- Test - lists.nanog.org

System security data about to be made public (Cobell v Norton)
by Eric Brunner-Williams in Portland Maine 24 Jan '04

24 Jan '04

The background is probably not of interest to many on NANOG, but the operational art of the Department of the Interior's network operators and security staff, and the host managers of the Indian Trust systems, which has been rated the worst in the Federal Goverment, is about to enter the public record, minus host and subnet identifiers, and any bits that "might jeopardize the security of individual Indian Trust Data". The text of the order is at this URL: http://www.indiantrust.com/_pdfs/20040121FileSMITReportsinRecord.pdf In a nutshell, its an Iraq-sized pile of thousands of individual trust accounts -- a major regional bank -- with no known audit trail, and an open access policy until quite recently. If I get the doc-u-boxen, I'll be happy to share with other NANOGers, as the DOI appears unable to move its operational art from an "F" to a "D" without assistance. Eric P.S. Triballaw list cc'd.

1 0

DRAFT agenda for NANOG 30
by Susan Harris 23 Jan '04

23 Jan '04

Greetings - here's a subject-to-change agenda for Miami: ------------------------------------------------------- NANOG 30 Agenda - 10th Anniversary Meeting ! February 8-10, 2004 Miami, Florida Sunday Tutorials ---------------- 1:30 - 3:00 p.m Customer-Triggered Real-Time Black Holes Level: Introductory Chris Morrow, UUNET; Tim Battles, AT&T 1:30 - 3:00 p.m. MPLS-Based Layer 2 VPNs Level: Intermediate Florin Balus and Mike Loomis, Nortel 3:00 - 3:30 p.m. BREAK 3:30 - 5:00 p.m. Provider-Provisioned Virtual Private Networks Level: Introductory Ina Minei, Juniper 3:30 - 5:00 p.m. MPLS Fast Reroute Level: Intermediate/Advanced Joe Soricelli, Juniper Monday, October 20 ------------------ 9:00 a.m. Welcome, Introductions Eric Aupperle, Merit Andy Burnette, Terremark Susan Harris, Merit 9:20 a.m. Implications of Recent Legislation on Provider Operations Diane Sidebottom, Dept. of Homeland Security 9:50 a.m. A Short History of the 'Net Scott Bradner, Harvard Univ. 10:30 a.m. BREAK 10:45 a.m. End-to-end, Spam, and DoS: Threats to the Model That Made the Internet Great Phil Karn, QUALCOMM 11:15 a.m. 10 Years of Corporate Change in the NANOG & IP Backbone Community Martin Levy, moderator;John Curran, XO Communication Doug Humphrey 12:00 p.m. LUNCH (on your own) 1:30 p.m. A Decade of Technology Pitfalls and Successes Dino Farinacci, Procket 2:00 p.m. Where Did the NAPs Come From and When Did They Turn Into Exchange Points? Steve Feldman, CNET 2:20 p.m. Anniversary Retrospective: Where We've Been & Where We're Headed Sue Hares, NextHop, Moderator Paul Francis, Cornell Univ. Steve Bellovin, AT&T Research Dino Farinacci, Procket 3:00 p.m. BREAK 4:20 p.m. Research Forum -------------- - Achievable Comprehensive Delay Reporting from Routers - Synchronising Software Clocks on the Internet Darryl Veitch, Sprintlabs - A Distributed Control Plane Architecture to Support Millisecond Routing Convergence Hormuzd Khosravi, Intel - IETF NETCONF Working Group Update Eliot Lear, Cisco - Nemecis: A Tool to Analyze the IRR Registries Georgos Siganos, UC Riverside - In-Progress Research Designing Support for Troubleshooting Complex Network Problems Barbara Mirel, Univ. of Mich. Monday Evening BOFs & Key Signing --------------------------------- 7:30 - 9:00 p.m. ISP Security and NSP-SEC BOF IV Barry Raveendran Greene, Cisco, moderator 9:00 - 10:30 p.m. Peering BOF VII Bill Norton, Equinix, moderator 9:00 - 10:30 p.m. Troubleshooting the Hardest Network Engineering Problems Barbara Mirel, Univ. of Michigan, moderator 9:00 p.m. PGP Key Signing Party Majdi Abbas, Lattice Networks, moderator Tuesday, October 21 ------------------- 9:00 a.m. Listen and Whisper: Security Mechanisms for BGP L. Subramanian, V. Roth, I. Stoica, S. Shenker, and R.H. Katz, UC Berkeley 9:20 a.m. Making Sense of BGP Tina Wong, Van Jacobson, Cengiz Alaettinoglu, Packet Design 9:50 a.m. Hot Potatoes Heat Up BGP Routing Renata Teixeira, UCSD; Jennifer Rexford, AT&T; Tim Griffen, Intel 10:20 a.m. BREAK 10:40 a.m. MPLS Over Various IP Encapsulations Mark Townsley, Cisco 11:10 a.m. IAB Concerns About Permanent Deployment of Edge-Based Filtering Itojun Hagino, IETF Internet Architecture Board 11:25 a.m. Regional Internet Registries Statistics and Activities Ray Plazk, ARIN 11:45 a.m. How to Kill Worms and Viruses with Policy Pontifications Scott Bradner, Harvard 12:00 p.m. LUNCH (on your own) 1:30 p.m. Real-time Global Routing Metrics Jim Cowie, Andy T. Ogielski, B.J. Premore, Eric A. Smith, & Todd Underwood, Renesys 1:50 p.m. Root Cause Analysis of Internet Routing Dynamics Matthew C. Caesar, L. Subramanian, Randy H. Katz, UC Berkeley 2:10 p.m. Airborne Contagion: Effects of a Worm on Wireless Networking Christopher Chin, UC Berkeley 2:30 p.m. Life on a University Network: An Architecture for Automatically Detecting, Isolating, and Cleaning Infected Hosts Eric Gauthier, Boston University 2:50 p.m. Analysis of the DDoS Attack Against SCO David Moore and Colleen Shannon, CAIDA 3:10 p.m. BREAK 3:30 p.m. BGP Testing: Why Be so Negative? Brent Imhoff, Wiltel; Scott Poretsky, Quarry 3:50 p.m. Exchange Point Update Celeste Anderson, USC LAAP, moderator Jay Adelson, Equinix Tom Bechly, MAE Services Itojun Hagino, DIX-IE Mike Hughes, LINX Christopher Quesada, Switch and Data Akio Sugeno, NYIIX/LAIIX 4:50 p.m. Adjourn Susan Harris, Merit

1 0

Re: network mapping and data viz.
by sgorman1＠gmu.edu 23 Jan '04

23 Jan '04

A useful set of references and links can be found here: http://www.cybergeography.org/mapping.html ----- Original Message ----- From: Chris Horry <zerbey(a)wibble.co.uk> Date: Friday, January 23, 2004 11:42 am Subject: Re: network mapping and data viz. > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Jamie Reid wrote: > | I have been looking for a tool that will visualize traceroute > data in > | a graph. Skitter looks ideal, but its availability is quite limited. > | > | I have tried Netmap (netmap.sourceforge.net) and have been > | mucking about with Graphviz (graphviz.org) in general. > | However, the problem of building a map from traceroute data > | (with graphviz anyway) is sorting out the unique paths. Technically > | possible, but I don't want to re-invent the wheel if I don't > have to. > | > | Tulip (tulip-software.org) is a framework that something like this > | could be written in, as is any other viz tool (opendx.org, etc...) > | The tools from Opte (opte.org) aren't available yet. > | > | Is there a tool that you are currently using to represent large > | traceroute graphs that is available under a gpl/bsd/open license? > | Even something based on Dot or Neato? > > You might want to try VisualRoute, www.visualroute.com. > > Chris > > - -- > Chris Horry "Winter is the season in which people > zerbey(a)wibble.co.uk try to keep the house as warm as it was > PGP: DSA/2B4C654E it was in the summer, when they complained > Amateur Radio: KG4TSM about the heat" --Author Unknown > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.4 (MingW32) > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > > iD8DBQFAEU7mnAAeGCtMZU4RAp+eAJ974r5L20XoIeJAr/FakiyAhuYzxACff9pZ > 2v8ZJOy1g8c0kBF8+8gwwUI= > =43qW > -----END PGP SIGNATURE----- > >

1 0

network mapping and data viz.
by Jamie Reid 23 Jan '04

23 Jan '04

I have been looking for a tool that will visualize traceroute data in a graph. Skitter looks ideal, but its availability is quite limited. I have tried Netmap (netmap.sourceforge.net) and have been mucking about with Graphviz (graphviz.org) in general. However, the problem of building a map from traceroute data (with graphviz anyway) is sorting out the unique paths. Technically possible, but I don't want to re-invent the wheel if I don't have to. Tulip (tulip-software.org) is a framework that something like this could be written in, as is any other viz tool (opendx.org, etc...) The tools from Opte (opte.org) aren't available yet. Is there a tool that you are currently using to represent large traceroute graphs that is available under a gpl/bsd/open license? Even something based on Dot or Neato? Thanks, -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324

3 2

Re: sniffer/promisc detector
by Michael.Dillon＠radianz.com 23 Jan '04

23 Jan '04

>> > Uhm, that would be wrong. This is simply "security through obscurity". >> Yes, it is wrong for the _smart books_. But it works in real life. >Actually, an automated script or manual scan can find it trivially. If security through obscurity was useless then the USAF would never have developed the stealth bomber. The British forces in North Africa would never have employed Jasper Maskelyne and his magic gang and Rommel would have defeated the British at El Alamein. And the Serbs would not have been able to retrieve the vast majority of their tanks from Kosovo after NATO's bombing campaign. The fact is that camouflage is a legitimate defense technique and can be used in networks as well as in the real world. Nobody would suggest that camouflage is sufficient to protect something but war is a numbers game. If you can use obscurity and camouflage to divert a percentage of the attacks against you then you can pay more attention to the much tougher security issues which sometimes can only be resolved through constant vigilance. --Michael Dillon

8 14

Re: What's the best way to wiretap a network?
by Eriks Rugelis 23 Jan '04

23 Jan '04

Sean Donelan wrote: > Assuming lawful purposes, what is the best way to tap a network > undetectable to the surveillance subject, not missing any > relevant data, and not exposing the installer to undue risk? 'Best' rarely has a straight-forward answer. ;-) Lawful access is subject to many of the same scaling issues which we confront in building up our networks. Solutions which can work well for 'small' access or hosting providers may not be sensible for larger scale environment. If you have only a low rate of warrants to process per year, and if your facilities are few in number and/or geographically close together, and if your 'optimum' point of tap insertion happens to be a link which can be reasonably traced without very expensive ASIC-based gear and if your operation can tolerate breaking open the link to insert the tap, and if the law enforcement types agree that the surveillance target is unlikely to notice the link going down to insert the tap... then in-line taps such as Finisar or NetOptics can be quite sensible. If your operation can tolerate the continuing presence of the in-line tap and you only ever need a small number of them then leaving the taps permanently installed may be entirely reasonable. On the other hand, if your environment consists of a large number (100's) of potential tapping points, then you will quickly determine that in-line taps have very poor scaling properties. a) They are not rack-dense b) They require external power warts c) They are not cheap (in the range of US$500 each) d) Often when you have that many potential tapping points, you are likely to be processing a larger number of warrants in a year. An in-line tap arrangement will require a body to physically install the recording equipment and cables to the trace-ports on the tap. You may also need to make room for more than one set of recording gear at each site. Large-scale providers will probably want to examine solutions based on support built directly into their traffic-carrying infrastructure (switches, routers.) You should be watchful for law enforcement types trying dictate a 'solution' which is not a good fit to your own business environment. There are usually several ways of getting them the data which they require to do their jobs. Eriks --- Eriks Rugelis -- Senior Consultant Netidea Inc. Voice: +1 416 876 0740 63 Charlton Boulevard, FAX: +1 416 250 5532 North York, Ontario, E-mail: eriks(a)netideainc.ca Canada M2M 1C1 PGP public key is here: http://members.rogers.com/eriks.rugelis/certs/pgp.htm

8 9

Re: sniffer/promisc detector
by Michael.Dillon＠radianz.com 23 Jan '04

23 Jan '04

>Mine too. So nmap sucks if you want to quickly identify daemons running on >strange ports. No big deal. This discussion wasn't about nmap to start with. >The point of the discussion was wether it made sense to run services on >non-standard ports to deter cr4x0rs. And I feel it doesn't. Actually, the point of the discussion was whether security through obscurity (A.K.A. camouflage techniques) is a legitimate tool in the security arsenal. >As long as a sshd yells "SSH-1.99" at you the moment you connect to it's >port there's no hiding sshd. Like I said, ... camouflage ... It doesn't stop with port numbers. And if you do camouflage the real SSH and run a honeypot on port 22 that looks like SSH, where do you think the haxors will put their attention first? >A well-tuned iptables or equivalent, on the other hand, might hide the >presence of daemons completely for anyone except the designated users. How >is that for obscurity? Great idea. The whole point of camouflage and obscurity techniques is to confuse observers/attackers and this fits the bill. I agree that security through obscurity should always be backed up with real hardening where possible, but I also believe that multiple techniques working in synergy is best. --Michael Dillon

1 0

The Cidr Report
by cidr-report＠potaroo.net 23 Jan '04

23 Jan '04

This report has been generated at Fri Jan 23 21:47:51 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 16-01-04 129605 90929 17-01-04 129642 90924 18-01-04 129749 90922 19-01-04 129759 90881 20-01-04 129614 90911 21-01-04 129657 91008 22-01-04 129839 91002 23-01-04 129825 91008 AS Summary 16434 Number of ASes in routing system 6593 Number of ASes announcing only one prefix 1379 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73394432 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 23Jan04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 129829 91050 38779 29.9% All ASes AS4323 690 209 481 69.7% TW-COMM Time Warner Communications, Inc. AS6197 696 267 429 61.6% BATI-ATL BellSouth Network Solutions, Inc AS701 1379 956 423 30.7% ALTERNET-AS UUNET Technologies, Inc. AS7018 1365 943 422 30.9% ATT-INTERNET4 AT&T WorldNet Services AS7843 510 122 388 76.1% ADELPHIA-AS Adelphia Corp. AS27364 382 33 349 91.4% ACS-INTERNET Armstrong Cable Services AS6198 590 250 340 57.6% BATI-MIA BellSouth Network Solutions, Inc AS4134 657 332 325 49.5% CHINANET-BACKBONE No.31,Jin-rong Street AS22909 331 26 305 92.1% DNEO-OSP1 Comcast Cable Communications, Inc. AS22773 332 32 300 90.4% CCINET-2 Cox Communications Inc. Atlanta AS1239 952 668 284 29.8% SPRINTLINK Sprint AS4355 382 99 283 74.1% ERMS-EARTHLNK EARTHLINK, INC AS9583 296 19 277 93.6% SATYAMNET-AS Satyam Infoway Ltd., AS1221 908 649 259 28.5% ASN-TELSTRA Telstra Pty Ltd AS17676 293 42 251 85.7% GIGAINFRA Softbank BB Corp. AS6347 329 82 247 75.1% DIAMOND SAVVIS Communications Corporation AS25844 243 16 227 93.4% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS209 724 507 217 30.0% ASN-QWEST Qwest AS6140 345 129 216 62.6% IMPSAT-USA ImpSat AS6478 260 44 216 83.1% ATT-INTERNET3 AT&T WorldNet Services AS14654 211 3 208 98.6% WAYPORT Wayport AS11305 236 42 194 82.2% INTERLAND-NET1 Interland Incorporated AS2386 418 229 189 45.2% INS-AS AT&T Data Communications Services AS20115 599 415 184 30.7% CHARTER-NET-HKY-NC Charter Communications AS4519 199 17 182 91.5% MAAS Maas Communications AS6327 205 28 177 86.3% SHAW Shaw Communications Inc. AS9929 199 30 169 84.9% CNCNET-CN China Netcom Corp. AS15270 208 39 169 81.2% AS-PAETEC-NET PaeTec.net -a division of PaeTecCommunications, Inc. AS2048 249 84 165 66.3% LANET-1 State of Louisiana AS5668 322 159 163 50.6% AS-5668 CenturyTel Internet Holdings, Inc. Total 14510 6471 8039 55.4% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI Andara High Speed Internet c/o Halifax Cable Ltd. 64.62.126.0/23 AS25700 SWIFTDESK SWIFTDESK VENTURE 66.41.192.0/18 AS13367 CCCH-AS3 Comcast Cable Communications Holdings, Inc 66.114.0.0/19 AS16526 BIRCH-TELECOM Birch Telecom, Inc. 66.114.28.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.29.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.30.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 66.114.31.0/24 AS15083 INFOLINK-MIA-US Infolink Communication Services, Inc. 69.8.128.0/17 AS7260 NORLIGHT Norlight Telecommunications 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.41.194.0/24 AS1982 ASN-NWNEXUS Northwest Nexus Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.136.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.154.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.114.156.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.160.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 200.120.0.0/16 AS22047 CL-VPNS-LACNIC VTR BANDA ANCHA S.A. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.16.0/22 AS17888 SINGTEL-HK SingTel Hong Kong Limited 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.72.112.0/22 AS22351 INTELSAT-1 INTELSAT 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.128.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.142.0/24 AS30362 HPT-ASN Hawaii-Pacific Teleport 202.86.171.0/24 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.172.0/23 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 202.86.190.0/24 AS4750 loxley-th Loxley Information Co., Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 203.32.4.0/23 AS7617 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.86.2.0/23 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 204.69.144.0/22 AS5668 AS-5668 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBIT Exobit Networks Inc. 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 209.87.192.0/20 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.196.192.0/19 AS1784 GNAPS Global NAPs Networks 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 GIEUROPE Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.36.46.0/24 AS7176 GENUITY-AS7176 Genuity 216.36.47.0/24 AS7176 GENUITY-AS7176 Genuity 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

AT&T carrying rfc1918 on the as7018 backbone?
by Brett Watson 23 Jan '04

23 Jan '04

First, yes I know I should call AT&T but I want to know if anyone else sees this problem: I have a customer that is multi-homed to AT&T and WCOM. They accept "default" via BGP from both providers and announce a handful of prefixes to both providers. Given that they receive default, it's just the same as if they had a *static* default to both providers. The customer installed a "network mapping tool" today and suddenly discovered they were seeing RFC1918 addresses in the map (hundreds of them) that were *not* part of the customer's internal network. It turns out that from what we can tell, insightbb.com (an AT&T sub or customer) is probably unintentionally leaking 10/8 and AT&T is propogating that across their network. Since the customer defaults for any "unknown" destination, they're crossing the AT&T network. If my customer had been taking full routing, with appropriate filters of course, they wouldn't be seeing this. But given that they are taking default, they see it. So I just wanted to see if anyone that is defaulting to AT&T is seeing this same problem just to verify that what we're seeing is correct (for my customer's edification). Yes, I'm calling AT&T now :) -b

8 13

Large Mail Provider Throttling
by Edward Gray 23 Jan '04

23 Jan '04

As probably many of you have already experienced, we have been hit with mailbombs with forged Hotmail (or other large provider) addresses recently. This has resulted in the large provider throttling our mail flow which forces messages to be placed into our local queue for retry at a later time. This ultimately has resulted in our customers reporting delays in emailing such large providers (ie. Hotmail). To protect ourselves from delayed mail, we have implemented several system wide rules to block Autoreplies and Undeliverable messages from being sent to the large providers. Unfortunately, this has resulted in many complaints from customers (since it's all or nothing). We have so far, left these rules enabled 24x7 since, the system already becomes degraded by the time we realize an event is occurring. I was interested to see what other techniques or steps people have taken to protect themselves from these types of threats and whether they have managed to handle a large #of accounts without preventing AutoReplies and Undeliverable messages to large providers. For instance, has anyone been able to approach such large providers and request special handling of mail coming from their system (higher throttling threshold for example)? Thanks in advance, Edward Gray Director, Operations & Networks Tucows.com Co. egray(a)tucows.com

3 3