- Test - lists.nanog.org

Re: short Botnet list and Cashing in on DoS
by Fergie (Paul Ferguson) 09 Oct '04

09 Oct '04

Which reminds me -- this is only one of the issues that appeared om the "SANS Top 20 Internet Vulnerabilities": http://www.sans.org/top20/ - ferg -- "J. Oquendo" <sil(a)politrix.org> wrote: Most ISP's wouldn't have to deal with this problem if corporations took the time to release better products. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

FW: House Toughens Spyware Penalties
by Nicole 08 Oct '04

08 Oct '04

It all reads ok until the latter part... shudder... Nicole -----FW: <200410081600530249.000E013B(a)mail.themezz.com>----- Date: Fri, 08 Oct 2004 16:00:53 -0400 Sender: cybercrime-alerts-bounce(a)freelists.org From: cybercrime-alerts <alerts(a)theMezz.com> To: cybercrime-alerts(a)freelists.org Subject: House Toughens Spyware Penalties October 8, 2004 House Toughens Spyware Penalties http://www.internetnews.com/bus-news/article.php/3419211 For the second time in three days, the U.S. House of Representatives has passed an anti-spyware bill, this time adding criminal penalties to tough civil provisions of legislation passed on Tuesday. The Internet Spyware Prevention Act of 2004 (H.R. 4661), which passed on a 415-0 vote Thursday, makes it a crime to intentionally access a computer without authorization or to intentionally exceed authorized access. If the unauthorized intrusion is to further another federal crime such as secretly accessing personal data, the penalty is up to five years in prison. Deliberately injuring or defrauding a person or damaging a computer through the unauthorized installation of spyware carry prison terms of up to two years. The legislation also authorizes $10 million for the Department of Justice to combat spyware and phishing (define) scams, although the bill does not specifically make phishing a crime. "By imposing criminal penalties on these bad actors, this legislation will help deter the use of spyware, and will thus help protect consumers from these aggressive attacks," Rep. Bob Goodlatte (R-VA), the bill's author, said in a statement. "At the same time, the legislation leaves the door open for innovative technology developments to continue to combat spyware programs." Tuesday night, the House passed legislation prohibiting unfair or deceptive practices related to spyware. The bill, known as the Spy Act (H.R. 2929), also requires an opt-in notice and consent form for legal software that collects personally identifiable information from consumers. The penalties in H.R. 2929 are limited to civil fines of up to $3 million. Both bills now go the Senate, which has pending legislation similar to the House bills. House Energy and Commerce Committee Chairman Joe Barton (R-Texas) said earlier this week he thought the two chambers could agree on a spyware bill before lawmakers adjourn on Friday or Saturday. "[We've] seen several egregious examples of spyware being used in ways that most Americans would think clearly ought to be criminal," Ari Schwartz, associate director of the Center for Democracy and Technology, said in another statement. "The bill will help make sure there are strong deterrents to using spyware to defraud or injure consumers." The two House bills are supported by a broad array of trade groups, including the U.S. Chamber of Commerce and the Business Software Alliance (BSA). "This anti-spyware legislation ensures that criminal penalties are imposed upon those persons who aim to harm innocent Internet users via spyware applications," said Robert Holleyman, president and CEO of the BSA. Dell (Quote, Chart), eBay (Quote, Chart)>, Microsoft (Quote, Chart), Time Warner (Quote, Chart), Yahoo (Quote, Chart) and Earthlink (Quote, Chart) endorsed the Tuesday legislation. They did so after exemptions were added to the bill for network monitoring for security purposes, technical support or repair, or the detection or prevention of fraudulent activities. The bill also permits computer software providers to interact with a user's computer without notice and consent in order to determine whether the computer user is authorized to use the software upon initialization of the software or an update of the software. "Every day thousands of unsuspecting Americans have their identities hijacked by a new breed of cyber criminals because of spyware. People whose identities have been stolen can spend months or years -- and much of their hard-earned money -- trying to restore their good name and credit record. This legislation will help prevent bad things from happening to good names," Rep. Lamar Smith (R-Texas) said. -- Articles distributed for the purposes of education, discussion and review. Archives and Subscription Updates: http://cybercrime.theMezz.com Guestbook: http://guestbook.theMezz.com PGP Key: http://pgp.theMezz.com --------------End of forwarded message------------------------- -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" - Politicaly Correct UNIX Page Opportunity is missed by most people because it is dressed in overalls and looks like work. - Thomas Edison "Microsoft isn't evil, they just make really crappy operating systems." - Linus Torvalds If you want to go backwards, you put it in 'R,' and if you want to go forward, you put it in 'D' -- Sen. Tom Harkin (D-IA)

5 5

Is there an email admin from RR.COM out there?
by Jeff Wheeler 08 Oct '04

08 Oct '04

Not sure how applicable to NANOG this is, but the below thread has started on another list that I am on, and I thought someone listening here from RR.COM might be able to help. If you think you can assist or at least want to find out more about these issues, please contact me off list and I'll get you in touch with those effected. -- Jeff Wheeler Postmaster, Network Admin US Institute of Peace Begin forwarded message: > From: Mitchell Kahn > Date: October 8, 2004 3:06:22 PM EDT > To: "CommuniGate Pro Discussions" > Subject: Re: blocked for too many messages? > > It sounds as if your difficulties are actually worse than mine. Thanks > for letting me know that I am in good company. > > Mitch > > On Oct 8, 2004, at 11:44 AM, eLists wrote: > >> Hello, >> >> I too have had my emails to any rr.com server rejected as well. I >> also checked my IP address at this senderbase page and funny how a >> ranking of 10 equates to all internet email, and with my server >> sending out about 2000 emails a day, I have a rating of 2.3? >> >> Seems something is rather messed up with both senderbase and rr (not >> surprising that rr is messed up). >> >> In the past few days, my server has only attempted to send about 20 >> emails to rr.com servers. Yet all of mine are also blocked. Like you, >> my IP is not in any lists. >> >> Mitchell Kahn wrote: >>> One of our clients received the following messaged when her e-mail >>> was bounced: >>> Failed to deliver to 'islandfamily(a)hawaii.rr.com' >>> SMTP module(domain hawaii.rr.com) reports: >>> host orngca-01.mgw.rr.com says: >>> 452 Too many recipients received this hour. Please see our rate >>> limit >>> policy at http://security.rr.com/spam.htm#ratelimit >>> I went to the page listed to try to understand why her e-mail was >>> rejected but this is incongruent with the facts as I understand >>> them. I checked our logs and there was only one attempt in the last >>> two days to send mail to this domain. My server does not appear on >>> any of the spam lists that they show (see below), we have a static >>> IP address on the server, and we don't have any open relays. This >>> Road Runner process appears to render e-mail useless as a >>> communication tool if this is the future of spam filtering. I >>> contacted the ISP that bounced the mail but I have not had a >>> response. (I wonder if my contact mail was bounced.) >>> Is anyone else familiar with this experience? Does anyone know of a >>> way around it? >>> Thanks, >>> Mitch_ > > Mitchell Kahn

2 1

Anyone from Hotmail listening?
by Drew Linsalata 08 Oct '04

08 Oct '04

If anyone responsible at Hotmail is listening, please email me off list. We have an issue that needs some work, and the usual channels are getting us nowhere. Thanks. -- Drew Linsalata The Gotham Bus Company, Inc. Colocation and Dedicated Access Solutions http://www.gothambus.com

1 0

MED and community fluctuation
by Zhen Wu 08 Oct '04

08 Oct '04

I understand the usage and application of MED and community attributes. But we watch some interesting policy/attribute fluctuation of MED and community. We analyze BGP updates sent out by RouteViews peers. We observed a lot of AADupType2 instabilities. We define AADupType2 event as: A route is implicitly withdrawn and replaced with a duplicate of the original route. The two messages have the same NEXTHOP and ASPATH attribute, but differ between at least one other attribute (like MED). Note that we only pair two updates from the same RouteViews' peer / neighboring AS. A fine-grained analysis revealed that most AADupType2 instabilities just change the MED or community attribute (or both), which means that MED and community values associated with prefixes are changing dynamically and frequently. We are not claiming it is a common practice of the Internet, this is just the cases observed from RouteViews peers. We are thinking of the motivation of doing this? Why the ISPs configured their network so that the MED values oscillate? Did ISPs configure MED values dynamically calculated from IGP metrics? The most strange thing to us is why the community attribute associated with prefixes also oscillate frequently. We know that community are used to simply operational complexity: group a set of prefixes to apply the same policy. It didn't make sense to me to change it dynamically. Misconfigurations? Any comments or discussions? Thanks! Zhen Wu

2 2

Weekly Routing Table Report
by Routing Table Analysis 08 Oct '04

08 Oct '04

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 09 Oct, 2004 Analysis Summary ---------------- BGP routing table entries examined: 149020 Prefixes after maximum aggregation: 87919 Unique aggregates announced to Internet: 71042 Total ASes present in the Internet Routing Table: 18195 Origin-only ASes present in the Internet Routing Table: 15790 Origin ASes announcing only one prefix: 7393 Transit ASes present in the Internet Routing Table: 2405 Transit-only ASes present in the Internet Routing Table: 79 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 26 Prefixes from unregistered ASNs in the Routing Table: 58 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 16 Number of addresses announced to Internet: 1344430884 Equivalent to 80 /8s, 34 /16s and 99 /24s Percentage of available address space announced: 36.3 Percentage of allocated address space announced: 58.6 Percentage of available address space allocated: 61.9 Total number of prefixes smaller than registry allocations: 68695 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 28600 Total APNIC prefixes after maximum aggregation: 14296 Prefixes being announced from the APNIC address blocks: 26765 Unique aggregates announced from the APNIC address blocks: 14304 APNIC Region origin ASes present in the Internet Routing Table: 2146 APNIC Region origin ASes announcing only one prefix: 641 APNIC Region transit ASes present in the Internet Routing Table: 329 Average APNIC Region AS path length visible: 4.8 Max APNIC Region AS path length visible: 22 Number of APNIC addresses announced to Internet: 164575616 Equivalent to 9 /8s, 207 /16s and 57 /24s Percentage of available APNIC address space announced: 75.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 85051 Total ARIN prefixes after maximum aggregation: 51403 Prefixes being announced from the ARIN address blocks: 65114 Unique aggregates announced from the ARIN address blocks: 22973 ARIN Region origin ASes present in the Internet Routing Table: 9604 ARIN Region origin ASes announcing only one prefix: 3450 ARIN Region transit ASes present in the Internet Routing Table: 931 Average ARIN Region AS path length visible: 4.4 Max ARIN Region AS path length visible: 18 Number of ARIN addresses announced to Internet: 233997056 Equivalent to 13 /8s, 242 /16s and 131 /24s Percentage of available ARIN address space announced: 69.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 27632 Total RIPE prefixes after maximum aggregation: 19190 Prefixes being announced from the RIPE address blocks: 24481 Unique aggregates announced from the RIPE address blocks: 16076 RIPE Region origin ASes present in the Internet Routing Table: 5882 RIPE Region origin ASes announcing only one prefix: 3169 RIPE Region transit ASes present in the Internet Routing Table: 1018 Average RIPE Region AS path length visible: 5.3 Max RIPE Region AS path length visible: 26 Number of RIPE addresses announced to Internet: 173276096 Equivalent to 10 /8s, 83 /16s and 251 /24s Percentage of available RIPE address space announced: 60.8 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6457 Total LACNIC prefixes after maximum aggregation: 2340 Prefixes being announced from the LACNIC address blocks: 6288 Unique aggregates announced from the LACNIC address blocks: 3705 LACNIC Region origin ASes present in the Internet Routing Table: 393 LACNIC Region origin ASes announcing only one prefix: 113 LACNIC Region transit ASes present in the Internet Routing Table: 83 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 18 Number of LACNIC addresses announced to Internet: 16269568 Equivalent to 0 /8s, 248 /16s and 65 /24s Percentage of available LACNIC address space announced: 48.5 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1272 Total AfriNIC prefixes after maximum aggregation: 690 Prefixes being announced from the AfriNIC address blocks: 886 Unique aggregates announced from the AfriNIC address blocks: 677 AfriNIC Region origin ASes present in the Internet Routing Table: 93 AfriNIC Region origin ASes announcing only one prefix: 20 AfriNIC Region transit ASes present in the Internet Routing Table: 12 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 16 Number of AfriNIC addresses announced to Internet: 2064640 Equivalent to 0 /8s, 31 /16s and 129 /24s Percentage of available AfriNIC address space announced: 12.3 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 840 4391 160 Data Communications Bureau 1221 809 1184 581 Telstra Pty Ltd 4766 544 3407 266 Korea Internet Exchange for " 9583 529 41 106 Satyam Infoway Ltd., 17676 370 5532 52 XTAGE CORPORATION 4755 367 132 51 Videsh Sanchar Nigam Ltd. Aut 2907 354 1857 328 SINET Japan 9443 353 69 79 Primus Telecommunications 9929 344 161 33 China Netcom Corp. 17557 316 23 157 Pakistan Telecom 703 311 342 240 UUNET 2764 285 274 232 connect.com.au pty ltd 7474 270 269 201 Optus Communications Pty Ltd 9942 238 73 127 COMindico Australia 4802 233 28 142 Wantree Development 9800 230 374 67 CHINA UNICOM 9498 224 49 48 BHARTI BT INTERNET LTD. 7563 221 48 164 Korea Internet Infrastructure 10036 203 19 186 C&M Communication Co. Ltd. 17974 203 62 10 PT TELEKOMUNIKASI INDONESIA ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1411 6749 983 AT&T WorldNet Services 701 1273 8450 919 UUNET Technologies, Inc. 1239 939 2867 624 Sprint 2386 845 532 606 AT&T Data Communications Serv 3549 843 563 206 Global Crossing 6197 794 491 319 BellSouth Network Solutions, 4323 790 637 216 Time Warner Telecom 18566 743 208 6 Covad Communications 721 723 21028 298 DLA Systems Automation Center 3356 647 10923 445 Level 3 Communications, LLC 3561 634 2513 432 Cable & Wireless USA 209 627 3465 495 Qwest 20115 589 427 302 Charter Communications 852 512 1142 398 Telus Advanced Communications 7843 493 691 98 Adelphia Corp. 7132 449 8288 377 SBC Internet Services 6198 432 403 203 BellSouth Network Solutions, 705 429 163 271 UUNET Technologies, Inc. 27364 411 36 19 Armstrong Cable Services 22773 402 960 18 Cox Communications, Inc. Atla RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 629 2013 519 UUNET - Commercial IP service 3320 301 2470 238 Deutsche Telekom AG 3301 282 1100 272 TeliaNet Sweden 8220 279 461 265 COLT Internet - International 21502 269 40 3 NUMERICABLE is a cabled netwo 680 251 2025 239 DFN-IP service G-WiN 3246 218 476 215 Song Networks 13083 217 51 8 Mannesmann Datenverarbeitung 8708 207 114 183 Romania Data Systems S.A. 1257 205 742 178 SWIPnet Swedish IP Network 5515 201 843 147 Sonera Solution Autonomous Sy 786 176 1794 176 The JANET IP Service 719 157 288 102 LANLINK autonomous system 3215 156 908 76 France Telecom Transpac 6746 154 30 129 Dynamic Network Technologies, 8866 151 18 19 Bulgarian Telecommunication C 25186 150 154 106 France Telecom Transpac's Tra 3269 149 1259 67 TELECOM ITALIA 5400 148 207 120 BT Ignite European Backbone 3303 147 610 129 Swisscom Ltd LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6140 349 139 68 ImpSat 8151 304 439 129 UniNet S.A. de C.V. 16814 212 13 7 NSS, S.A. 11172 205 100 54 Servicios Alestra S.A de C.V 6147 194 94 20 Telefonica Del Peru 11664 171 13 26 Keytech SA 6505 137 90 94 Global One Communicaoes Ltda 7303 134 60 24 Telecom Argentina Stet-France 6503 124 164 85 AVANTEL, S.A. 11992 101 9 31 Integrated Systems 11311 88 8 26 Sinectis S.A. 6535 85 7 19 Chilesat Servicios Empresari 10481 81 32 7 Prima S.A. 11556 81 41 3 Cable-Wireless Panama 14420 80 5 33 ANDINATEL S.A. 4270 79 18 9 Red de Interconexion Universi 5639 77 8 8 Telecommunications Services o 15311 76 21 36 Telefonica Empresas 27716 74 9 12 Eveloz 14522 72 5 8 SatNet S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 251 631 218 The Internet Solution 5536 113 16 4 Internet Egypt Network 2018 94 297 92 Tertiary Education Network 2905 93 276 81 The Internetworking Company o 20928 58 16 1 Noor Advanced Technologies AS 22750 50 3 2 >>UNKNOWN<< 24835 34 34 7 RAYA Telecom - Egypt 9129 33 3 4 UUNET Kenya 6713 31 42 10 Itissalat Al-MAGHRIB 5713 26 125 24 Telkom SA Ltd 8524 25 1 4 AUCEGYPT Autonomous System 14988 24 16 1 Botswana Telecommunications C 16637 22 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 12455 17 4 2 Jambonet Autonomous system 8346 15 7 14 SONATEL-AS Autonomous System 15706 15 4 2 Sudatel Internet Exchange Aut 21491 15 1 4 UTL On-line is RF broadband I 21280 14 2 3 Swift Global Kenya Ltd.Is an Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 18566 743 737 Covad Communications 4134 840 680 Data Communications Bureau 3549 843 637 Global Crossing 4323 790 574 Time Warner Telecom 6197 794 475 BellSouth Network Solutions, 721 723 425 DLA Systems Automation Center 9583 529 423 Satyam Infoway Ltd., 7843 493 395 Adelphia Corp. 27364 411 392 Armstrong Cable Services 22773 402 384 Cox Communications, Inc. Atla 5668 398 380 Century Telephone 6467 389 359 E.Spire Communications, Inc. 701 1273 354 UUNET Technologies, Inc. 22909 383 353 Comcast Cable Corporation 17676 370 318 XTAGE CORPORATION 4755 367 316 Videsh Sanchar Nigam Ltd. Aut 1239 939 315 Sprint 9929 344 311 China Netcom Corp. 6478 379 300 AT&T Worldnet Services 4355 389 290 EarthLink, Inc. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64512 PRIVATE 24.249.231.0/24 15218 COX Communications 64512 PRIVATE 24.249.232.0/24 15218 COX Communications 64512 PRIVATE 24.249.233.0/24 15218 COX Communications 64512 PRIVATE 24.249.234.0/24 15218 COX Communications 64512 PRIVATE 24.249.235.0/24 15218 COX Communications 65006 PRIVATE 84.18.32.0/19 33831 * 65217 PRIVATE 192.102.236.0/24 217 University of Minnes 1877 UNALLOCATED 192.108.199.0/24 1876 Southern Methodist U 22750 UNALLOCATED 196.44.64.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.64.0/19 2905 The Internetworking 22750 UNALLOCATED 196.44.65.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.66.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.67.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.68.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.69.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.70.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.71.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.72.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.73.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.74.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.75.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.76.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.77.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.78.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.79.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.80.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.81.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.82.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.83.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.84.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.85.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.86.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.87.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.88.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.89.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.90.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.91.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.92.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.93.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.94.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.95.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.224.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.224.0/20 2905 The Internetworking 22750 UNALLOCATED 196.44.225.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.226.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.227.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.228.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.229.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.230.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.231.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.232.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.233.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.234.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.235.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.236.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.237.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.238.0/24 2905 The Internetworking 22750 UNALLOCATED 196.44.239.0/24 2905 The Internetworking Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 111.0.0.0/24 7563 Korea Internet Infrastructure 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:6 /11:15 /12:62 /13:137 /14:308 /15:552 /16:8102 /17:2247 /18:3881 /19:9700 /20:10370 /21:7877 /22:10881 /23:12542 /24:81493 /25:233 /26:209 /27:113 /28:59 /29:48 /30:116 /31:0 /32:47 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 728 743 Covad Communications 6197 638 794 BellSouth Network Solutions, 2386 610 845 AT&T Data Communications Serv 7018 561 1411 AT&T WorldNet Services 3549 444 843 Global Crossing 27364 395 411 Armstrong Cable Services 702 381 629 UUNET - Commercial IP service 1239 376 939 Sprint 9583 368 529 Satyam Infoway Ltd., 4766 364 544 Korea Internet Exchange for " 701 351 1273 UUNET Technologies, Inc. 5668 346 398 Century Telephone 6198 316 432 BellSouth Network Solutions, 20115 299 589 Charter Communications 6467 286 389 E.Spire Communications, Inc. 9929 275 344 China Netcom Corp. 6517 271 298 Yipes Communications, Inc. 13609 266 309 Choice One Communications Inc 21502 266 269 NUMERICABLE is a cabled netwo 3561 257 634 Cable & Wireless USA Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:8 12:1404 13:1 15:1 16:2 17:3 18:1 20:6 24:739 32:68 33:2 38:80 40:54 44:3 47:2 52:3 55:1 56:3 57:17 60:6 61:519 62:509 63:1833 64:2543 65:2072 66:2502 67:420 68:548 69:731 70:80 80:520 81:532 82:310 83:174 84:40 111:1 128:121 129:165 130:87 131:185 132:34 134:188 135:17 136:181 137:55 138:182 139:38 140:184 141:107 142:123 143:69 144:161 145:42 146:323 147:94 148:396 149:109 150:87 151:65 152:151 153:68 154:2 155:130 156:57 157:70 158:142 159:162 160:60 161:71 162:374 163:79 164:213 165:161 166:117 167:220 168:358 169:120 170:280 171:9 192:5571 193:2894 194:2136 195:1520 196:644 198:3676 199:3282 200:3772 201:20 202:4880 203:5710 204:3382 205:2099 206:2435 207:2647 208:2273 209:3004 210:1492 211:636 212:1115 213:1198 214:131 215:30 216:3688 217:1046 218:176 219:101 220:256 221:37 222:43 End of report

1 0

routing sniffed traffic
by Patrick Arguello 08 Oct '04

08 Oct '04

In my datacenter, I have three Gig links coming in that I am sniffing using passive taps. What I want to do is feed these links into a layer 3 switch so that I can have them sent to different packet analysis boxes by destination address or packet types or ports. What should I look for in a switch for such a use -- something that can take in sniffed traffic on fiber gig links and parcel them out to different servers on copper gig links based on routing rules. Please email me your recommendation or suggestion directly and I will summarize what I find out for the list. Thanks, Patrick A. __________________________________ Do you Yahoo!? Y! Messenger - Communicate in real time. Download now. http://messenger.yahoo.com

3 3

The Cidr Report
by cidr-report＠potaroo.net 08 Oct '04

08 Oct '04

This report has been generated at Fri Oct 8 21:44:22 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 01-10-04 145932 100119 02-10-04 146075 99905 03-10-04 145755 100267 04-10-04 146184 100294 05-10-04 146297 100252 06-10-04 146316 100325 07-10-04 146253 100429 08-10-04 146340 100450 AS Summary 18121 Number of ASes in routing system 7375 Number of ASes announcing only one prefix 1392 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 86706432 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 08Oct04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 146447 100449 45998 31.4% All ASes AS18566 743 7 736 99.1% CVAD Covad Communications AS4134 814 178 636 78.1% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 789 220 569 72.1% TWTC Time Warner Telecom AS7018 1392 967 425 30.5% ATTW AT&T WorldNet Services AS6197 789 382 407 51.6% BNS-14 BellSouth Network Solutions, Inc AS22773 403 21 382 94.8% CXA Cox Communications Inc. AS27364 411 37 374 91.0% ARMC Armstrong Cable Services AS6467 390 30 360 92.3% ACSI e.spire Communications, Inc. AS701 1252 907 345 27.6% UU UUNET Technologies, Inc. AS22909 383 38 345 90.1% CMCS Comcast Cable Communications, Inc. AS1239 953 639 314 32.9% SPRN Sprint AS17676 368 61 307 83.4% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS9929 334 33 301 90.1% CNCNET-CN China Netcom Corp. AS6478 379 79 300 79.2% ATTW AT&T WorldNet Services AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS21502 269 3 266 98.9% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS4766 529 266 263 49.7% KIXS-AS-KR Korea Telecom AS14654 260 6 254 97.7% WAYPOR-3 Wayport AS9443 357 108 249 69.7% INTERNETPRIMUS-AS-AP Primus Telecommunications AS6140 370 134 236 63.8% IMPSA ImpSat AS15557 334 104 230 68.9% LDCOMNET LDCOM NETWORKS AS2386 841 612 229 27.2% ADCS-1 AT&T Data Communications Services AS1221 815 587 228 28.0% ASN-TELSTRA Telstra Pty Ltd AS25844 244 16 228 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS9583 529 306 223 42.2% SIFY-AS-IN Sify Limited AS7843 488 266 222 45.5% ADELPH-13 Adelphia Corp. AS6198 432 214 218 50.5% BNS-14 BellSouth Network Solutions, Inc AS13083 217 8 209 96.3% Mannesmann Datenverarbeitung Autonomes System AS721 718 513 205 28.6% DNIC DoD Network Information Center AS3356 647 445 202 31.2% LEVEL3 Level 3 Communications Total 16831 7286 9545 56.7% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.83.96.0/19 AS26956 NETFR NetFree Communications 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 111.0.0.0/24 AS7563 KII-AS Korea Internet Infrastructure 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.80.64.0/19 AS1 LVLT Level 3 Communications, Inc. 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.107.144.0/22 AS1 LVLT Level 3 Communications, Inc. 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.138.208.0/20 AS1 LVLT Level 3 Communications, Inc. 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.190.16.0/21 AS1 LVLT Level 3 Communications, Inc. 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.84.192.0/19 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.192.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.208.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 204.196.0.0/14 AS1 LVLT Level 3 Communications, Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.47.254.0/24 AS701 UU UUNET Technologies, Inc. 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

short Botnet list and Cashing in on DoS
by J. Oquendo 08 Oct '04

08 Oct '04

I've been slowly compiling a list of known botnets should anyone care to filter, or check them in your netblocks if someone in your range is passing off garbage, etc. Information has been passed from others admins having to deal with these pest. Care to pass on a host that you're seeing I'll post it for others to see as well. Perhaps when I have spare time, I may or may not throw up something where admins can check, add, hosts they're seeing. Don't know if I want my connection getting toasted for doing so, but it could be something informative, a-la spamhaus. Bothaus anyone? http://www.infiltrated.net/sdbot-irc-servers.txt ------------- Virus writers seek cash from chaos By John Leyden The Register http://www.theregister.co.uk/2004/10/06/vxers_cash_in/ Last month Trend Micro, the anti-virus firm, recorded a six-fold increase in malware compared to September 2003. It detected 1,485 new items of malware last month, compared to 250 new types of malicious code in the same period last year. ... Trend also records the emergence of the first JPEG virus in September, and notes that the most damaging variant of the Sasser worm - Sasser-B - is still prevalent four months after its first appearance in the wild. ------------- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

4 3

follow-on of maintenance survey
by Zhen Wu 07 Oct '04

07 Oct '04

Several hours ago, I post a survey request on the list. First, if it disturb some people, please accept my sincere apology. Second, I'd like to summarize the responses, because I think it might be interesting to some people. I got about 30 responses, which is not a big size. Most people said that they do the planned maintenance during weekday midnight. Two reasons for this. First, it's the time window that will cause the least interference of network usage; Second, it's a better time to get hold of other people (customers, vendors) than weekend if necessary. For some small or critical problems, people just fix it immediately. Some people also mentioned that they would like to major maintenance during weekend. Third, I will explain our research (routing instability) and hypothesis, which motivate this email survey. Your sharing of insight will be very helpful and appreciated. Because it's pretty long, I put the description in the end. Finally, we still warmly welcome your survey response. Thanks! Zhen ----------------------------------------------------- In the academic research society, some people argue that there is correlation between network usage and Internet routing instability (of BGP). A research done in 1996 revealed daily and weekly routing instability pattern. During the day time Internet exhibits significantly higher instability, while in the midnight we see much less instability activity. Similarly, during weekend there are much less routing instability. We revisited this study, because we believe Internet has changed a lot since 1996. We use data from public BGP archives like Oregon RouteViews. Our new results still display pretty strong daily pattern, with higher instabilities during 6AM and 6PM (PST). However, we observe less obvious weekly pattern compared to 1996. Our visual comparisons are also confirmed by more rigorous statistics method: spectrum analysis (using Fourier Transform). Meanwhile, Internet traffic still display strong weekly and diurnal patterns. So if we believe the correlation between network usage and routing instability, why we didn't see less instability during weekend? That's why I send out previous survey email to see whether people do a lot of maintenance during weekend, which might contribute to some of the instabilities observed during weekend. From current survey, my hypothesis seems not to be true. Any discussion, insight, or critique are extremely welcomed!

1 0