- Test - lists.nanog.org

Current Blackworm numbers
by Fergie 28 Jan '06

28 Jan '06

Given all the noise that this issue has caused on the list, I thought I'd take a moment this afternoon and forward a URL that good folks over at LURHQ have made available with more realistic, and current, statistics on the BlackWorm cruft: http://www.lurhq.com/blackworm-stats.html Thanks to Joe Stewart at LURHQ. Cheers, - ferg -- Martin Hannigan <hannigan(a)world.std.com> wrote: [snip] The point I was trying to make before the thread went, East?, was that there is a perceived problem in the security community with approrpriate response. I'd tell you how I think that could have been avoided, but then my name would go up in the subject again. *cough full disclosure* [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

LimeLigh random Friday afternoon renumbering, anyone?
by Mike Lyon 28 Jan '06

28 Jan '06

Anyone else have LimeLight randomly decide to renumber their IP blocks on Friday afternoon without any heads up to anyone? Just curious to see who else had their connectivity go down because of it... Yay! -Mike

1 0

Re: So -- what did happen to Panix?
by sandy＠tislabs.com 27 Jan '06

27 Jan '06

Todd Underwood wrote: >you're probably right (as usual). but it seems that if you delay >acceptance of announcements with novel origination patterns, you don't >harm very many legitimate uses. in particular, ASes changing >upstreams won't be harmed at all. people moving their prefix to a new >ISP will have a fixed delay in getting their announcement propagated, >sure. but they already have this delay now. >they tell the new ISP: 'announce my prefix' and the new ISP says >'prove it's yours'. they do that for a couple of emails. then the >new ISP asks it's upstreams to accept that announcement. that takes a >little while (ranging from 4 to 72 hours in my recent experience). This is great for the planned changes, but real-time changes to respond to Internet dynamics won't work well with such delays. If you are multi-homed to provide a backup, you would like for it to respond more quickly than 4-72 hours, I'll bet. So if you have PI space but not your own AS, your backup route would look like a novel origination, but you sure wouldn't want it delayed. How common are such cases? Should the solutions cover them also? Should there be special procedures to deal with special cases? Etc. --Sandy

2 1

Wifi SIP WPA/PSK Support
by Mike Leber 27 Jan '06

27 Jan '06

I'm working on finding a Wifi SIP phone that supports WPA/PSK that we can recommended to VOIP clients. As everybody knows, currently most Wifi SIP phones support WEP which is demonstrably insecure. For banking and financial customers, or companies that are given passwords or credit cards over the phone, this is a serious security issue. We recently bought a Hitachi-Cable Wireless IPC-5000 WiFi SIP Phone from voipsupply.com after finding some web pages that said that phone supported WPA (the pages were in German), yet once we got the phone all it supported was WEP even after updating the firmware to the latest version using the website mentioned in the documentation that came with the phone. I've had a few people say that there was some sort of conspiracy to keep US citizens from using secure phones, however I found that laughable because the potential risk of terrorist or criminal interception from having all Wifi telephone conversations involving credit cards (let alone social security numbers, bank account numbers, passwords, what have you) in the clear would create an attack vector so large as to exceed all other possible attack vectors... I mean why work on cracking anything when you can just listen to everybody in the clear (well virtually in the clear with WEP). So, back in reality, could anybody in the US that bought their Wifi SIP phone in the US share a success story at getting Wifi SIP setup with WPA/PSK? What model of phone did you buy? Where did you get it? Did you have to upgrade it to any special version of firmware or what? Mike. +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +-----------------------------------------------------------------------+

4 4

Re: So -- what did happen to Panix?
by sandy＠tislabs.com 27 Jan '06

27 Jan '06

Michael.Dillon wrote: >Writing RFCs is a fine way to document operational >best practices, but it is not a good way to work out >joint operational practices. >Seems to me that operational problem solving works >better when the problem is not thrown into the laps >of the protocol designers. If the solution turns out to be joint operational practice, then operators need to be involved, natch. If the solution turns out to be protocols, then the protocol designers need to be involved along with the operators. I'm not so certain that operational practices will fix this problem - it could be argued that the fundamental vulnerabilites in the way routing info is communicated would be better fixed in the protocol. --Sandy

1 0

Re: So -- what did happen to Panix?
by sandy＠tislabs.com 27 Jan '06

27 Jan '06

Michael.Dillon wrote: >-certified prefix ownership >-certified AS path ownership >-dynamic changes to the above two items There is, as Joe Abley mentioned, a definition of authorization in routing registries. But the definition of "certified" still becomes problematic/controverial at times. crypt-pw? pgpkey? X.509 certs? singly rooted PKI? etc. Another problem is the scope of "dynamic" - would daily changes to the IRR database from which you construct a filter list nightly satisfy as being "dynamic" enough? --Sandy

1 0

Re: So -- what did happen to Panix?
by sandy＠tislabs.com 27 Jan '06

27 Jan '06

Todd Underwood wrote: >> seems to me that certified validation of prefix ownership and as >> path are the only real way out of these problems that does not >> teach us the 42 reasons we use a *dynamic* protocol. >certified validation of prefix ownership (and path, as has been >pointed out) would be great. it's clearly a laudable goal and seemed >like the right way to go. but right now, no one is doing it. the >rfcs that's i've found have all expired. and the conversation about >it has reached the point where people seem to have stopped even >disagreeing about how to do it. in short, it's as dead as dns-sec. >so what are we do do in the meantime? (a) I'd hardly say dead - there's the sidr work starting up in the IETF with vendor/operator/registry participation. And there was a panel discussion at the last NANOG about government efforts to assemble the right people (vendors/operators/registries/etc) to work on routing infrastructure security - and prefix origination was one of the biggest item on everyone's list of goals/hopes/longings/dreams. (Truth in advertising: I've been one of those involved in the gov't sponsored workshops.) (b) dnssec isn't dead - there's serious work afoot to get it deployed. Sweden and RIPE have signed their zones. There are web sites that point to work going on, if you'd like to know more: www.dnssec-deployment.org www.dnssec.net (Truth in advertising: I work with people who are working on this.) (z) I think you mean internet drafts, not rfcs. I don't think there have been any rfcs (would there were - we'd be in a different situation), and rfcs don't expire. --Sandy

1 0

Weekly Routing Table Report
by Routing Table Analysis 27 Jan '06

27 Jan '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 28 Jan, 2006 Analysis Summary ---------------- BGP routing table entries examined: 180021 Prefixes after maximum aggregation: 100565 Unique aggregates announced to Internet: 87510 Total ASes present in the Internet Routing Table: 21387 Origin-only ASes present in the Internet Routing Table: 18586 Origin ASes announcing only one prefix: 8813 Transit ASes present in the Internet Routing Table: 2801 Transit-only ASes present in the Internet Routing Table: 75 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 22 Prefixes from unregistered ASNs in the Routing Table: 1 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1484762656 Equivalent to 88 /8s, 127 /16s and 174 /24s Percentage of available address space announced: 40.1 Percentage of allocated address space announced: 59.1 Percentage of available address space allocated: 67.8 Total number of prefixes smaller than registry allocations: 87277 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 37717 Total APNIC prefixes after maximum aggregation: 15944 Prefixes being announced from the APNIC address blocks: 35495 Unique aggregates announced from the APNIC address blocks: 17347 APNIC Region origin ASes present in the Internet Routing Table: 2466 APNIC Region origin ASes announcing only one prefix: 695 APNIC Region transit ASes present in the Internet Routing Table: 382 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 21 Number of APNIC addresses announced to Internet: 211573472 Equivalent to 12 /8s, 156 /16s and 90 /24s Percentage of available APNIC address space announced: 66.2 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 94801 Total ARIN prefixes after maximum aggregation: 56437 Prefixes being announced from the ARIN address blocks: 74122 Unique aggregates announced from the ARIN address blocks: 28259 ARIN Region origin ASes present in the Internet Routing Table: 10473 ARIN Region origin ASes announcing only one prefix: 3903 ARIN Region transit ASes present in the Internet Routing Table: 976 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 284486400 Equivalent to 16 /8s, 244 /16s and 235 /24s Percentage of available ARIN address space announced: 70.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 35370 Total RIPE prefixes after maximum aggregation: 23868 Prefixes being announced from the RIPE address blocks: 32378 Unique aggregates announced from the RIPE address blocks: 21748 RIPE Region origin ASes present in the Internet Routing Table: 7566 RIPE Region origin ASes announcing only one prefix: 3956 RIPE Region transit ASes present in the Internet Routing Table: 1252 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 19 Number of RIPE addresses announced to Internet: 230579840 Equivalent to 13 /8s, 190 /16s and 94 /24s Percentage of available RIPE address space announced: 68.7 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 10268 Total LACNIC prefixes after maximum aggregation: 3448 Prefixes being announced from the LACNIC address blocks: 8450 Unique aggregates announced from the LACNIC address blocks: 5051 LACNIC Region origin ASes present in the Internet Routing Table: 662 LACNIC Region origin ASes announcing only one prefix: 215 LACNIC Region transit ASes present in the Internet Routing Table: 122 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 22 Number of LACNIC addresses announced to Internet: 24582400 Equivalent to 1 /8s, 119 /16s and 25 /24s Percentage of available LACNIC address space announced: 36.6 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1858 Total AfriNIC prefixes after maximum aggregation: 868 Prefixes being announced from the AfriNIC address blocks: 1223 Unique aggregates announced from the AfriNIC address blocks: 864 AfriNIC Region origin ASes present in the Internet Routing Table: 145 AfriNIC Region origin ASes announcing only one prefix: 44 AfriNIC Region transit ASes present in the Internet Routing Table: 26 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 3039488 Equivalent to 0 /8s, 46 /16s and 97 /24s Percentage of available AfriNIC address space announced: 9.1 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 982 6462 204 CHINANET-BACKBONE 9583 848 109 15 Sify Limited 4755 793 258 63 Videsh Sanchar Nigam Ltd. Aut 4766 720 3930 304 Korea Telecom (KIX) 1221 669 1428 476 Telstra Pty Ltd 7545 515 108 69 TPG Internet Pty Ltd 9498 512 211 69 BHARTI BT INTERNET LTD. 17676 480 6949 104 Softbank BB Corp. 17488 435 26 9 Hathway IP Over Cable Interne 9443 411 94 85 Primus Telecommunications 4802 366 75 159 Wantree Development 2907 338 1763 315 SINET Japan 9929 335 218 50 China Netcom Corp. 7474 330 227 228 SingTel Optus Pty Ltd 18101 330 68 23 Reliance Infocom Ltd Internet 17557 312 25 161 Pakistan Telecom 4780 282 226 16 Digital United Inc. 17974 272 77 37 PT TELEKOMUNIKASI INDONESIA 9837 271 78 169 Powertel Ltd 9800 259 410 67 CHINA UNICOM ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1472 6248 956 AT&T WorldNet Services 4323 1208 724 236 Time Warner Telecom 174 1036 5791 947 Cogent Communications 721 1026 21938 308 DLA Systems Automation Center 6197 984 593 475 BellSouth Network Solutions, 701 960 8083 803 UUNET Technologies, Inc. 18566 896 272 8 Covad Communications 2386 883 501 691 AT&T Data Communications Serv 1239 848 2792 601 Sprint 20115 668 545 348 Charter Communications 209 663 3604 529 Qwest 6198 635 449 238 BellSouth Network Solutions, 11492 632 89 12 Cable One 22773 611 1478 33 Cox Communications, Inc. 19262 604 1743 146 Verizon Global Networks 852 570 1092 379 Telus Advanced Communications 19916 563 49 54 OLM LLC 855 559 242 59 Canadian Research Network 6478 537 1517 298 AT&T Worldnet Services 3602 522 127 106 Sprint Canada, Inc. RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 587 1954 463 UUNET - Commercial IP service 3301 303 1071 289 TeliaNet Sweden 3352 303 1500 34 Ibernet, Internet Access Netw 3320 281 3485 235 Deutsche Telekom AG 8220 275 474 269 COLT Telecommunications 680 248 2025 239 DFN-IP service G-WiN 3246 229 487 219 Song Networks 8708 223 275 207 Romania Data Systems S.A. 6746 218 85 188 Dynamic Network Technologies, 1257 195 712 173 SWIPnet Swedish IP Network 3269 185 1925 70 TELECOM ITALIA 5515 180 840 127 Sonera Solution Autonomous Sy 786 174 1795 174 The JANET IP Service 8866 172 37 13 Bulgarian Telecommunication C 24863 168 38 9 LINKdotNET AS number 3215 167 1366 81 France Telecom Transpac 5400 166 328 136 BT Ignite European Backbone 3300 164 170 93 AUCS Communications Services 6830 159 669 33 UPC Distribution Services 12479 157 322 5 Uni2 Autonomous System LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 561 1048 215 UniNet S.A. de C.V. 22047 379 141 44 VTR PUNTO NET S.A. 11172 302 110 77 Servicios Alestra S.A de C.V 16814 297 18 7 NSS, S.A. 13999 189 51 18 Mega Cable S.A. de C.V. 14117 181 11 6 Telefonica del Sur S.A. 6147 154 126 22 Telefonica Del Peru 7303 154 73 18 Telecom Argentina Stet-France 11556 130 64 3 Cable-Wireless Panama 19169 123 8 30 Telconet 10481 121 48 8 Prima S.A. 6503 115 148 76 AVANTEL, S.A. 21826 113 14 19 INTERCABLE 5639 112 12 9 Telecommunications Services o 6505 108 88 80 Global One Communicaoes Ltda 18822 99 8 10 TELEFONICA MANQUEHUE 7315 96 6 3 Grupo Rey Moreno 11311 94 8 23 Sinectis S.A. 14522 94 12 8 SatNet S.A. 19429 94 51 50 E.T.B. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 277 819 233 The Internet Solution 8452 151 60 7 TEDATA 5536 122 8 16 Internet Egypt Network 2018 117 298 103 Tertiary Education Network 15475 76 84 4 Nile Online 2905 74 155 67 The Internetworking Company o 24835 73 34 6 RAYA Telecom - Egypt 6713 68 71 10 Itissalat Al-MAGHRIB 20928 60 16 2 Noor Advanced Technologies AS 5713 38 166 34 Telkom SA Ltd 33774 36 9 27 AS Number for Telecom Algeria 15706 31 8 3 Sudatel Internet Exchange Aut 12455 28 6 5 Jambonet Autonomous system 23889 25 7 10 MAURITIUS TELECOM 8524 23 1 4 AUCEGYPT Autonomous System 16637 23 10 21 Johnnic e-Ventures 10798 22 1 13 Standard Bank of South Africa 21280 21 4 4 Swift Global Kenya Ltd.Is an 8346 20 14 19 SONATEL-AS Autonomous System 12258 17 3 11 Vodacom Internet Company Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1208 972 Time Warner Telecom 18566 896 888 Covad Communications 9583 848 833 Sify Limited 4134 982 778 CHINANET-BACKBONE 4755 793 730 Videsh Sanchar Nigam Ltd. Aut 721 1026 718 DLA Systems Automation Center 11492 632 620 Cable One 22773 611 578 Cox Communications, Inc. 6197 984 509 BellSouth Network Solutions, 19916 563 509 OLM LLC 855 559 500 Canadian Research Network 5668 520 496 CenturyTel Internet Holdings, 19262 604 458 Verizon Global Networks 7545 515 446 TPG Internet Pty Ltd 9498 512 443 BHARTI BT INTERNET LTD. 17488 435 426 Hathway IP Over Cable Interne 7757 442 423 AT&T Broadband 4766 720 416 Korea Telecom (KIX) 3602 522 416 Sprint Canada, Inc. 812 438 410 Rogers WAVE List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 65005 PRIVATE 159.153.148.0/22 24989 IX Europe Frankfurt Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:5 /10:8 /11:20 /12:87 /13:198 /14:351 /15:684 /16:8667 /17:2982 /18:4983 /19:11227 /20:12403 /21:10785 /22:13810 /23:14993 /24:97838 /25:314 /26:260 /27:203 /28:62 /29:26 /30:55 /31:3 /32:39 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 879 896 Covad Communications 6197 783 984 BellSouth Network Solutions, 7018 746 1472 AT&T WorldNet Services 9583 667 848 Sify Limited 11492 623 632 Cable One 2386 617 883 AT&T Data Communications Serv 4323 582 1208 Time Warner Telecom 19916 557 563 OLM LLC 4766 520 720 Korea Telecom (KIX) 6198 500 635 BellSouth Network Solutions, 855 445 559 Canadian Research Network 7757 424 442 AT&T Broadband 5668 408 520 CenturyTel Internet Holdings, 7011 406 472 Citizens Utilities 702 374 587 UUNET - Commercial IP service 1239 367 848 Sprint 6517 344 372 Yipes Communications, Inc. 15270 338 366 PaeTec.net -a division of Pae 22773 318 611 Cox Communications, Inc. 812 317 438 Rogers WAVE Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:44 12:1638 13:1 15:11 16:3 17:3 18:4 20:42 24:861 25:1 30:2 32:66 38:191 40:54 44:3 47:3 52:4 55:1 56:3 57:34 58:115 59:163 60:183 61:812 62:745 63:1893 64:2940 65:2230 66:3090 67:588 68:665 69:1425 70:300 71:53 72:612 73:23 80:741 81:599 82:507 83:357 84:343 85:425 86:283 87:153 88:17 89:7 124:8 125:188 128:160 129:174 130:103 131:311 132:34 133:7 134:152 135:46 136:169 137:61 138:183 139:89 140:380 141:133 142:414 143:144 144:225 145:39 146:307 147:134 148:323 149:185 150:114 151:72 152:61 153:104 154:6 155:186 156:90 157:120 158:156 159:180 160:88 161:68 162:258 163:177 164:170 165:181 166:146 167:236 168:476 169:139 170:316 171:12 190:30 192:5760 193:3356 194:2469 195:1745 196:738 198:3886 199:3265 200:4209 201:566 202:6451 203:6757 204:3887 205:2099 206:2438 207:2925 208:2019 209:3490 210:1864 211:790 212:1279 213:1429 214:320 215:40 216:3826 217:1155 218:235 219:133 220:638 221:336 222:137 End of report

1 0

The Cidr Report
by cidr-report＠potaroo.net 27 Jan '06

27 Jan '06

This report has been generated at Fri Jan 27 21:46:51 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 20-01-06 176004 117185 21-01-06 176072 117190 22-01-06 176110 117191 23-01-06 176037 117221 24-01-06 176250 117309 25-01-06 176313 117259 26-01-06 176470 117277 27-01-06 176708 117381 AS Summary 21305 Number of ASes in routing system 8835 Number of ASes announcing only one prefix 1457 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91319808 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 27Jan06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 176930 117331 59599 33.7% All ASes AS4323 1202 238 964 80.2% TWTC - Time Warner Telecom AS18566 896 9 887 99.0% COVAD - Covad Communications Co. AS4134 978 253 725 74.1% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1029 310 719 69.9% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 609 39 570 93.6% CCINET-2 - Cox Communications Inc. AS7018 1457 954 503 34.5% ATT-INTERNET4 - AT&T WorldNet Services AS855 559 59 500 89.4% CANET-ASN-4 - Canadian Research Network AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS6197 982 538 444 45.2% BATI-ATL - BellSouth Network Solutions, Inc AS3602 522 107 415 79.5% AS3602-RTI - Rogers Telecom Inc. AS812 438 28 410 93.6% ROGERS-CABLE - Rogers Cable Inc. AS9498 512 121 391 76.4% BBIL-AP BHARTI BT INTERNET LTD. AS11492 632 246 386 61.1% CABLEONE - CABLE ONE AS17676 480 104 376 78.3% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS4766 681 306 375 55.1% KIXS-AS-KR Korea Telecom AS6198 634 260 374 59.0% BATI-MIA - BellSouth Network Solutions, Inc AS7757 386 19 367 95.1% CCCH-AS4 - Comcast Cable Communications Holdings, Inc AS6467 395 55 340 86.1% ESPIRECOMM - e.spire Communications, Inc. AS17488 432 95 337 78.0% HATHWAY-NET-AP Hathway IP Over Cable Internet AS4755 637 305 332 52.1% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS15270 361 31 330 91.4% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS18101 328 38 290 88.4% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS22047 379 89 290 76.5% VTR BANDA ANCHA S.A. AS16814 296 7 289 97.6% NSS S.A. AS14654 292 13 279 95.5% WAYPORT - Wayport AS5668 520 248 272 52.3% AS-5668 - CenturyTel Internet Holdings, Inc. AS3352 303 34 269 88.8% TELEFONICA-DATA-ESPANA Internet Access Network of TDE AS9929 324 57 267 82.4% CNCNET-CN China Netcom Corp. AS6167 334 69 265 79.3% CELLCO-PART - Cellco Partnership AS9583 847 584 263 31.1% SIFY-AS-IN Sify Limited Total 18008 5281 12727 70.7% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.25.224.0/20 AS12180 INTERNAP-2BLK - Internap Network Services 64.25.224.0/22 AS15083 INFOLINK-MIA-US - Infolink Information Services Inc. 64.38.96.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 64.127.128.0/17 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.224.0/20 AS3356 LEVEL3 Level 3 Communications 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.9.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.16.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.18.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.20.0/24 AS30085 NHI-COLOCATIONS - New Horizon Collocations 66.117.21.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.186.192.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.216.0.0/18 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 85.129.3.0/24 AS14585 CIFNET - CIFNet, Inc. 85.129.4.0/24 AS14585 CIFNET - CIFNet, Inc. 90.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 90.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP DFN-IP service X-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.0.246.0/24 AS3303 SWISSCOM Swisscom Solutions Ltd 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.160.171.0/24 AS7046 UUNET-CUSTOMER - UUNET Technologies, Inc. 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.74.32.0/19 AS9315 CWN-AS-AP Chomanan WorldNet Co., Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.138.0/24 AS9237 HUTCHCA-AS Corporate Access (HK) Ltd. 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.145.0/24 AS4637 REACH Reach Network Border AS 203.89.146.0/24 AS4637 REACH Reach Network Border AS 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.108.96.0/19 AS577 BACOM - Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.97.64.0/19 AS6132 INGRESSNET - Ingress Enterprises, Inc w/ Ingress Communications, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.82.160.0/20 AS20481 CALYX-NL Calyx Internet B.V. Netherlands 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.201.68.0/24 AS13564 BELLSOUTHINTERNATIONL - BellSouth International - Network Services 216.201.69.0/24 AS13564 BELLSOUTHINTERNATIONL - BellSouth International - Network Services 216.201.70.0/24 AS13564 BELLSOUTHINTERNATIONL - BellSouth International - Network Services 216.201.71.0/24 AS13564 BELLSOUTHINTERNATIONL - BellSouth International - Network Services 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

ongoing DDoS...
by Barry Shein 27 Jan '06

27 Jan '06

[Feel free to respond with: take it to list XYZZY] There's been an ongoing DDoS here at world.std.com (The World) tho it's not quite DoS'ing (you got this, right?) it's getting very tiring and obviously is affecting many systems "out there". The MO: (easy to understand but pretty nasty): What I presume is a zombie army sending out gazillions of emails to thousands of hosts out there (not ours) with a randomly generated (usually) return/source address @ our domain(s). The target addresses are usually also unknown so it just bounces back at us. Besides the obvious SMTP traffic this also generates a lot of DNS traffic. At this point the DNS traffic seems to be more of a nuisance probably because so many target hosts are retrying. At one point we were doing around 10K pkts/second in DNS traffic, very unusual. This has been going on for about a week. I'd hoped some little mitigation tricks here and there and a few days' patience and the excess mouths would get tired of this and go back to stuffing neighbors' pets down their garbage disposals for yucks, etc. So where does one start. It seems a mother ship needs to be shut down somewhere, etc. Obviously ID'ing a miscreant would be a nice result. P.S. If you think "get a firewall": The problem traffic is coming from legitimate hosts in the form of DNS+SMTP, not the bots (not to us anyhow.) So not so simple, what's the filter? -- -Barry Shein The World | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

3 2