- Test - lists.nanog.org

RE: TCP-ACK vulnerability (was RE: SSH on the router)
by Michel Py 11 Jun '04

11 Jun '04

> Alexei Roudnev wrote: > Of course, reason can be as simple as _I have MS_ or as > complicated as _here is my girlfriend, and if this system > went down, she will be released earlier_ -:) /most common > reason was, yep, _getting IRC control_). Or "just because I can do it". I call these lame excuses, not reasons. Michel.

1 0

Weekly Routing Table Report
by Routing Table Analysis 11 Jun '04

11 Jun '04

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 12 Jun, 2004 Analysis Summary ---------------- BGP routing table entries examined: 140462 Prefixes after maximum aggregation: 84998 Unique aggregates announced to Internet: 68154 Total ASes present in the Internet Routing Table: 17399 Origin-only ASes present in the Internet Routing Table: 15103 Origin ASes announcing only one prefix: 7028 Transit ASes present in the Internet Routing Table: 2296 Transit-only ASes present in the Internet Routing Table: 72 Average AS path length visible in the Internet Routing Table: 5.1 Max AS path length visible: 26 Illegal AS announcements present in the Routing Table: 8 Non-routable prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 19 Number of addresses announced to Internet: 1312025340 Equivalent to 78 /8s, 51 /16s and 234 /24s Percentage of available address space announced: 35.4 Percentage of allocated address space announced: 58.1 Percentage of available address space allocated: 60.9 Total number of prefixes smaller than registry allocations: 64122 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 26841 Total APNIC prefixes after maximum aggregation: 13922 Prefixes being announced from the APNIC address blocks: 25076 Unique aggregates announced from the APNIC address blocks: 14019 APNIC Region origin ASes present in the Internet Routing Table: 2064 APNIC Region origin ASes announcing only one prefix: 616 APNIC Region transit ASes present in the Internet Routing Table: 337 Average APNIC Region AS path length visible: 5.2 Max APNIC Region AS path length visible: 18 Number of APNIC addresses announced to Internet: 150026240 Equivalent to 8 /8s, 241 /16s and 56 /24s Percentage of available APNIC address space announced: 68.5 APNIC AS Blocks 4608 - 4864, 7467 - 7722, 9216 - 10239 17408 - 18431, 23552 - 24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 80606 Total ARIN prefixes after maximum aggregation: 49793 Prefixes being announced from the ARIN address blocks: 62431 Unique aggregates announced from the ARIN address blocks: 21967 ARIN Region origin ASes present in the Internet Routing Table: 9241 ARIN Region origin ASes announcing only one prefix: 3287 ARIN Region transit ASes present in the Internet Routing Table: 896 Average ARIN Region AS path length visible: 4.9 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 225181216 Equivalent to 13 /8s, 107 /16s and 254 /24s Percentage of available ARIN address space announced: 74.6 ARIN AS Blocks 1 - 1876, 1902 - 2042, 2044 - 2046, 2048 - 2106 2138 - 2584, 2615 - 2772, 2823 - 2829, 2880 - 3153 3354 - 4607, 4865 - 5119, 5632 - 6655, 6912 - 7466 7723 - 8191, 10240 - 12287, 13312 - 15359 16384 - 17407, 18432 - 20479, 21504 - 23551 25600 - 26591, 26624 - 27647, 29695 - 30719 31744 - 33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 25755 Total RIPE prefixes after maximum aggregation: 18347 Prefixes being announced from the RIPE address blocks: 22551 Unique aggregates announced from the RIPE address blocks: 15075 RIPE Region origin ASes present in the Internet Routing Table: 5551 RIPE Region origin ASes announcing only one prefix: 2992 RIPE Region transit ASes present in the Internet Routing Table: 951 Average RIPE Region AS path length visible: 5.9 Max RIPE Region AS path length visible: 26 Number of RIPE addresses announced to Internet: 164243456 Equivalent to 9 /8s, 202 /16s and 40 /24s Percentage of available RIPE address space announced: 57.6 RIPE AS Blocks 1877 - 1901, 2043, 2047, 2107 - 2136, 2585 - 2614 2773 - 2822, 2830 - 2879, 3154 - 3353, 5377 - 5631 6656 - 6911, 8192 - 9215, 12288 - 13311, 15360 - 16383 20480 - 21503, 24576 - 25599, 28672 - 29695 30720 - 31743 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6111 Total LACNIC prefixes after maximum aggregation: 2260 Prefixes being announced from the LACNIC address blocks: 5737 Unique aggregates announced from the LACNIC address blocks: 3525 LACNIC Region origin ASes present in the Internet Routing Table: 381 LACNIC Region origin ASes announcing only one prefix: 110 LACNIC Region transit ASes present in the Internet Routing Table: 74 Average LACNIC Region AS path length visible: 5.5 Max LACNIC Region AS path length visible: 16 Number of LACNIC addresses announced to Internet: 15063808 Equivalent to 0 /8s, 229 /16s and 219 /24s Percentage of available LACNIC address space announced: 44.9 LACNIC AS Blocks 26592 - 26623, 27648 - 28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1146 Total AfriNIC prefixes after maximum aggregation: 676 Prefixes being announced from the AfriNIC address blocks: 781 Unique aggregates announced from the AfriNIC address blocks: 584 AfriNIC Region origin ASes present in the Internet Routing Table: 90 AfriNIC Region origin ASes announcing only one prefix: 23 AfriNIC Region transit ASes present in the Internet Routing Table: 12 Average AfriNIC Region AS path length visible: 5.3 Max AfriNIC Region AS path length visible: 16 Number of AfriNIC addresses announced to Internet: 1865728 Equivalent to 0 /8s, 28 /16s and 120 /24s Percentage of available AfriNIC address space announced: 11.1 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 1221 845 1075 613 Telstra Pty Ltd 4134 790 3660 144 Data Communications Bureau 4766 491 2896 264 Korea Internet Exchange for " 9583 451 34 138 Satyam Infoway Ltd., 4755 365 133 53 Videsh Sanchar Nigam Ltd. Aut 9443 353 69 78 Primus Telecommunications 2907 352 1841 329 SINET Japan 17676 341 5084 33 XTAGE CORPORATION 703 329 375 256 UUNET 17557 329 23 165 Pakistan Telecom 9929 323 156 33 China Netcom Corp. 2764 294 274 241 connect.com.au pty ltd 7474 263 267 206 Optus Communications Pty Ltd 9942 229 71 126 COMindico Australia 9800 224 367 62 CHINA UNICOM 9498 217 47 46 BHARTI BT INTERNET LTD. 4780 210 193 26 Digital United Inc. 17974 184 51 99 PT TELEKOMUNIKASI INDONESIA 4837 182 2019 105 chinanet IDC center beijing n 10036 181 17 169 C&M Communication Co. Ltd. ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1435 6891 998 AT&T 701 1305 8493 930 UUNET Technologies, Inc. 1239 941 3002 637 Sprint 6347 938 400 98 SAVVIS Communications Corpora 3356 890 10900 674 Level 3 Communications, LLC 4323 737 549 205 Time Warner Communications, I 209 736 3457 504 Qwest 18566 710 192 8 Covad Communications 6197 703 499 286 BellSouth Network Solutions, 6198 572 440 219 BellSouth Network Solutions, 20115 556 369 287 Charter Communications 852 516 1142 405 Telus Advanced Communications 7843 506 652 128 Adelphia Corp. 7132 452 7868 338 Southwestern Bell Internet Se 2386 431 582 232 AT&T Data Communications Serv 705 395 144 270 UUNET Technologies, Inc. 4355 393 323 103 EarthLink, Inc. 22909 390 843 25 Comcast Cable Corporation 376 385 359 112 Reseau Interordinateurs Scien 22773 385 779 53 Cox Communications, Inc. Atla RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 646 2039 539 UUNET - Commercial IP service 3320 297 2462 237 Deutsche Telekom AG 3301 277 1097 266 TeliaNet Sweden 8220 274 429 262 COLT Internet - International 1257 251 497 197 SWIPnet Swedish IP Network 680 244 2025 239 DFN-IP service G-WiN 13083 216 51 8 Mannesmann Datenverarbeitung 3246 209 468 206 Song Networks 5515 199 843 144 Sonera Solution Autonomous Sy 8708 183 112 171 Romania Data Systems S.A. 719 179 288 102 LANLINK autonomous system 3215 178 895 69 France Telecom Transpac 786 174 1794 174 The JANET IP Service 25186 167 156 116 France Telecom Transpac's Tra 6746 158 29 127 Dynamic Network Technologies, 5400 144 206 119 BT Ignite European Backbone 3269 134 1099 64 TELECOM ITALIA 3303 132 611 132 Swisscom Ltd 12302 125 18 31 MobiFon S.A. 8866 120 14 8 Bulgarian Telecommunication C LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11172 356 96 57 Servicios Alestra S.A de C.V 6140 345 140 67 ImpSat 8151 275 373 130 UniNet S.A. de C.V. 16814 203 13 7 NSS, S.A. 6147 160 82 21 Telefonica Del Peru 7303 145 53 31 Telecom Argentina Stet-France 6505 135 90 93 Global One Communicaoes Ltda 6503 130 218 88 AVANTEL, S.A. 11992 93 9 29 Integrated Systems 11556 87 57 24 Cable-Wireless Panama 6535 80 5 17 Chilesat Servicios Empresari 14420 76 5 32 ANDINATEL S.A. 14535 75 6 5 Techtel S.A. 15311 75 19 37 Telefonica Empresas 11311 73 7 20 Sinectis S.A. 5639 72 8 8 Telecommunications Services o 4270 71 18 9 Red de Interconexion Universi 14259 67 4 5 GTD Internet S.A. 10292 65 6 24 TELECOMMUNICATIONS OF JAMAICA 7080 64 4 1 Electronica y Comunicaciones AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 253 632 220 The Internet Solution 5536 111 16 4 Internet Egypt Network 2018 94 297 92 Tertiary Education Network 2905 89 276 79 The Internetworking Company o 11845 38 9 11 Data Pro Business Online 24835 31 18 6 RAYA Telecom - Egypt 9129 27 3 4 UUNET Kenya 5713 26 125 24 Telkom SA Ltd 16637 25 9 18 Johnnic e-Ventures 6713 24 38 9 Itissalat Al-MAGHRIB 8524 24 2 7 AUCEGYPT Autonomous System 12455 24 4 2 Jambonet Autonomous system 14988 24 16 1 Botswana Telecommunications C 10798 18 1 12 Standard Bank of South Africa 15706 16 2 3 Sudatel Internet Exchange Aut 12258 15 3 10 Vodacom Internet Company 8346 13 6 12 SONATEL-AS Autonomous System 17148 13 1 7 First National Bank 2609 12 26 4 Tunisia BackBone AS 15808 12 1 4 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6347 938 840 SAVVIS Communications Corpora 18566 710 702 Covad Communications 4134 790 646 Data Communications Bureau 4323 737 532 Time Warner Communications, I 6197 703 417 BellSouth Network Solutions, 7843 506 378 Adelphia Corp. 701 1305 375 UUNET Technologies, Inc. 5668 383 366 Century Telephone 22909 390 365 Comcast Cable Corporation 27364 376 357 Armstrong Cable Services 6198 572 353 BellSouth Network Solutions, 22773 385 332 Cox Communications, Inc. Atla 9583 451 313 Satyam Infoway Ltd., 4755 365 312 Videsh Sanchar Nigam Ltd. Aut 17676 341 308 XTAGE CORPORATION 1239 941 304 Sprint 11172 356 299 Servicios Alestra S.A de C.V 4355 393 290 EarthLink, Inc. 9929 323 290 China Netcom Corp. 6140 345 278 ImpSat List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 18416 UNALLOCATED 61.56.96.0/24 9919 New Century InfoComm 18416 UNALLOCATED 61.56.96.0/20 9919 New Century InfoComm 18416 UNALLOCATED 61.56.97.0/24 9919 New Century InfoComm 18416 UNALLOCATED 61.56.98.0/24 9919 New Century InfoComm 65501 PRIVATE 66.60.187.0/24 14051 Roseville Telephone 65501 PRIVATE 66.60.188.0/22 14051 Roseville Telephone 1877 UNALLOCATED 192.108.199.0/24 1876 Southern Methodist U 18412 UNALLOCATED 211.77.0.0/19 9674 Far EastTone Telecom Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 568 DISO-UNRRA 137.0.0.0/13 568 DISO-UNRRA 156.154.16.0/22 7786 Lockheed Martin IMS 158.0.0.0/13 568 DISO-UNRRA 164.234.0.0/18 721 DLA Systems Automation Center 164.234.0.0/16 721 DLA Systems Automation Center 192.43.230.0/24 4738 South Australian Academic Res 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:6 /11:15 /12:59 /13:124 /14:299 /15:518 /16:7856 /17:2058 /18:3620 /19:9410 /20:9896 /21:7260 /22:10328 /23:11735 /24:76506 /25:230 /26:252 /27:140 /28:31 /29:14 /30:69 /31:0 /32:14 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6347 715 938 SAVVIS Communications Corpora 18566 693 710 Covad Communications 7018 554 1435 AT&T 6197 534 703 BellSouth Network Solutions, 3356 504 890 Level 3 Communications, LLC 6198 401 572 BellSouth Network Solutions, 702 398 646 UUNET - Commercial IP service 701 373 1305 UUNET Technologies, Inc. 1239 373 941 Sprint 27364 364 376 Armstrong Cable Services 5668 335 383 Century Telephone 4766 312 491 Korea Internet Exchange for " 9583 302 451 Satyam Infoway Ltd., 20115 295 556 Charter Communications 9929 256 323 China Netcom Corp. 14824 255 281 NewSouth Communications Corp. 3320 247 297 Deutsche Telekom AG 690 246 282 Merit Network 25844 244 244 Skadden, Arps, Slate, Meagher 13609 237 278 Choice One Communications Inc Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 12:826 13:1 15:5 16:2 17:3 20:8 24:749 32:65 33:1 38:70 40:54 44:3 55:1 56:3 57:16 61:427 62:501 63:1820 64:1965 65:1996 66:2609 67:329 68:497 69:557 70:64 80:494 81:309 82:174 83:68 84:2 128:145 129:186 130:79 131:177 132:21 133:1 134:181 135:17 136:182 137:92 138:154 139:44 140:164 141:125 142:117 143:47 144:89 145:42 146:303 147:78 148:418 149:120 150:91 151:72 152:165 153:64 154:1 155:117 156:60 157:60 158:144 159:147 160:52 161:57 162:380 163:77 164:179 165:156 166:94 167:217 168:223 169:106 170:285 171:8 192:5560 193:2752 194:2026 195:1374 196:558 198:3715 199:3095 200:3491 201:8 202:4636 203:5603 204:3098 205:2068 206:2283 207:2493 208:2227 209:2921 210:1425 211:566 212:977 213:1192 214:62 215:30 216:3686 217:927 218:164 219:108 220:228 221:28 222:46 End of report

1 0

MD5 BGP performance on a VXR?
by Ben Buxton 11 Jun '04

11 Jun '04

Has anyone done any concrete testing on how well a 7206VXR with an NPE-300 can handle BGP MD5? The box in question has about 25 sessions and is pushing 150Mbps, with a 75% cpu load. I'm curious to know if it's the MD5 taking all the CPU. Thanks, Ben

2 1

RE: SSH on the router - was( IT security people sleep well)
by McBurnett, Jim 11 Jun '04

11 Jun '04

Ok back to the previous premise.. Linux with an IPSEC server load.. IPSEC to the Linux box, use Telnet or ??? to connect to the routers on the management VLAN/Net and your done.... Aside from that, Use ACL's out the wazoo on the VTY lines and limit access to that to say 1 SSH enabled router or 1 IPSEC enabled router... Jim ->-----Original Message----- ->From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of ->Rubens Kuhl Jr. ->Sent: Monday, June 07, 2004 8:08 AM ->To: nanog(a)merit.edu; Michael.Dillon(a)radianz.com ->Subject: Re: SSH on the router - was( IT security people sleep well) -> -> -> -> ->I'd rather use IPSEC than SSH to connect to routers or to a ->secure gateway ->and then to routers. Flaw history in IPSEC is much better ->than SSH, IPSEC ->can easily be used to move files with FTP or TFTP (does your ->router/client ->suport SCP ? SFTP ?)... -> ->Unfortunately, IOS costs more to have IPSEC. -> -> ->Rubens -> ->----- Original Message ----- ->From: <Michael.Dillon(a)radianz.com> ->To: <nanog(a)merit.edu> ->Sent: Monday, June 07, 2004 7:39 AM ->Subject: SSH on the router - was( IT security people sleep well) -> -> ->> ->> > complaining that cisco charges extra for such a critical ->component is ->> > exactly the right thing to do; it is fucking scary. ->> > ->> > every damn network device which used to have telnet ->should ship with ->> > ssh, it's free. ->> ->> Why? ->> ->> The typical network architecture of an ISP sees routers located in ->> large clusters in a PoP or on a customer's site directly connected ->> to a PoP. Since it is dead simple to place a 1U Linux box or similar ->> SPARC server in a PoP to act as a secure gateway, why should router ->> vendors encourage laziness and sloppiness? IMHO routers should not ->> have SSH at all and should not accept any packets directed to them ->> unless they are coming from a small set of known addresses on the ->> network operator's management network. ->> ->> Once you open the router to SSH from arbitrary locations on the ->> Internet you also open the router to DDoS from arbitrary ->locations and ->> to attacks from people with inside info (SSH keys stolen or ->otherwise). ->> ->> It makes more sense to funnel everything through secure gateways and ->> then use SSH as a second level of security to allow staff to connect ->> to the secure gateways from the Internet. Of course these secure ->> gateways are more than just security proxies; they can also contain ->> diagnostic tools, auditing functions, scripting capability, etc. ->> ->> Now there is nothing fundamentally wrong with ADDING to that type ->> of architecture by enabling SSH between the routers and the security ->> gateways. But I believe that it is fundamentally wrong to consider ->> SSH on the router to be equivalent to opening the router to ->any staff ->> member, anytime, anywhere on the Internet. There are still possible ->> man in the middle attacks that cannot be protected against by SSH. ->> Consider the case of a staff member lounging in the backyard on a ->> lazy Saturday afternoon with their iBook. They have an ->802.11 wireless ->> LAN at home so they telnet to their Linux box in the kitchen and run ->> SSH to the router. Ooops! ->> ->> The only way to protect against that sort of situation is ->to encourage ->> everyone to be security-minded and not take risks where the ->network is ->> concerned. Funneling all access to routers through a secure ->gateway is ->> part of that security-mindedness and is just plain good practice. ->> ->> --Michael Dillon ->> ->> -> ->

7 11

The Cidr Report
by cidr-report＠potaroo.net 11 Jun '04

11 Jun '04

This report has been generated at Fri Jun 11 21:43:32 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 04-06-04 137884 95186 05-06-04 136784 95165 06-06-04 136790 95427 07-06-04 137242 95750 08-06-04 137787 95839 09-06-04 137594 95788 10-06-04 137680 95901 11-06-04 137772 95814 AS Summary 17314 Number of ASes in routing system 7019 Number of ASes announcing only one prefix 1414 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 64935424 Largest address span announced by an AS (/32s) AS568 : DISOUN DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 11Jun04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 137806 95798 42008 30.5% All ASes AS6347 940 160 780 83.0% SAVV SAVVIS Communications Corporation AS4134 738 158 580 78.6% CHINANET-BACKBONE No.31,Jin-rong Street AS18566 710 169 541 76.2% CVAD Covad Communications AS4323 736 205 531 72.1% TWTC Time Warner Telecom AS7018 1414 979 435 30.8% ATTW AT&T WorldNet Services AS6197 702 321 381 54.3% BNS-14 BellSouth Network Solutions, Inc AS7843 506 128 378 74.7% ADELPH-13 Adelphia Corp. AS701 1288 922 366 28.4% UU UUNET Technologies, Inc. AS22909 390 33 357 91.5% CMCS Comcast Cable Communications, Inc. AS27364 376 38 338 89.9% ARMC Armstrong Cable Services AS6198 568 233 335 59.0% BNS-14 BellSouth Network Solutions, Inc AS22773 385 61 324 84.2% CXAB Cox Communications Inc. Atlanta AS1239 944 639 305 32.3% SPRN Sprint AS11172 354 56 298 84.2% Servicios Alestra S.A de C.V AS17676 339 50 289 85.3% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS9929 316 33 283 89.6% CNCNET-CN China Netcom Corp. AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS6478 305 48 257 84.3% ATTW AT&T WorldNet Services AS6140 390 157 233 59.7% IMPSA ImpSat AS209 739 507 232 31.4% QWEST-4 Qwest AS1221 849 617 232 27.3% ASN-TELSTRA Telstra Pty Ltd AS14654 233 5 228 97.9% WAYPOR-3 Wayport AS25844 243 16 227 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS9583 453 228 225 49.7% SATYAMNET-AS Satyam Infoway Ltd., AS3356 890 675 215 24.2% LEVEL3 Level 3 Communications AS4766 476 264 212 44.5% KIX Korea Internet Exchange for "96 World Internet Exposition AS9443 357 155 202 56.6% INTERNETPRIMUS-AS-AP Primus Telecommunications AS2386 431 234 197 45.7% ADCS-1 AT&T Data Communications Services AS5668 383 192 191 49.9% CIH-12 CenturyTel Internet Holdings, Inc. AS6327 208 28 180 86.5% SHAWC-2 Shaw Communications Inc. Total 17044 7410 9634 56.5% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS568 DISOUN DISO-UNRRA 137.0.0.0/13 AS568 DISOUN DISO-UNRRA 138.136.0.0/13 AS568 DISOUN DISO-UNRRA 158.0.0.0/13 AS568 DISOUN DISO-UNRRA 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS568 DISOUN DISO-UNRRA 198.97.80.0/20 AS568 DISOUN DISO-UNRRA 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS568 DISOUN DISO-UNRRA 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS568 DISOUN DISO-UNRRA 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS568 DISOUN DISO-UNRRA 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.84.0.0/16 AS701 UU UUNET Technologies, Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS568 DISOUN DISO-UNRRA 199.114.128.0/18 AS568 DISOUN DISO-UNRRA 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 DISOUN DISO-UNRRA 199.123.0.0/18 AS568 DISOUN DISO-UNRRA 199.123.16.0/20 AS568 DISOUN DISO-UNRRA 199.123.80.0/21 AS568 DISOUN DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.142.0/24 AS30362 HAWAI-1 Hawaii-Pacific Teleport 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.123.96.0/20 AS9288 COMCEN-AS-AP Com-Cen Pty Ltd 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.141.160.0/24 AS9237 HUTCHCA-AS BTN Access Limited 202.141.190.0/24 AS10026 ANC Asia Netcom Corporation 202.141.191.0/24 AS4637 REACH Reach Network Border AS 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 204.69.144.0/22 AS5668 CIH-12 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.41.32.0/19 AS14824 NCC-105 NewSouth Communications Corp. 206.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.169.219.0/24 AS189 GNTY Genuity 209.169.223.0/24 AS189 GNTY Genuity 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL-33 Telesat International Ltd. 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.18.224.0/21 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.133.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.135.0/24 AS11937 TRXI TRX Inc. 216.145.152.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications 222.196.0.0/15 AS4538 ERX-CERNET-BKB China Education and Research Network Center 222.198.0.0/16 AS4538 ERX-CERNET-BKB China Education and Research Network Center Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

RE: TCP-ACK vulnerability (was RE: SSH on the router)
by Michel Py 11 Jun '04

11 Jun '04

> Alexei Roudnev wrote: > Even if I (if been a hacker) scan your networks and find > this switch (and you did not moved it out of routable P), > I will have not any idea, what is it about, where this > switch is, and have not any reason to break it... You (being a hacker) need a _reason_ to break into something? Where does this come from? Michel.

2 1

Input needed on a EFF research paper...
by Tim Pozar 11 Jun '04

11 Jun '04

Hi guyz, long time... The Electronic Frontier Foundation is currently writing a research paper geared towards ISPs and other content providers on how to be CALEA and DMCA-safe. EFF is looking to get in contact with technical staff at ISPs (both wireless and wired) and content providers (i.e. Ebay, Yahoo, etc) who could give us some information about current logging practices. In addition, we would also like to hear from any providers who have experience with handling DMCA court-orders/subpoenas for their logs. If so, it would be great if you could email Harlan Yu, at: harlanyu(a)eff.org Thanks in advance. Tim Pozar Technical Director Electronic Frontier Foundation -- GPG Fingerprint: 4821 CFDA 06E7 49F3 BF05 3F02 11E3 390F 8338 5B04 "Be who you are and say what you feel because the people who mind don't matter and the people who matter don't mind." - Dr. Seuss

1 0

Re: Even you can be hacked
by Patrick W.Gilmore 11 Jun '04

11 Jun '04

On Jun 10, 2004, at 11:49 PM, David Krikorian wrote: > Sometimes the provider shares the responsibility with the offender. > For example, I can't get my telephone demark inside my house, so it > is unlocked, and open to all comers. This is not, nor has ever been > within my control. Since I'm not allowed to secure the line it is the > provider, who prevents me from having a vaguely secured line, who > enabled > the theft of service, and should take some share of the responsibility. Not a valid comparison. The ISP did not leave the Internet line outside your house, nor have they any responsibility to secure your systems. In fact, most users would get upset at a provider meddling in their systems. > Similarly, if I'm under an attack that is consuming my bandwidth, I'd > expect > to be responsible for if I had a way of guaging the bandwidth (to > detect > the abuse) and if the ISP did its part to shut down the attack. You have your router, it gives you stats. And what part is the ISP supposed to do to shut down an attack? Did you pay for the ISP to monitor your line and proactively shut down an attack? Did you give the ISP permission to filter traffic of certain types? If you get /.'ed or run a promotion on your web site and the ISP filters the traffic as an attack, will you be upset? > If I complained to the ISP about the attack, and nothing were done > about it > in a reasonable amount of time, driving up my cost for the month (or > two) due > to bursting, I would be unwilling to take responsibility for the added > cost. > The ISP's delay resulted in the ISP charging me more money. I think > most > reasonably people would consider that extra charge to be undeserved, > unfair, > and unreasonable. If you ask the ISP to take action and they do not, it is a _TOTALLY_ different story. Of course, in the original post, the ISP informed the end user of his problem, and even forgave his first month's bill. Wouldn't you say the ISP was being more than nice? > I think one metric of "reasonableness" is how big a surprise the added > cost > would be. If my phone/electric/net bill is double for one month, > that's an > unpleasant surprise, but not a big deal. If it consumes my whole > month's > paycheck and I didn't knowingly contribute to the overrun, I will be > outraged > (and possibly bankrupt). Service companies generally don't want to > outrage > (or bankrupt) their customers. That's a fine metric, but by no means a perfect one. Many companies have "flash crowds", get /.'ed, run promotions, get mentioned in a blog somewhere, etc., etc., etc. The resulting traffic can be very out-of-profile, but still very wanted. Nice ISPs call or e-mail the customer and mention this change. But there is no responsibility to do so in any contract I have seen that does not include extra charges for security purposes. >> Take some responsibility. > > Yes, when that responsibility doesn't already belong to someone else > who can > be held accountable, and/or when I had some warning in advance of the > risk > I was taking. You signed a contract that said you would pay for usage. Therefore you had warning. You are over 18, you are supposed to know what you are doing when you sign a contract. (And if you don't, no one cares anyway. :) As for someone else being held accountable, that depends on your definition of "can be held accountable". The worm writers are "accountable" in my book, but they cannot "be held accountable" because they will likely never be caught. (And if they are, no way will they be able to pay.) Should the ISP have to pay their transit bill while you get to blame a faceless perpetrator? Or do you hold any responsibility and need to pay for the bandwidth your system consumed on the line you agreed to purchase, whether you personally sent the bits or not? -- TTFN, patrick

1 0

Canadian RBOC (Aliant) SONET ring sabotage
by Eric Kuhnke 11 Jun '04

11 Jun '04

http://news.google.com/news?hl=en&edition=us&ie=UTF-8&newsclusterurl=http:/… shorter URL: http://ln.ooz.net/27115 Several days ago somebody cut both sides of a SONET ring in Newfoundland. From the article: The Atlantic Communications and Technical Workers, the union representing the striking employees, was quick to say they weren't responsible for the massive phone failure, with a spokesman adding that union members have been warned not to tamper with phone-company equipment.

1 0

Aggregating 16,000 gigE ports in one campus?
by Eric Kuhnke 11 Jun '04

11 Jun '04

http://science.slashdot.org/science/04/06/02/0038223.shtml?tid=126 Reading the posts by slashdot readers (and CWU alumni) it seems as if they are upgrading to gigabit using the existing 62/125 and singlemode installed in the late 1980s. Some people say it's rate-limited to 10Mbps... But if it isn't, how do you aggregate 16,000 gigabit ports in one campus? Tons of Cisco 6509/6513s with MT-RJ cards? I'd like to see the commission cheque for the sales rep that sold them the gear. :-)

1 0