- Test - lists.nanog.org

The Cidr Report
by cidr-report＠potaroo.net 11 Feb '05

11 Feb '05

This report has been generated at Fri Feb 11 21:44:29 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 04-02-05 151613 103143 05-02-05 152142 103736 06-02-05 152231 103721 07-02-05 152353 103830 08-02-05 152514 103966 09-02-05 153855 104090 10-02-05 154283 104246 11-02-05 154341 104240 AS Summary 18869 Number of ASes in routing system 7735 Number of ASes announcing only one prefix 1441 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 90770688 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 11Feb05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 151940 104250 47690 31.4% All ASes AS4323 1031 227 804 78.0% TWTC Time Warner Telecom AS18566 770 7 763 99.1% CVAD Covad Communications AS4134 868 203 665 76.6% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1137 573 564 49.6% DNIC DoD Network Information Center AS22773 469 26 443 94.5% CXA Cox Communications Inc. AS7018 1441 1000 441 30.6% ATTW AT&T WorldNet Services AS27364 468 34 434 92.7% ARMC Armstrong Cable Services AS6197 852 454 398 46.7% BNS-14 BellSouth Network Solutions, Inc AS3602 492 136 356 72.4% SPCA Sprint Canada Inc. AS6478 496 156 340 68.5% ATTW AT&T WorldNet Services AS1239 946 632 314 33.2% SPRN Sprint AS9929 339 35 304 89.7% CNCNET-CN China Netcom Corp. AS4766 570 281 289 50.7% KIXS-AS-KR Korea Telecom AS17676 394 105 289 73.4% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS14654 259 6 253 97.7% WAYPOR-3 Wayport AS9443 375 124 251 66.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS22909 422 182 240 56.9% CMCS Comcast Cable Communications, Inc. AS4355 298 64 234 78.5% ERSD EARTHLINK, INC AS25844 244 15 229 93.9% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS6198 451 225 226 50.1% BNS-14 BellSouth Network Solutions, Inc AS6140 381 171 210 55.1% IMPSA ImpSat AS15270 248 41 207 83.5% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. AS2386 826 625 201 24.3% ADCS-1 AT&T Data Communications Services AS7545 425 224 201 47.3% TPG-INTERNET-AP TPG Internet Pty Ltd AS5668 439 251 188 42.8% CIH-12 CenturyTel Internet Holdings, Inc. AS6517 305 120 185 60.7% YIPS Yipes Communications, Inc. AS19632 191 8 183 95.8% Metropolis Intercom AS6167 259 78 181 69.9% CELLCO Cellco Partnership AS9498 236 55 181 76.7% BBIL-AP BHARTI BT INTERNET LTD. AS16852 240 64 176 73.3% FDCI Focal Data Communications of Illinois Total 15872 6122 9750 61.4% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS11814 IGST Information Gateway Services - Toronto 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.200.100.0/24 AS7018 ATTW AT&T WorldNet Services 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 201.239.0.0/16 AS22047 VTR BANDA ANCHA S.A. 202.72.240.0/20 AS24320 RAILCOM Mongolian Railway Commercial Center Railcom 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of BAYANTEL 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.11.108.0/22 AS33419 TRIBAL-2 Tribal Fusion Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.108.96.0/19 AS577 BAC-14 Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

Re: Symantec AV may execute viruses
by Jeff Wheeler 10 Feb '05

10 Feb '05

I would actually expect LiveUpdate for the home versions to get the update automatically. The corporate edition however does not update the software via LiveUpdate - they figure IT departments would rather control when the software gets updated themselves, but unfortunately in most companies that probably means almost never :\ Also, it doesn't appear that this issue effects the Mac software (at least, I didn't see the Mac products in the Symantec vulnerability list), only Windows products. -- Jeff Wheeler Postmaster, Network Admin US Institute of Peace On Feb 10, 2005, at 1:07 PM, Colin Johnston wrote: > Any ideas why Symantec have not released the updated code to > LiveUpdate for > Mac and LiveUpdate for PC ?? > > Colin Johnston > TTL > c.johnston(a)ngat.com > >

6 8

Community meeting RealMedia available
by Susan Harris 10 Feb '05

10 Feb '05

You'll find a RealMedia recording of our Sunday evening community meeting in Las Vegas here: http://www.nanog.org/mtg-0501/coordination.html

1 0

Speaking of viruses...
by Adam Maloney 10 Feb '05

10 Feb '05

I sent this to CERT this morning. They apparently were unaware of it, and as far as I can tell there's nothing on any of the A/V sites about it. As of 14:00 CST, these sites are still serving up the virus executable. I haven't heard anything back from CERT or UCLA. Am I the only one seeing this?! >From adam(a)whee.org Thu Feb 10 10:24:16 2005 Date: Thu, 10 Feb 2005 10:24:15 -0600 (CST) From: Adam Maloney <adam(a)whee.org> To: cert(a)cert.org Cc: abuse(a)ucla.edu Subject: Attn: Bob - Dust.exe CC'd to abuse(a)ucla.edu - UCLA, your option "2" for your abuse desk rings to an invalid number. On Monday morning a bunch of our Win2k PC's got infected with a virus. We are seeing the infected machines attempting to make FTP connections to various IP's - the one's I've seen so far are in UCLA and MIT address space. The client connects to the FTP server (all have been Serv-U running under Windows), logs in with username "1", password "1", and retrieves Dust.exe Some of the IP's I've seen connections to: 18.242.5.42 (MIT) 18.241.5.89 (MIT) 169.232.117.223 (UCLA) The Dust.exe process attempts to install infected files named Jah.exe and Gamma.exe Jah is detected by Trend as WORM_RBOT.alo Gamma is detected as "possible virus". Starting this morning Trend started detecting Dust as TROJ_SCNDTHOT.ab When the machine tried to download it from MIT, Trend caught it as above. When it tried to UCLA, Trend did not catch it, and the download succeeded. When this hit on Monday, we saw infected PC's trying to infect other machines over tcp/445. They were trying random IP's in the address space that the infected computer was configured in. We did not see any FTP connections Monday morning like these, however we weren't really looking for them. -- END -- After this was sent, I've found some more details. The Dust.exe file is also being served by IP's at ThePlanet and ncsd.edu. The file from UCLA is about 5K bigger than the files served by the other sites. This explains why Trend was catching it when served by MIT but not by UCLA. After some more investigation, it looks like an infected machine uses a tcp/445 vulnerability to infect others. Once the others are hit on 445, they are instructed to download the payload from these FTP sites. I've made copies of the files available to CERT. I'm waiting on Trend to react to our support request from this morning.

2 1

Re: Speaking of viruses...
by Adam Maloney 10 Feb '05

10 Feb '05

Sorry - my mailer did something stupid. Here's what was sent, and more comments at the bottom: > To: cert(a)cert.org > CC: abuse(a)ucla.edu Subject: Attn: Bob - Dust.exe CC'd to abuse(a)ucla.edu - UCLA, your option "2" for your abuse desk rings to an invalid number. On Monday morning a bunch of our Win2k PC's got infected with a virus. We are seeing the infected machines attempting to make FTP connections to various IP's - the one's I've seen so far are in UCLA and MIT address space. The client connects to the FTP server (all have been Serv-U running under Windows), logs in with username "1", password "1", and retrieves Dust.exe Some of the IP's I've seen connections to: 18.242.5.42 (MIT) 18.241.5.89 (MIT) 169.232.117.223 (UCLA) The Dust.exe process attempts to install infected files named Jah.exe and Gamma.exe Jah is detected by Trend as WORM_RBOT.alo Gamma is detected as "possible virus". Starting this morning Trend started detecting Dust as TROJ_SCNDTHOT.ab When the machine tried to download it from MIT, Trend caught it as above. When it tried to UCLA, Trend did not catch it, and the download succeeded. When this hit on Monday, we saw infected PC's trying to infect other machines over tcp/445. They were trying random IP's in the address space that the infected computer was configured in. We did not see any FTP connections Monday morning like these, however we weren't really looking for them. -- END -- After this was sent, I've found some more details. The Dust.exe file is also being served by IP's at ThePlanet and ncsd.edu. The file from UCLA is about 5K bigger than the files served by the other sites. This explains why Trend was catching it when served by MIT but not by UCLA. After some more investigation, it looks like an infected machine uses a tcp/445 vulnerability to infect others. Once the others are hit on 445, they are instructed to download the payload from these FTP sites. I've made copies of the files available to CERT. I'm waiting on Trend to react to our support request from this morning.

1 0

Symantec AV may execute viruses
by Jeff Wheeler 10 Feb '05

10 Feb '05

apparently a serious vulnerability that needs to be patched immediately - affects Symantec firewalls, anti-spam, retail, and enterprise products. from Slashdot... http://it.slashdot.org/it/05/02/10/1327220.shtml?tid=172&tid=128 original article from ZDNet... http://www.zdnet.com.au/news/security/0,2000061744,39180674,00.htm Not sure if this is technically 'operational' but I'm sure it affects most of the people on this list. -- Jeff Wheeler Postmaster, Network Admin US Institute of Peace

1 1

Re: IRC Bot list (cross posting)
by Bill Nash 10 Feb '05

10 Feb '05

[ Edited and resent, the first appears to have vanished in transit ] I concede the point that operational tracking of botnets doesn't belong here, and I offer apologies to Martin, and the list in general, for not counting to ten before replying to his email. However, simply suppressing discussion of the topics isn't a good way to foster a cooperative working environment. I'd like to thank those few folks who corrected me, today. I was wrong in what I felt was appropriate, and I shouldn't have gone off in the manner I did. Moving to a more productive stance for this thread: How many people have subbed in the past month? The past year? There's stuff in the FAQ about what's directly relevent to this particular list, but there are a million related sub-topics with low level chatter that would overwhelm a single list, like this one. Is there a helpful resource that references these lists, to give subscribers a better grasp on topic specific lists that other nanog users deem productive, clue packed and useful? - billn

6 5

Request for delegation info
by Eric Germann 10 Feb '05

10 Feb '05

Colleagues, I was wondering if anyone had the following allocation information for the following registries archived somewhere. I'm conducting a graduate project and am trying to complete a picture of IPv4, v6 and ASN allocations. The following dates were missing from various registry repositories. I'm just trying to verify they actually do not exist vs. deleted from that registry ftp server and its associated mirrors. All dates are for 2004. For RIPENCC: delegated-ripencc- Jan 17 Jan 18 Feb 7 Feb 8 Feb 9 Apr 30 May 1 May 2 Sep 11 Sep 12 Sep 23 Oct 9 Oct 10 For ARIN: delegated-arin- Mar 2 Apr 17 If anyone has these files and data available, please contact me off list. Thanks for the consideration. Eric Germann

1 0

72.18.160.0/19 Please Check Filters - BOGON Filtering IP Space 72.0.0.0/8
by Bryan Bradsby 10 Feb '05

10 Feb '05

> Our NOC is opening a lot of tickets for customers that live on our > 72.14.128.0/19 network going towards local and federal government sites > in particular. Our customer - Angelo State U was recently assigned IP space 72.18.160.0/19. They have also seen some issues getting packets to government and other sites. For example, USGS.gov was filtering based on an old bogon list. Rob T - this should be a periodic FAQ: http://www.cymru.com/Bogons/ At your service, -bryan bradsby DIR Capnet Texas State Government Net NOC: 512-475-2432 877-472-4848

3 2

Savvis Contact
by Williams, Ken 09 Feb '05

09 Feb '05

Can any network engineer from the Savvis network please contact me off-line. Kind Regards, Ken Williams Network Security Engineer Sony Pictures Digital Entertainment

1 0