- Test - lists.nanog.org

Sober
by Dennis Dayman 03 Dec '05

03 Dec '05

Interested, but I see many Sober postings and outages on other lists and not here...has anyone been having issues? I know the ISP's are fighting the living out of the virus. -Dennis

11 11

blocking unallocated subnets
by John S. Bucy 03 Dec '05

03 Dec '05

I work for a large email provider and we've run into trouble delivering mail to certain sites after bringing up new servers in a recently allocated subnet of 72/8. Apparently, some folks decided it would be a good policy to protect their nameservers from ddos attacks to silently drop requests from unallocated subnets. So they obtained a list of subnets at some point in the past, deployed it and then never updated it. This manifests itsself in our system when the dns query repeatedly times out on the smtp servers in that subnet while it works from elsewhere. In the instances we've run into this, it only seemed to affect dns and not, say, smtp connections. I just wanted to try to raise some awareness of this practice and the trouble it may cause if the ruleset gets out-of-date. This caused us a pretty major headache the result of which is that we've given up for now on trying to deliver mail out of that subnet. john

5 5

Weekly Routing Table Report
by Routing Table Analysis 02 Dec '05

02 Dec '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 03 Dec, 2005 Analysis Summary ---------------- BGP routing table entries examined: 176067 Prefixes after maximum aggregation: 99087 Unique aggregates announced to Internet: 85328 Total ASes present in the Internet Routing Table: 21035 Origin-only ASes present in the Internet Routing Table: 18309 Origin ASes announcing only one prefix: 8674 Transit ASes present in the Internet Routing Table: 2726 Transit-only ASes present in the Internet Routing Table: 72 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 23 Prefixes from unregistered ASNs in the Routing Table: 8 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 13 Number of addresses announced to Internet: 1469673344 Equivalent to 87 /8s, 153 /16s and 111 /24s Percentage of available address space announced: 39.7 Percentage of allocated address space announced: 59.7 Percentage of available address space allocated: 66.4 Total number of prefixes smaller than registry allocations: 84502 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 36873 Total APNIC prefixes after maximum aggregation: 15699 Prefixes being announced from the APNIC address blocks: 34622 Unique aggregates announced from the APNIC address blocks: 16944 APNIC Region origin ASes present in the Internet Routing Table: 2419 APNIC Region origin ASes announcing only one prefix: 699 APNIC Region transit ASes present in the Internet Routing Table: 364 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 17 Number of APNIC addresses announced to Internet: 208047808 Equivalent to 12 /8s, 102 /16s and 142 /24s Percentage of available APNIC address space announced: 77.2 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 92966 Total ARIN prefixes after maximum aggregation: 55975 Prefixes being announced from the ARIN address blocks: 72481 Unique aggregates announced from the ARIN address blocks: 27556 ARIN Region origin ASes present in the Internet Routing Table: 10379 ARIN Region origin ASes announcing only one prefix: 3857 ARIN Region transit ASes present in the Internet Routing Table: 963 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 278432000 Equivalent to 16 /8s, 152 /16s and 137 /24s Percentage of available ARIN address space announced: 69.1 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 34421 Total RIPE prefixes after maximum aggregation: 23247 Prefixes being announced from the RIPE address blocks: 31362 Unique aggregates announced from the RIPE address blocks: 21087 RIPE Region origin ASes present in the Internet Routing Table: 7370 RIPE Region origin ASes announcing only one prefix: 3865 RIPE Region transit ASes present in the Internet Routing Table: 1217 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 20 Number of RIPE addresses announced to Internet: 226078976 Equivalent to 13 /8s, 121 /16s and 177 /24s Percentage of available RIPE address space announced: 67.4 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 10032 Total LACNIC prefixes after maximum aggregation: 3316 Prefixes being announced from the LACNIC address blocks: 8323 Unique aggregates announced from the LACNIC address blocks: 4822 LACNIC Region origin ASes present in the Internet Routing Table: 651 LACNIC Region origin ASes announcing only one prefix: 208 LACNIC Region transit ASes present in the Internet Routing Table: 120 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 23 Number of LACNIC addresses announced to Internet: 22953984 Equivalent to 1 /8s, 94 /16s and 64 /24s Percentage of available LACNIC address space announced: 34.2 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1767 Total AfriNIC prefixes after maximum aggregation: 850 Prefixes being announced from the AfriNIC address blocks: 1157 Unique aggregates announced from the AfriNIC address blocks: 834 AfriNIC Region origin ASes present in the Internet Routing Table: 144 AfriNIC Region origin ASes announcing only one prefix: 45 AfriNIC Region transit ASes present in the Internet Routing Table: 21 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2884608 Equivalent to 0 /8s, 44 /16s and 4 /24s Percentage of available AfriNIC address space announced: 8.6 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1014 6356 216 CHINANET-BACKBONE 9583 833 77 12 Sify Limited 4755 759 260 70 Videsh Sanchar Nigam Ltd. Aut 1221 692 1370 502 Telstra Pty Ltd 4766 653 3927 287 Korea Telecom (KIX) 7545 509 108 70 TPG Internet Pty Ltd 17676 470 6819 100 Softbank BB Corp. 17488 425 25 23 Hathway IP Over Cable Interne 9498 408 216 65 BHARTI BT INTERNET LTD. 9443 394 87 80 Primus Telecommunications 4802 345 73 158 Wantree Development 2907 340 1764 317 SINET Japan 9929 331 217 49 China Netcom Corp. 17557 331 24 161 Pakistan Telecom 18302 329 152 25 SK Global co., Ltd 7474 325 225 224 SingTel Optus Pty Ltd 17974 281 65 16 PT TELEKOMUNIKASI INDONESIA 9837 272 78 174 Powertel Ltd 18101 271 68 19 Reliance Infocom Ltd Internet 9800 255 410 67 CHINA UNICOM ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1471 6314 962 AT&T WorldNet Services 4323 1190 706 233 Time Warner Telecom 174 1074 5846 993 Cogent Communications 721 999 21889 299 DLA Systems Automation Center 701 986 8133 829 UUNET Technologies, Inc. 6197 968 432 502 BellSouth Network Solutions, 2386 914 530 685 AT&T Data Communications Serv 18566 879 240 7 Covad Communications 1239 844 2801 598 Sprint 209 658 3607 521 Qwest 20115 656 533 344 Charter Communications 11492 632 81 10 Cable One 22773 585 1476 28 Cox Communications, Inc. 852 574 1093 382 Telus Advanced Communications 19262 565 1594 137 Verizon Global Networks 19916 563 49 54 OLM LLC 855 562 247 66 Canadian Research Network 3602 532 126 103 Sprint Canada, Inc. 3356 514 10633 401 Level 3 Communications, LLC 6478 502 1432 280 AT&T Worldnet Services RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 606 1959 479 UUNET - Commercial IP service 3301 306 1085 292 TeliaNet Sweden 3320 285 3230 240 Deutsche Telekom AG 8220 271 475 266 COLT Telecommunications 680 245 2040 239 DFN-IP service G-WiN 8708 236 274 217 Romania Data Systems S.A. 3246 230 477 223 Song Networks 6746 199 51 171 Dynamic Network Technologies, 1257 189 712 170 SWIPnet Swedish IP Network 3269 182 1829 68 TELECOM ITALIA 5515 180 840 127 Sonera Solution Autonomous Sy 786 174 1795 174 The JANET IP Service 5400 166 317 136 BT Ignite European Backbone 8866 163 37 9 Bulgarian Telecommunication C 6830 161 669 33 UPC Distribution Services 3300 158 169 92 AUCS Communications Services 12479 151 322 5 Uni2 Autonomous System 24863 151 37 6 LINKdotNET AS number 3215 150 1275 81 France Telecom Transpac 25186 147 211 103 France Telecom Transpac's Tra LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 397 709 170 UniNet S.A. de C.V. 16814 295 18 7 NSS, S.A. 11172 289 106 74 Servicios Alestra S.A de C.V 11664 219 22 28 Keytech SA 19632 196 14 5 Metropolis Intercom S.A. 14117 184 11 6 Telefonica del Sur S.A. 22047 179 128 7 VTR PUNTO NET S.A. 13999 174 52 9 Mega Cable S.A. de C.V. 6147 157 118 21 Telefonica Del Peru 7303 152 72 19 Telecom Argentina Stet-France 11556 132 64 3 Cable-Wireless Panama 19169 127 8 20 Telconet 10481 121 48 8 Prima S.A. 6503 114 148 75 AVANTEL, S.A. 18822 114 8 11 TELEFONICA MANQUEHUE 5639 112 12 9 Telecommunications Services o 21826 112 14 18 INTERCABLE 6505 107 88 80 Global One Communicaoes Ltda 11311 99 8 10 Sinectis S.A. 4270 94 17 9 Red de Interconexion Universi AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 271 812 229 The Internet Solution 8452 147 44 7 TEDATA 5536 122 8 16 Internet Egypt Network 2018 117 298 103 Tertiary Education Network 2905 74 155 67 The Internetworking Company o 6713 69 71 10 Itissalat Al-MAGHRIB 20928 61 16 2 Noor Advanced Technologies AS 24835 59 34 6 RAYA Telecom - Egypt 15475 57 84 4 Nile Online 5713 38 151 34 Telkom SA Ltd 33774 33 4 24 AS Number for Telecom Algeria 15706 31 8 3 Sudatel Internet Exchange Aut 8524 23 1 4 AUCEGYPT Autonomous System 16637 23 10 21 Johnnic e-Ventures 23889 23 5 9 MAURITIUS TELECOM 10798 22 1 13 Standard Bank of South Africa 21280 21 4 4 Swift Global Kenya Ltd.Is an 12258 17 3 11 Vodacom Internet Company 15808 17 2 2 Communication Solutions Ltd i 21491 17 17 2 UTL On-line is RF broadband I Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1190 957 Time Warner Telecom 18566 879 872 Covad Communications 9583 833 821 Sify Limited 4134 1014 798 CHINANET-BACKBONE 721 999 700 DLA Systems Automation Center 4755 759 689 Videsh Sanchar Nigam Ltd. Aut 11492 632 622 Cable One 22773 585 557 Cox Communications, Inc. 19916 563 509 OLM LLC 855 562 496 Canadian Research Network 6197 968 466 BellSouth Network Solutions, 5668 486 460 CenturyTel Internet Holdings, 7545 509 439 TPG Internet Pty Ltd 3602 532 429 Sprint Canada, Inc. 19262 565 428 Verizon Global Networks 17488 425 402 Hathway IP Over Cable Interne 17676 470 370 Softbank BB Corp. 4766 653 366 Korea Telecom (KIX) 6467 411 363 E.Spire Communications, Inc. 9498 408 343 BHARTI BT INTERNET LTD. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 38976 UNALLOCATED 62.192.224.0/19 21166 Satgate autonomous s 38976 UNALLOCATED 62.192.232.0/24 21166 Satgate autonomous s 24413 UNALLOCATED 202.46.32.0/19 17623 China Netcom Corp. 64720 PRIVATE 202.127.124.0/24 4837 chinanet IDC center 64720 PRIVATE 202.127.125.0/24 4837 chinanet IDC center 24406 UNALLOCATED 203.119.26.0/24 4808 CNCGROUP IP network: 24406 UNALLOCATED 203.119.27.0/24 4808 CNCGROUP IP network: 24406 UNALLOCATED 203.119.29.0/24 4808 CNCGROUP IP network: Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 175.98.111.0/24 6453 Teleglobe Inc. 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:5 /10:8 /11:19 /12:84 /13:190 /14:342 /15:668 /16:8609 /17:2906 /18:4893 /19:11062 /20:12227 /21:10256 /22:13524 /23:14646 /24:95662 /25:352 /26:291 /27:205 /28:25 /29:12 /30:30 /31:3 /32:30 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 863 879 Covad Communications 6197 783 968 BellSouth Network Solutions, 7018 722 1471 AT&T WorldNet Services 9583 656 833 Sify Limited 2386 640 914 AT&T Data Communications Serv 11492 624 632 Cable One 4323 568 1190 Time Warner Telecom 19916 557 563 OLM LLC 4766 458 653 Korea Telecom (KIX) 855 434 562 Canadian Research Network 7011 402 466 Citizens Utilities 702 386 606 UUNET - Commercial IP service 5668 385 486 CenturyTel Internet Holdings, 1239 365 844 Sprint 6198 356 494 BellSouth Network Solutions, 6517 320 345 Yipes Communications, Inc. 15270 320 347 PaeTec.net -a division of Pae 22773 303 585 Cox Communications, Inc. 13609 298 340 Choice One Communications Inc 18302 298 329 SK Global co., Ltd Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:40 12:1624 13:1 15:11 16:3 17:3 18:3 20:42 24:711 30:2 32:64 38:187 40:54 44:3 47:3 52:4 55:1 56:3 57:35 58:94 59:103 60:160 61:805 62:801 63:1898 64:2925 65:2138 66:2903 67:643 68:686 69:1332 70:241 71:36 72:474 80:692 81:586 82:487 83:321 84:334 85:381 86:217 87:109 125:130 128:151 129:169 130:99 131:304 132:35 133:1 134:151 135:45 136:167 137:66 138:176 139:75 140:448 141:145 142:404 143:143 144:219 145:34 146:304 147:131 148:271 149:186 150:108 151:71 152:111 153:94 154:5 155:153 156:88 157:118 158:147 159:175 160:84 161:74 162:241 163:173 164:184 165:180 166:147 167:242 168:461 169:143 170:313 171:12 175:1 192:5740 193:3375 194:2432 195:1637 196:712 198:3914 199:3250 200:4313 201:467 202:6285 203:6602 204:3834 205:2092 206:2432 207:2928 208:2028 209:3446 210:1777 211:799 212:1223 213:1382 214:314 215:42 216:3774 217:1178 218:220 219:131 220:538 221:325 222:130 End of report

1 0

Re: QoS for ADSL customers
by Miquel van Smoorenburg 02 Dec '05

02 Dec '05

In article <cistron.e05f39290511290324l761e676dm2cf141344c966a99(a)mail.gmail.com>, Kim Onnel <karim.adel(a)gmail.com> wrote: >We have Juniper ERX as BRAS for ADSL >Our humble approach was to collect some p2p ports and police traffic to >these ports, but the traffic wasnt much, one other thing is rate-limiting >per ADSL customers IPs, but that wasnt supported by management, so we >thought of matching ADSL www traffic and doing exceed action is transmit, >and police other IP traffic. > >Doing so on the ERX wasnt a nice experience, so we're trying to do it on the >cisco. The ERX really has good CoS and QoS controls (not NBAR though AFAIK). It can do it all in hardware, I've heard a lot of good things about it from people who actually use it. If you have a support contract just ask if you can spend a day in a Juniper lab with an engineer to learn how it works (Juniper here in NL definitely does that). Mike.

1 0

The Cidr Report
by cidr-report＠potaroo.net 02 Dec '05

02 Dec '05

This report has been generated at Fri Dec 2 21:46:37 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 25-11-05 172899 115145 26-11-05 172818 115065 27-11-05 172783 115147 28-11-05 173030 115171 29-11-05 173008 115448 30-11-05 172803 115438 01-12-05 173244 115396 02-12-05 173338 115423 AS Summary 20954 Number of ASes in routing system 8692 Number of ASes announcing only one prefix 1459 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91252992 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 02Dec05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 173501 115410 58091 33.5% All ASes AS4323 1184 236 948 80.1% TWTC - Time Warner Telecom AS18566 879 8 871 99.1% COVAD - Covad Communications AS4134 1007 257 750 74.5% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1054 312 742 70.4% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 577 34 543 94.1% CCINET-2 - Cox Communications Inc. AS7018 1459 959 500 34.3% ATT-INTERNET4 - AT&T WorldNet Services AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 562 66 496 88.3% CANET-ASN-4 - Canadian Research Network AS3602 531 104 427 80.4% SPRINT-CA-AS - Sprint Canada Inc. AS6197 966 567 399 41.3% BATI-ATL - BellSouth Network Solutions, Inc AS11492 631 251 380 60.2% CABLEONE - CABLE ONE AS17676 470 101 369 78.5% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS6467 411 57 354 86.1% ESPIRECOMM - e.spire Communications, Inc. AS17488 434 82 352 81.1% HATHWAY-NET-AP Hathway IP Over Cable Internet AS812 370 27 343 92.7% ROGERS-CABLE - Rogers Cable Inc. AS4755 612 282 330 53.9% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS4766 616 289 327 53.1% KIXS-AS-KR Korea Telecom AS15270 342 25 317 92.7% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS9583 831 519 312 37.5% SIFY-AS-IN Sify Limited AS9498 411 107 304 74.0% BBIL-AP BHARTI BT INTERNET LTD. AS14654 292 6 286 97.9% WAYPORT - Wayport AS5668 485 212 273 56.3% AS-5668 - CenturyTel Internet Holdings, Inc. AS9929 319 56 263 82.4% CNCNET-CN China Netcom Corp. AS6167 324 63 261 80.6% CELLCO-PART - Cellco Partnership AS16814 295 37 258 87.5% NSS S.A. AS18101 271 23 248 91.5% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS6140 428 186 242 56.5% IMPSAT-USA - ImpSat AS1239 840 599 241 28.7% SPRINTLINK - Sprint AS19115 258 27 231 89.5% CHARTER-LEBANON - Charter Communications AS6198 484 255 229 47.3% BATI-MIA - BellSouth Network Solutions, Inc Total 17906 5812 12094 67.5% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.78.0/24 AS25994 NPG-001 - NPG Cable, INC 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.38.96.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 64.66.32.0/20 AS18864 STARTEC - Startec Global Communications 64.66.32.0/22 AS18864 STARTEC - Startec Global Communications 64.66.34.0/23 AS18864 STARTEC - Startec Global Communications 64.127.128.0/17 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.11.224.0/20 AS3356 LEVEL3 Level 3 Communications 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.9.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.16.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.18.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.20.0/24 AS30085 NHI-COLOCATIONS - New Horizon Collocations 66.117.21.0/24 AS30033 NHI-NETWORKS - NHI Networks 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.186.192.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.216.0.0/18 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 85.129.3.0/24 AS14585 CIFNET - CIFNet, Inc. 85.129.4.0/24 AS14585 CIFNET - CIFNet, Inc. 90.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 90.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.0.246.0/24 AS3303 SWISSCOM Swisscom Solutions Ltd 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.59.178.0/24 AS8481 TRANSNET transnet INTERNET Services 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.160.171.0/24 AS7046 UUNET-CUSTOMER - UUNET Technologies, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM - GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.131.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET - NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.46.0/23 AS17747 ZIML-AP ZEE INTERACTIVE MUTIMEDIA LTD., BANGALORE 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.133.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.138.0/24 AS9237 HUTCHCA-AS Corporate Access (HK) Ltd. 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.145.0/24 AS4637 REACH Reach Network Border AS 203.89.146.0/24 AS4637 REACH Reach Network Border AS 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.108.96.0/19 AS577 BACOM - Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 208.138.48.0/20 AS6971 ESCH - Eschelon Telecommunications, Inc. 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.97.64.0/19 AS6132 INGRESSNET - Ingress Enterprises, Inc w/ Ingress Communications, Inc. 209.112.224.0/20 AS19817 DSLEXTREME - DSL Extreme 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 209.251.0.0/19 AS11036 SISCOM - SISCOM, Inc 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.82.160.0/20 AS20481 CALYX-NL Calyx Internet B.V. Netherlands 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.178.37.0/24 AS3356 LEVEL3 Level 3 Communications 216.178.39.0/24 AS3356 LEVEL3 Level 3 Communications 216.178.42.0/24 AS3356 LEVEL3 Level 3 Communications 216.178.43.0/24 AS3356 LEVEL3 Level 3 Communications 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

[Sidr] Re: S-BGP and IP prefix aggregation
by william(at)elan.net 02 Dec '05

02 Dec '05

I'm reposting my email reply that did not make it to nanog (it made it fine to ietf list though as did Tony's reply to my email that went to both sidr and to nanog). I suspect nanog maybe using special filtering rules [aka amavisd] that did not non-ascii characters in "To" field (that is the only thing I can think of that in how that post was different from others) - I can't think of a good reason to have this filtering rule though... ---------- Forwarded message ---------- Date: Fri, 2 Dec 2005 00:22:44 -0800 (PST) From: "william(at)elan.net" <william(a)elan.net> To: ÍõÄÈ <wn(a)ndsc.com.cn> Cc: nanog(a)merit.edu, sidr(a)ietf.org Subject: [Sidr] Re: S-BGP and IP prefix aggregation [I'm cross-posting this to SIDR BOF (future SIDR WG) list as that seems to be the most appropriate forum to discuss this issue] On Fri, 2 Dec 2005, <wn(a)ndsc.com.cn> wrote: > I have a question about S-BGP. When IP prefix is aggregated, and a S-BGP > speaker receives a route announcement with the aggregated ip prefix, > > how does it verify the authority of the AS to announce the IP prefix. The > aggregated IP prefix should have not address attestation. With rare exceptions almost all aggregation happens by ISP that has been allocated larger block and which it sub-allocated to its customers (or decided to break of and announce subparts from multiple datacenters), so in this case ISP (ASN) would obviously be able to provide a permission [sign cert] to announce that larger block. There are however some rare exceptions, for example I know of ip block in legacy class-c space that UUNET is announcing as /16 aggregate but where it actually consists of a number of smaller ip blocks assigned (direct assignment from RIR) to several different organizations. I always assumed myself that those running SIDR aware routers in such cases would not be doing aggregation - i.e. no aggregation if each ip block in the aggregate has permission for announcement from different entity. An alternative for sbgp design could be that aggregating ASN would create special self-signing cert for such aggregate block and that cert would have special attribute(s) indicating list of all sub-blocks and reference to all certs that "make" this aggregate block. Then verifying router in such a case would go through and verify each one of those sub-block certs (and those sub-block certs would have to be such that they give permission for announcing the block from that sub-block owner to aggregating ASN). -- William Leibzon Elan Networks william(a)elan.net

1 0

Re: [Sidr] Re: S-BGP and IP prefix aggregation
by Tony Li 02 Dec '05

02 Dec '05

> > An alternative for sbgp design could be that aggregating ASN would > create special self-signing cert for such aggregate block and that > cert would have special attribute(s) indicating list of all sub- > blocks and reference > to all certs that "make" this aggregate block. Then verifying router > in such a case would go through and verify each one of those sub-block > certs (and those sub-block certs would have to be such that they > give permission for announcing the block from that sub-block owner > to aggregating ASN). > Advertising an aggregate that is not specifically assigned to you is known as "proxy aggregation". William has given a good description of what's required above, but it needs a further enhancement in that proxy aggregation will frequently need to happen in several locations for the aggregate to have any true impact on routing. In graph theoretic terms, proxy aggregation must form a "cut set" topologically around the longer prefixes to contain them and prevent them from being distributed throughout the network. Thus, any security mechanism needs to provide some means for indicating that an entire set of ASes may legitimately be advertising a proxy aggregate prefix. How one determines the appropriate set of ASes that are authorized is another interesting administrative issue that needs to be resolved. Tony

1 0

S-BGP and IP prefix aggregation
by 王娜 02 Dec '05

02 Dec '05

I have a question about S-BGP. When IP prefix is aggregated, and a S-BGP speaker receives a route announcement with the aggregated ip prefix, how does it verify the authority of the AS to announce the IP prefix. The aggregated IP prefix should have not address attestation. wn(a)mail.ndsc.com.cn

1 0

Re: GoDaddy DDoS
by Sam Crooks 02 Dec '05

02 Dec '05

the source I have seen so far is: http://news.com.com/GoDaddy.com+suffers +outage/2110-7349_3-5977187.html?tag=nefd.hed So I was looking for more details.... On Wed, 2005-11-30 at 23:11 +0000, Christopher L. Morrow wrote: > On Wed, 30 Nov 2005, Sam Crooks wrote: > > > Does anybody have information regarding to size and scale of the DDoS > > attack purported to have happened against GoDaddy today? > > nope... but against their: > 1) dns servers? > 2) web servers? > 3) mail servers? > 4) networking equipment? > 5) none of the above? > > > CONFIDENTIALITY NOTICE: This message, and any attachments, are intended only for the lawful and specified use of the individual or entity to which it is addressed and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that you are STRICTLY PROHIBITED from disclosing, printing, storing, disseminating, distributing or copying this communication, or admitting to take any action relying thereon, and doing so may be unlawful. It should be noted that any use of this communication outside of the intended and specified use as designated by the sender, may be unlawful. If you have received this in error, please immediately notify us by return e-mail, fax and/or telephone, and destroy this original transmission and its attachments without reading or saving in any manner.

9 8

Cisco Security Advisory: IOS HTTP Server Command Injection Vulnerability
by Cisco Systems Product Security Incident Response Team 01 Dec '05

01 Dec '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: IOS HTTP Server Command Injection Vulnerability ======================================================================== Document ID: 68322 Advisory ID: cisco-sa-20051201-http http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml Revision 1.0 For Public Release 2005 December 01 2100 UTC (GMT) - ----------------------------------------------------------------------- Contents ======== Summary Affected Products Details Impact Software Versions and Fixes Workarounds Obtaining Fixed Software Exploitation and Public Announcements Status of This Notice: INTERIM Distribution Revision History Cisco Security Procedures - ----------------------------------------------------------------------- Summary ======= A vulnerability exists in the IOS HTTP server in which HTML code inserted into dynamically generated output, such as the output from a "show buffers" command, will be passed to the browser requesting the page. This HTML code could be interpreted by the client browser and potentially execute malicious commands against the device or other possible cross-site scripting attacks. Successful exploitation of this vulnerability requires that a user browse a page containing dynamic content in which HTML commands have been injected. Cisco will be making free software available to address this vulnerability for affected customers. There are workarounds available to mitigate the effects of the vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml. Affected Products ================= This security advisory applies to all Cisco products that run Cisco IOS Software versions 11.0 through 12.4 with the HTTP server enabled. A system which contains the IOS HTTP server or HTTP secure server, but does not have it enabled, is not affected. To determine if the HTTP server is running on your device, issue the "show ip http server status" and "show ip http server secure status" commands at the prompt and look for output similar to: Router>show ip http server status HTTP server status: Enabled If the device is not running the HTTP server, you should see output similar to: Router>show ip http server status HTTP server status: Disabled Any version of Cisco IOS prior to the versions which will be listed in the Fixed Software section below may be vulnerable. Cisco IOS XR is not affected. To determine the software running on a Cisco product, log in to the device and issue the "show version" command to display the system banner. Cisco IOS Software will identify itself as "Internetwork Operating System Software" or simply "IOS". On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the "show version" command or will give different output. The following example identifies a Cisco product running IOS release 12.3(6) with an installed image name of C3640-I-M: Cisco Internetwork Operating System Software IOS (tm) 3600 Software (C3640-I-M), Version 12.3(6), RELEASE SOFTWARE (fc3) The next example shows a product running IOS release 12.3(11)T3 with an image name of C3845-ADVIPSERVICESK9-M: Cisco IOS Software, 3800 Software (C3845-ADVIPSERVICESK9-M), Version 12.3(11)T3, RELEASE SOFTWARE (fc4) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2005 by Cisco Systems, Inc. Additional information about Cisco IOS release naming can be found at http://www.cisco.com/warp/public/620/1.html. No other Cisco products are currently known to be affected by the vulnerability addressed in this advisory. Details ======= The Cisco IOS Web browser interface (which enables the device to perform as an HTTP server) allows configuration and monitoring of a router or access server using any web browser. This feature was introduced in IOS 11.0. A vulnerability exists in the IOS HTTP server in which HTML code inserted into dynamically generated output, such as the output from a "show buffers" command, will be passed to the browser requesting the page. This HTML code could be interpreted by the browser and potentially execute malicious commands against the device or other possible cross-site scripting attacks. In order to be vulnerable to the cross-site scripting attack, a user must browse and view the content during the same period of time the injected code exists in memory. On the other hand, if a user does not browse contaminated dynamic content on the device, then exploitation is not possible. A proof of concept exploit exists for this vulnerability, in which the exploit attempts to reset the enable password on the device. For the attack to work against the device itself, the user browsing tainted dynamic content on the router will only be able to execute commands at or below the privilege level for which they are authenticated and authorized for on the device. This vulnerability is documented in Cisco Bug ID CSCsc64976. Impact ====== Successful exploitation of the vulnerability may result in an attacker executing commands on the device, including the possibility of gaining full administrative privileges on the device which is dependent on the privilege level of the authenticated user. Software Versions and Fixes =========================== No software fixes are currently available. This section will be updated regularly as soon as software fixes are available. Workarounds =========== Disable the HTTP server +---------------------- If the HTTP server is not used for any legitimate purposes on the device, it is a best practice to disable it by issuing the following commands in configure mode: no ip http server no ip http secure-server Disable the HTTP WEB_EXEC service +-------------------------------- A feature was introduced in 12.3(14)T and later in which selective HTTP and HTTPS services could be enabled or disabled. Two typical services are WEB_EXEC and the IOS Certificate Server (SCEP). The WEB_EXEC service provides a facility to configure the box and retrieve current state of the box from remote clients. The IOS Certificate Server service provides a facility wherein remote clients can enroll and obtain Crypto Certificates. It is possible to disable the WEB_EXEC service while still leaving SCEP running to serve Certificates. If an installation requires the use of the SCEP service, the WEB_EXEC service may be disabled via the commands in configure mode: no ip http active-session-modules WEB_EXEC no ip http secure-active-session-modules WEB_EXEC Avoid the use of Web-based SHOW commands +--------------------------------------- Successful exploitation of this vulnerability requires an unsuspecting user to request dynamic content from the device via the "show" commands which are available. Avoiding the use of those commands via the web interface until an upgrade to fixed software is possible may be perfectly legitimate for some installations. Obtaining Fixed Software ======================== Cisco will make free software available to address this vulnerability for affected customers. This advisory will be updated as fixed software becomes available. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== This vulnerability was disclosed in a public posting to the Bugtraq mailing list, and at the following URL: http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/cisco/index.…. The Cisco PSIRT is not aware of any malicious use of the vulnerability described in this advisory. Status of This Notice: INTERIM ============================== THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT WITHIN FROM THE ORIGINAL DATE OF THIS NOTICE. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +----------------------------------------+ | Revision | 1-December-2005. | Initial | | 1.0 | | draft. | +----------------------------------------+ Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt/. - ----------------------------------------------------------------------- All contents are Copyright 1992-2005 Cisco Systems, Inc. All rights reserved. - ----------------------------------------------------------------------- Updated: Dec 01, 2005 Document ID: 68322 - ----------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDj3udezGozzK2tZARAmkwAJ4xrlLCF75ryXyuX2/62peJ1YAUegCfYdUS jfZM0o9w1mRIAVF4C3uunRs= =A852 -----END PGP SIGNATURE-----

1 0