 16 2 Noor Advanced Technologies AS 12455 46 6 3 Jambonet Autonomous system 5713 39 294 35 Telkom SA Ltd 15706 31 8 3 Sudatel Internet Exchange Aut 33774 30 7 21 AS Number for Telecom Algeria 23889 26 8 11 MAURITIUS TELECOM 8524 24 1 4 AUCEGYPT Autonomous System 16637 23 10 21 Johnnic e-Ventures 10798 22 1 13 Standard Bank of South Africa 8346 20 13 17 SONATEL-AS Autonomous System 21280 20 5 5 Swift Global Kenya Ltd.Is an 2561 19 6 2 Egyptian Universities Network Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 8151 1268 1038 UniNet S.A. de C.V. 4323 1249 1001 Time Warner Telecom 18566 925 917 Covad Communications 9583 874 858 Sify Limited 4755 891 822 Videsh Sanchar Nigam Ltd. Aut 4134 1010 798 CHINANET-BACKBONE 721 1004 698 DLA Systems Automation Center 19029 784 672 New Edge Networks 11492 627 607 Cable One 22773 643 603 Cox Communications, Inc. 6197 1008 537 BellSouth Network Solutions, 19262 665 509 Verizon Global Networks 19916 563 509 OLM LLC 17488 513 506 Hathway IP Over Cable Interne 5668 532 502 CenturyTel Internet Holdings, 9498 560 489 BHARTI BT INTERNET LTD. 855 546 482 Canadian Research Network 7545 530 460 TPG Internet Pty Ltd 7757 473 454 AT&T Broadband 3602 539 430 Sprint Canada, Inc. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 65289 PRIVATE 148.164.1.0/24 4755 Videsh Sanchar Nigam 65005 PRIVATE 159.153.148.0/22 24989 IX Europe Frankfurt 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com 24808 UNALLOCATED 217.78.74.0/23 12491 IPPlanet 24808 UNALLOCATED 217.78.76.0/23 12491 IPPlanet 65412 PRIVATE 221.123.128.0/20 24405 Beijing CJWX Communi Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 183.206.196.0/24 2188 FR-RENATER-ASTER 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:9 /10:8 /11:27 /12:88 /13:199 /14:357 /15:691 /16:8769 /17:3164 /18:5175 /19:11456 /20:12907 /21:11232 /22:14266 /23:15395 /24:101451 /25:343 /26:249 /27:217 /28:63 /29:68 /30:34 /31:0 /32:34 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 8151 910 1268 UniNet S.A. de C.V. 18566 908 925 Covad Communications 7018 802 1510 AT&T WorldNet Services 6197 797 1008 BellSouth Network Solutions, 19029 711 784 New Edge Networks 9583 695 874 Sify Limited 11492 618 627 Cable One 4323 603 1249 Time Warner Telecom 2386 597 873 AT&T Data Communications Serv 19916 557 563 OLM LLC 7011 531 619 Citizens Utilities 4766 488 679 Korea Telecom (KIX) 7757 455 473 AT&T Broadband 6198 440 583 BellSouth Network Solutions, 855 420 546 Canadian Research Network 5668 412 532 CenturyTel Internet Holdings, 1239 378 852 Sprint 702 367 586 UUNET - Commercial IP service 15270 364 394 PaeTec.net -a division of Pae 6517 348 378 Yipes Communications, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:38 12:1623 13:1 15:11 16:3 17:3 18:4 20:43 24:880 25:1 30:2 32:67 38:207 40:53 44:3 47:6 52:4 55:1 56:3 57:33 58:153 59:191 60:175 61:836 62:813 63:1925 64:3117 65:2235 66:3098 67:617 68:700 69:1431 70:315 71:82 72:656 73:23 74:28 80:756 81:613 82:544 83:371 84:373 85:505 86:341 87:276 88:51 89:111 124:196 125:281 128:161 129:177 130:108 131:319 132:33 133:8 134:150 135:47 136:177 137:69 138:199 139:75 140:468 141:134 142:393 143:160 144:229 145:40 146:320 147:133 148:342 149:190 150:114 151:80 152:65 153:107 154:6 155:196 156:99 157:120 158:166 159:170 160:86 161:69 162:252 163:145 164:179 165:181 166:166 167:242 168:480 169:134 170:327 171:12 172:1 183:1 190:51 192:5767 193:3402 194:2563 195:1794 196:806 198:3874 199:3253 200:4316 201:1330 202:6561 203:6901 204:3937 205:2085 206:2426 207:2930 208:2039 209:3724 210:1919 211:737 212:1250 213:1438 214:332 215:42 216:4088 217:1169 218:240 219:179 220:654 221:352 222:160 End of report

1 0

The Cidr Report
by cidr-report＠potaroo.net 31 Mar '06

31 Mar '06

This report has been generated at Fri Mar 31 21:48:55 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 25-03-06 181028 119484 26-03-06 181082 119580 26-03-06 181055 119436 27-03-06 180958 119546 28-03-06 181057 119597 29-03-06 181152 119695 30-03-06 181294 119765 31-03-06 181480 120229 AS Summary 21776 Number of ASes in routing system 9067 Number of ASes announcing only one prefix 1498 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91435520 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 31Mar06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 182353 120253 62100 34.1% All ASes AS4323 1246 252 994 79.8% TWTC - Time Warner Telecom, Inc. AS18566 925 9 916 99.0% COVAD - Covad Communications Co. AS4134 1005 275 730 72.6% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1008 311 697 69.1% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 640 48 592 92.5% CCINET-2 - Cox Communications Inc. AS7018 1498 967 531 35.4% ATT-INTERNET4 - AT&T WorldNet Services AS6197 1006 485 521 51.8% BATI-ATL - BellSouth Network Solutions, Inc AS8151 1266 745 521 41.2% Uninet S.A. de C.V. AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 546 64 482 88.3% CANET-ASN-4 - Aliant Telecom AS7757 473 19 454 96.0% CCCH-AS4 - Comcast Cable Communications Holdings, Inc AS17488 502 51 451 89.8% HATHWAY-NET-AP Hathway IP Over Cable Internet AS3602 540 109 431 79.8% AS3602-RTI - Rogers Telecom Inc. AS812 438 28 410 93.6% ROGERS-CABLE - Rogers Cable Inc. AS9498 563 155 408 72.5% BBIL-AP BHARTI BT INTERNET LTD. AS4755 735 329 406 55.2% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS17676 484 107 377 77.9% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS11492 627 275 352 56.1% CABLEONE - CABLE ONE AS15270 388 36 352 90.7% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS6198 583 239 344 59.0% BATI-MIA - BellSouth Network Solutions, Inc AS4766 644 304 340 52.8% KIXS-AS-KR Korea Telecom AS6467 388 49 339 87.4% ESPIRECOMM - Xspedius Communications Co. AS22047 386 72 314 81.3% VTR BANDA ANCHA S.A. AS18101 324 27 297 91.7% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS14654 302 14 288 95.4% WAYPORT - Wayport AS19262 619 339 280 45.2% VZGNI-TRANSIT - Verizon Internet Services Inc. AS6167 342 64 278 81.3% CELLCO-PART - Cellco Partnership AS3352 307 31 276 89.9% TELEFONICA-DATA-ESPANA Internet Access Network of TDE AS5668 531 256 275 51.8% AS-5668 - CenturyTel Internet Holdings, Inc. AS9583 877 612 265 30.2% SIFY-AS-IN Sify Limited Total 19756 6337 13419 67.9% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.90.128.0/20 AS6971 ESCH - Eschelon Telecommunications, Inc. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/19 AS33104 FUZION-COLO - FUZION COLO 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.31.151.0/24 AS26627 AS-PILOSOFT - Pilosoft, Inc. 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 162.168.200.0/24 AS3301 TELIANET-SWEDEN TeliaNet Sweden 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 183.206.196.0/24 AS2188 FR-RENATER-ASTER Reseau Regional ASTER 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.122.212.0/24 AS209 ASN-QWEST - Qwest 192.124.252.0/22 AS680 DFN-IP DFN-IP service X-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.168.255.255/32 AS4637 REACH Reach Network Border AS 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.93.116.0/22 AS24872 MAGNUS-AS Magnus ISP autonomous system 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS3542 ITSDN-U5 - DISA/UNRRA 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.45.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.74.32.0/19 AS9315 CWN-AS-AP Chomanan WorldNet Co., Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.29.185.0/24 AS7268 ATHENET - Athenet Internet Services 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

"Bad bgp identifier"
by Joe Maimon 31 Mar '06

31 Mar '06

4271 specifies that bgp identifier must be a valid unicast ip address So what is the larget 32 bit value expressed as a dotted quad that meets this requirement? Is it the last address in class c? class e? Can 255.x.x.x be used? Do all vendors implement this? I understand that draft-ietf-idr-bgp-identifier-06.txt does away with the above requirements. Is this something I should ask vendors if they will support it? Thanks, Joe

3 2

Rate-Limiting.
by Robert Sherrard 31 Mar '06

31 Mar '06

I've got a situation in which I'd like to rate limit a few servers that hang off of my 6590's... it appears that this can only be done on a layer 3 interface. These servers however aren't, they simply on a switch port / access. Aside from hard setting the l2 interface to 10mbit, can anyone think of another creative way to do this? Is one option moving these servers into a separate VLAN, then rate-limiting from there? Rob

2 4

Peering Issues with Global Crossing and SBC?
by Elijah Savage 31 Mar '06

31 Mar '06

All, I have well over 150 vpn customers but this past week I have had 7 customers ipsec tunnels constantly bouncing all day. The common ground for all 7 of these customers are traversing the SBC and Global Crossing links you see below, the ultimate common ground being 64.208.110.29. 9 151.164.191.134 16 msec 16 msec 16 msec 10 64.208.110.29 16 msec 16 msec 16 msec 9 151.164.40.49 16 msec 16 msec 16 msec 10 64.208.110.29 12 msec 20 msec 12 msec When tracing to these 7 customers all 7 hit one or the other of the trace's you see above. I have opened a ticket with SBC but no answer from them yet. All of the other customers have been very stable and of course non of the other customers traverse either of these links either. Anyone from Global Crossing or SBC that could contact me off list or lend a hand it would greatly appreciate it. Thank you -- ---------------------------------------------------------------------- Elijah Savage | AOL IM:layer3rules Senior Network Engineer | When it has to be switched or routed. http://www.digitalrage.org | The Information Technology News Center ----- http://www.digitalrage.org/?page_id=46 for pgp public key--------

1 0

Re: Have Yahoo! gone pink?
by Robert Bonomi 30 Mar '06

30 Mar '06

> Cc: nanog(a)nanog.org > Subject: Re: Have Yahoo! gone pink? > From: Valdis.Kletnieks(a)vt.edu > Date: Wed, 29 Mar 2006 16:55:23 -0500 > > > --==_Exmh_1143669323_3096P > Content-Type: text/plain; charset=us-ascii > > On Wed, 29 Mar 2006 21:28:26 GMT, Peter Corlett said: > > > Yahoo claim "After investigation, we have determined that this email message > > did not originate from the Yahoo! Mail system. > > Received: from EXCHG01-DUB.Europe.Search.Corpsys.P4pnet.net > (cluster01-dub.europe.search.corpsys.p4pnet.net [172.30.132.19]) > by mrout3.yahoo.com (8.13.4/8.13.4/y.out) with ESMTP id k2FIupeH049008; > Wed, 15 Mar 2006 10:56:52 -0800 (PST) > > Hey, what do you know... if you trust both uksolutions.net and yahoo.com's > Received: lines, it didn't originate at Yahoo - it came from p4pnet.net. ;) > > (A fine demonstration of the difference between being truthful and being helpful :) Of course, this ignores the fact that '172.30.132.19' is in RFC-1918 space. <wry grin> Now _how_ 'mrout3.yahoo.com' got that message *is* open for speculation. Even more interesting is how it got DNS name resolution on that address. Best available evidence indicates that _that_ header line is a total fabrication. As I recall, the header added by the destination system showed receipt from a yahoo machine (and a valid IP address, belonging to yahoo). It's possible that yahoo's auto-parsing got misled by the bogus header shown above. > > --==_Exmh_1143669323_3096P > Content-Type: application/pgp-signature > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2.2 (GNU/Linux) > Comment: Exmh version 2.5 07/13/2001 > > iD8DBQFEKwJLcC3lWbTT17ARAhcbAKDYpN/L2fVwYu9w2E4jG1P+knnPFwCdEliY > YSY/cunFfCJoJ8zky9YhYP8= > =qdCE > -----END PGP SIGNATURE----- > > --==_Exmh_1143669323_3096P-- >

2 1

Have Yahoo! gone pink?
by abuse＠cabal.org.uk 30 Mar '06

30 Mar '06

[I'm wearing my personal hat here.] I'm getting a *flood* of spam coming in from Yahoo! mailservers, both to my personal and work addresses. It seems that Yahoo! don't care. Here's the response to me piping a sample one through Spamcop: http://abuse.mooli.org.uk/yahoospam Yahoo claim "After investigation, we have determined that this email message did not originate from the Yahoo! Mail system. It appears that the sender of this message forged the header information to give the impression that it came from the Yahoo! Mail system." The spam headers claim otherwise: Received: from mrout3.yahoo.com ([216.145.54.173]) by relay-1.mail.uksolutions.net with esmtp (Exim 4.50) id 1FJbCW-0002Ag-IV for sales(a)uksolutions.co.uk; Wed, 15 Mar 2006 18:58:29 +0000 As does DNS and whois: abuse@mooli:~$ host 216.145.54.173 173.54.145.216.in-addr.arpa domain name pointer mrout3.yahoo.com. abuse@mooli:~$ host mrout3.yahoo.com mrout3.yahoo.com has address 216.145.54.173 abuse@mooli:~$ whois 216.145.54.173 OrgName: Yahoo! Inc. OrgID: YAHOOI-2 Address: 701 First Avenue City: Sunnyvale StateProv: CA PostalCode: 94089 Country: US [etc] Doing double-DNS lookups of the IP addresses on other spams also give yahoo.com hostnames, and they're typically in DNSBLs for being sources of spam and a useless abuse address. So, which IP blocks shall I null-route then? Or is there anybody here from Yahoo! with a clue? (OK, you can all stop laughing now.) -- PGP key ID E85DC776 - finger abuse(a)mooli.org.uk for full key

5 4