- Test - lists.nanog.org

Spike in traffic to Google&Akamai caches?
by Hank Nussbacher 21 Apr '20

21 Apr '20

Did anyone notice a huge jump in traffic today between 11:30-11:40 (GMT) directed at Google and Akamai caches coming from Amazon and Google? Gaming updates? Thanks, Hank Caveat: The views expressed above are solely my own and do not express the views or opinions of my employer

3 2

SINGLEHOP-LLC AS32475 - Contact
by James Braunegg 21 Apr '20

21 Apr '20

Dear All Does anyone have a contact at SingleHop AS32475 which you can share with me ? Looking for someone who is responsible for BGP / Routing / AS Path etc ? Looking forward to hearing from you Kindest Regards James Braunegg [cid:image001.png@01D280A4.01865B60] 1300 769 972<tel:1300%20769%20972> / 0488 997 207<tel:1300%20769%20972> james(a)micron21.com<mailto:james@micron21.com> www.micron21.com/<http://www.micron21.com/> [cid:image002.png@01D280A4.01865B60]<http://www.micron21.com/> [cid:image003.png@01D280A4.01865B60]<https://www.facebook.com/micron21/> [cid:image004.png@01D280A4.01865B60]<https://twitter.com/micron21> Follow us on Twitter<https://twitter.com/micron21> for important service and system updates. This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.

1 0

FCC Enforcement Bureau requests Traceback Consortium
by Sean Donelan 20 Apr '20

20 Apr '20

Enforcement Bureau requests interested consortia to file Letters of Intent to conduct private traceback efforts pursuant to section 13(d) of the TRACED Act https://www.fcc.gov/document/eb-requests-letters-intent-traceback-consortium The Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act (TRACED Act) was signed into law on December 30, 2019. Congress required the Federal Communications Commission, not later than 90 days after that date, to “issue rules to establish a registration process for the registration of a single consortium that conducts private-led efforts to trace back the origin of suspected unlawful robocalls.” The Commission adopted rules to require any consortium that seeks to be selected as the single registered consortium to file a Letter of Intent to conduct private traceback efforts and directed the Enforcement Bureau to issue a public notice to that effect no later than April 28th each year. [...]

1 0

Re: IS-IS Error (FRR)
by Mark Tinka 20 Apr '20

20 Apr '20

So we've been discussing this on Slack. It seems the packet handlers for IS-IS in FRR and how they work on FreeBSD is not completely optimized (not an issue on Linux). FRR-based IS-IS on FreeBSD is sending PSNP's that are 6,020 bytes large. However, FreeBSD's BPF (Berkeley Packet Filter) has a packet data limit of 4,096 bytes. This is what is causing the error. While it is possible to set the IIH MTU in FRR with the "lsp-mtu" command, there is not way to set the PSNP MTU. In short, IS-IS on FRR does not understand that there is an MTU limit for PSNP's on FreeBSD. I'm working with the IS-IS FRR team, but as of now, no idea on if/when there will be a fix for this. While routes are being successfully exchanged between FRR and Cisco IOS XE for IS-IS, this is a show-stopper! So for the moment, I cannot recommend anyone runs IS-IS on FRR in production. As it stands, it appears that this is the only thing standing in the way of a successful deployment, as far as simple Anycast services go. Will keep you all posted as this develops. Mark. On 18/Apr/20 16:34, Tony Li wrote: > > No, IIH’s are padded, hot PSNP’s. > > Tony > >> On Apr 18, 2020, at 3:08 AM, adamv0025(a)netconsultings.com wrote: >> >> >> >> Just shooting in the dark, Isn’t the PSNP padded to some ISIS defined >> max MTU and that somehow fails due to mismatch on em0 L2 MTU? >> >> >> >> adam >> >> *From:*NANOG <nanog-bounces(a)nanog.org> *On Behalf Of *Mark Tinka >> *Sent:* Friday, April 17, 2020 11:05 AM >> *To:* nanog(a)nanog.org >> *Subject:* IS-IS Error (FRR) >> >> >> >> Hi all. >> >> I'm almost there getting IS-IS to work without issue. I'm now faced >> with the following error log: >> >> 2020/04/17 10:02:01 ISIS: IS-IS bpf: could not transmit packet on >> em0: Input/output error >> 2020/04/17 10:02:01 ISIS: [EC 67108865] ISIS-Snp (1): Send L2 PSNP on >> em0 failed >> >> This repeats every second. >> >> Anyone know what this could be? >> >> Systems is FreeBSD-12.1-RELEASE-p3. >> >> Despite the error, IS-IS is running and routing is good, talking to a >> Cisco IOS XE implementation on the other side. So the error is >> throwing me off. >> >> No feedback from the Slack feed, Google doesn't say much, and waiting >> to hear back from the FRR list. >> >> Mark. >>

2 2

Constant Abuse Reports / Borderline Spamming from RiskIQ
by Kushal R. 19 Apr '20

19 Apr '20

From the past few months we have been receiving a constant stream of abuse reports from a company that calls themselves RiskIQ (RiskIQ.com) The problem isn’t the abuse reports themselves but the way they send them. We receive copies of the report, on our sales, billing, TECH-POCs and almost everything other email address of ours that is available publicly. It doesn’t end there, they even online on our website and start using our support live chat and as recently as tomorrow they I see that they have now started using Twitter (@riskiq_irt) to do the same. We understand these reports and deal with them as per our policies and timelines but this constant spamming by them from various channels is not appreciated. Does anyone have a similar experience with them?

22 39

IS-IS Error (FRR)
by Mark Tinka 18 Apr '20

18 Apr '20

Hi all. I'm almost there getting IS-IS to work without issue. I'm now faced with the following error log: 2020/04/17 10:02:01 ISIS: IS-IS bpf: could not transmit packet on em0: Input/output error 2020/04/17 10:02:01 ISIS: [EC 67108865] ISIS-Snp (1): Send L2 PSNP on em0 failed This repeats every second. Anyone know what this could be? Systems is FreeBSD-12.1-RELEASE-p3. Despite the error, IS-IS is running and routing is good, talking to a Cisco IOS XE implementation on the other side. So the error is throwing me off. No feedback from the Slack feed, Google doesn't say much, and waiting to hear back from the FRR list. Mark.

2 1

RE: attribution
by Jakob Heitz (jheitz) 17 Apr '20

17 Apr '20

From version 6.3.1, IOS XR supports "if community length" in route-policy. Regards, Jakob. -----Original Message----- Date: Fri, 17 Apr 2020 12:29:33 +0100 From: <adamv0025(a)netconsultings.com> On the point of as-path length limit, Yes I know of at least one tier-1 that does it and since I left some 8 years back I do it everywhere I go. In addition to the above (best common practice, id' say) -on junos you can do community length limiting -and on cisco you can do attribute filtering -hence my question to this forum some time back about whether folks do filter all the "experiments" for the sake of running a successful business (paraphrasing...) adam

1 0

Weekly Routing Table Report
by cscora＠apnic.net 17 Apr '20

17 Apr '20

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 18 Apr, 2020 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 806496 Prefixes after maximum aggregation (per Origin AS): 306294 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 393395 Total ASes present in the Internet Routing Table: 67775 Prefixes per ASN: 11.90 Origin-only ASes present in the Internet Routing Table: 58227 Origin ASes announcing only one prefix: 24284 Transit ASes present in the Internet Routing Table: 9548 Transit-only ASes present in the Internet Routing Table: 293 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 43 Max AS path prepend of ASN ( 27978) 31 Prefixes from unregistered ASNs in the Routing Table: 1135 Number of instances of unregistered ASNs: 1138 Number of 32-bit ASNs allocated by the RIRs: 31315 Number of 32-bit ASNs visible in the Routing Table: 25896 Prefixes from 32-bit ASNs in the Routing Table: 119373 Number of bogon 32-bit ASNs visible in the Routing Table: 21 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 887 Number of addresses announced to Internet: 2854764032 Equivalent to 170 /8s, 40 /16s and 62 /24s Percentage of available address space announced: 77.1 Percentage of allocated address space announced: 77.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 271711 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 212063 Total APNIC prefixes after maximum aggregation: 62008 APNIC Deaggregation factor: 3.42 Prefixes being announced from the APNIC address blocks: 205066 Unique aggregates announced from the APNIC address blocks: 85529 APNIC Region origin ASes present in the Internet Routing Table: 10525 APNIC Prefixes per ASN: 19.48 APNIC Region origin ASes announcing only one prefix: 2927 APNIC Region transit ASes present in the Internet Routing Table: 1567 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 25 Number of APNIC region 32-bit ASNs visible in the Routing Table: 5590 Number of APNIC addresses announced to Internet: 766930816 Equivalent to 45 /8s, 182 /16s and 111 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-141625 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 235932 Total ARIN prefixes after maximum aggregation: 108500 ARIN Deaggregation factor: 2.17 Prefixes being announced from the ARIN address blocks: 233397 Unique aggregates announced from the ARIN address blocks: 118491 ARIN Region origin ASes present in the Internet Routing Table: 18432 ARIN Prefixes per ASN: 12.66 ARIN Region origin ASes announcing only one prefix: 6715 ARIN Region transit ASes present in the Internet Routing Table: 1916 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 22 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3207 Number of ARIN addresses announced to Internet: 1079340032 Equivalent to 64 /8s, 85 /16s and 108 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 229210 Total RIPE prefixes after maximum aggregation: 105765 RIPE Deaggregation factor: 2.17 Prefixes being announced from the RIPE address blocks: 225876 Unique aggregates announced from the RIPE address blocks: 132192 RIPE Region origin ASes present in the Internet Routing Table: 27022 RIPE Prefixes per ASN: 8.36 RIPE Region origin ASes announcing only one prefix: 11738 RIPE Region transit ASes present in the Internet Routing Table: 3805 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 9112 Number of RIPE addresses announced to Internet: 724136832 Equivalent to 43 /8s, 41 /16s and 115 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 105790 Total LACNIC prefixes after maximum aggregation: 24575 LACNIC Deaggregation factor: 4.30 Prefixes being announced from the LACNIC address blocks: 107128 Unique aggregates announced from the LACNIC address blocks: 46384 LACNIC Region origin ASes present in the Internet Routing Table: 9739 LACNIC Prefixes per ASN: 11.00 LACNIC Region origin ASes announcing only one prefix: 2419 LACNIC Region transit ASes present in the Internet Routing Table: 1843 Average LACNIC Region AS path length visible: 5.5 Max LACNIC Region AS path length visible: 43 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 7312 Number of LACNIC addresses announced to Internet: 174516992 Equivalent to 10 /8s, 102 /16s and 235 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 22365 Total AfriNIC prefixes after maximum aggregation: 4707 AfriNIC Deaggregation factor: 4.75 Prefixes being announced from the AfriNIC address blocks: 34142 Unique aggregates announced from the AfriNIC address blocks: 10047 AfriNIC Region origin ASes present in the Internet Routing Table: 1383 AfriNIC Prefixes per ASN: 24.69 AfriNIC Region origin ASes announcing only one prefix: 485 AfriNIC Region transit ASes present in the Internet Routing Table: 270 Average AfriNIC Region AS path length visible: 5.1 Max AfriNIC Region AS path length visible: 23 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 675 Number of AfriNIC addresses announced to Internet: 109336832 Equivalent to 6 /8s, 132 /16s and 89 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 5397 681 640 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4651 4192 73 ERX-CERNET-BKB China Education and Rese 7552 3398 1330 22 VIETEL-AS-AP Viettel Group, VN 45899 3145 1802 105 VNPT-AS-VN VNPT Corp, VN 7713 2709 831 503 TELKOMNET-AS-AP PT Telekomunikasi Indon 9808 2544 9043 62 CMNET-GD Guangdong Mobile Communication 4766 2288 11102 560 KIXS-AS-KR Korea Telecom, KR 9498 2259 434 221 BBIL-AP BHARTI Airtel Ltd., IN 4755 2135 441 192 TATACOMM-AS TATA Communications formerl 9394 2041 4914 20 CTTNET China TieTong Telecommunications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11492 4121 274 632 CABLEONE, US 7155 4034 280 28 VIASAT-SP-BACKBONE, US 16509 3978 7874 1759 AMAZON-02, US 22773 3533 2969 150 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3363 1324 92 SHAW, CA 16625 3005 1585 2171 AKAMAI-AS, US 30036 2365 362 91 MEDIACOM-ENTERPRISE-BUSINESS, US 209 2357 5076 535 CENTURYLINK-US-LEGACY-QWEST, US 5650 2300 2981 1621 FRONTIER-FRTR, US 26484 2196 137 172 IKGUL-26484, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5780 1603 138 UNI2-AS, ES 31334 4765 484 13 KABELDEUTSCHLAND-AS, DE 39891 3651 203 20 ALJAWWALSTC-AS, SA 8551 3193 379 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2957 460 2024 AKAMAI-ASN1, EU 12389 2492 2251 725 ROSTELECOM-AS, RU 9009 2168 229 1172 M247, GB 34984 2056 350 563 TELLCOM-AS, TR 9121 1878 1691 18 TTNET, TR 13188 1606 100 36 TRIOLAN, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6463 3307 604 Uninet S.A. de C.V., MX 10620 3357 530 519 Telmex Colombia S.A., CO 11830 2671 369 63 Instituto Costarricense de Electricidad 6503 1689 327 387 Axtel, S.A.B. de C.V., MX 7303 1553 1032 259 Telecom Argentina S.A., AR 28573 1366 2242 203 CLARO S.A., BR 13999 1302 486 329 Mega Cable, S.A. de C.V., MX 6147 1139 379 39 Telefonica del Peru S.A.A., PE 3816 1090 565 144 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 957 112 71 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1470 393 22 LINKdotNET-AS, EG 24835 1109 574 25 RAYA-AS, EG 36992 1093 1539 76 ETISALAT-MISR, EG 36903 890 467 88 MT-MPLS, MA 29571 592 68 12 ORANGE-COTE-IVOIRE, CI 6713 579 1863 34 IAM-AS, MA 37342 480 32 1 MOVITEL, MZ 36935 411 522 44 Vodafone-, EG 23889 368 231 15 MauritiusTelecom, MU 15399 337 45 10 WANANCHI-, KE Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6463 3307 604 Uninet S.A. de C.V., MX 12479 5780 1603 138 UNI2-AS, ES 7545 5397 681 640 TPG-INTERNET-AP TPG Telecom Limited, AU 31334 4765 484 13 KABELDEUTSCHLAND-AS, DE 4538 4651 4192 73 ERX-CERNET-BKB China Education and Rese 11492 4121 274 632 CABLEONE, US 7155 4034 280 28 VIASAT-SP-BACKBONE, US 16509 3978 7874 1759 AMAZON-02, US 39891 3651 203 20 ALJAWWALSTC-AS, SA 22773 3533 2969 150 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 5780 5642 UNI2-AS, ES 7545 5397 4757 TPG-INTERNET-AP TPG Telecom Limited, AU 31334 4765 4752 KABELDEUTSCHLAND-AS, DE 4538 4651 4578 ERX-CERNET-BKB China Education and Research Net 7155 4034 4006 VIASAT-SP-BACKBONE, US 39891 3651 3631 ALJAWWALSTC-AS, SA 11492 4121 3489 CABLEONE, US 22773 3533 3383 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3398 3376 VIETEL-AS-AP Viettel Group, VN 6327 3363 3271 SHAW, CA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 174 COGENT-174, US 62485 UNALLOCATED 8.23.229.0/24 3356 LEVEL3, US 32985 UNALLOCATED 8.28.31.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 14109 UNALLOCATED 8.38.252.0/24 3356 LEVEL3, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 26584 UNALLOCATED 8.42.62.0/23 209 CENTURYLINK-US-LEGACY-QWEST, 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 40544 UNALLOCATED 12.0.33.0/24 6461 ZAYO-6461, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.137.192.0/24 Origin: 31798 CANAD-86-31798, CA Transit: 174 COGENT-174, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY 27.126.158.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:10 /9:11 /10:38 /11:99 /12:285 /13:579 /14:1165 /15:1915 /16:13351 /17:8183 /18:13912 /19:25839 /20:40482 /21:48011 /22:99841 /23:82315 /24:469179 /25:1281 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4780 5780 UNI2-AS, ES 31334 4610 4765 KABELDEUTSCHLAND-AS, DE 11492 3241 4121 CABLEONE, US 6327 3151 3363 SHAW, CA 7155 3125 4034 VIASAT-SP-BACKBONE, US 39891 2801 3651 ALJAWWALSTC-AS, SA 22773 2751 3533 ASN-CXA-ALL-CCI-22773-RDC, US 8551 2652 3193 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 8151 2191 6463 Uninet S.A. de C.V., MX 30036 2112 2365 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1654 2:1145 3:30 4:19 5:3337 6:50 8:1403 9:1 11:1 12:1797 13:500 14:2268 15:75 16:9 17:299 18:81 20:83 23:3492 24:2269 25:2 27:2555 31:3051 32:103 34:3 35:41 36:925 37:3290 38:1938 39:327 40:124 41:3599 42:701 43:2095 44:196 45:14051 46:3708 47:286 49:1433 50:1243 51:93 52:1130 54:270 55:650 56:6 57:52 58:1775 59:1188 60:718 61:2234 62:2278 63:1942 64:5091 65:2300 66:4901 67:2859 68:1228 69:3853 70:1430 71:679 72:2877 74:2600 75:1434 76:681 77:2818 78:1876 79:2366 80:1898 81:1606 82:1298 83:1175 84:1200 85:2544 86:549 87:1707 88:1131 89:2702 90:315 91:7903 92:1493 93:2457 94:2647 95:3978 96:1092 97:335 98:954 99:974 100:87 101:983 102:887 103:23488 104:3387 105:376 106:830 107:1971 108:702 109:3710 110:1807 111:2000 112:1606 113:1403 114:1542 115:1843 116:1793 117:2091 118:2152 119:1738 120:835 121:1043 122:2432 123:1985 124:1555 125:2025 128:1350 129:943 130:631 131:1839 132:762 133:300 134:1305 135:305 136:610 137:845 138:2165 139:986 140:638 141:931 142:899 143:1229 144:973 145:329 146:1481 147:1038 148:2129 149:1173 150:810 151:1292 152:1488 153:379 154:4749 155:1045 156:3398 157:1104 158:827 159:1947 160:1920 161:1014 162:3046 163:856 164:1462 165:1272 166:535 167:1627 168:3679 169:514 170:4269 171:769 172:1923 173:2464 174:1014 175:1015 176:2629 177:4208 178:3042 179:1497 180:2321 181:2525 182:3082 183:1130 184:2409 185:16350 186:3792 187:2692 188:4055 189:2254 190:8623 191:1442 192:10347 193:7448 194:6117 195:4369 196:3310 197:1881 198:6107 199:5954 200:7201 201:5207 202:10511 203:10167 204:4520 205:3126 206:3249 207:3282 208:4050 209:4427 210:4011 211:2007 212:3310 213:3061 214:1171 215:61 216:5933 217:2404 218:876 219:609 220:2034 221:897 222:992 223:1468 End of report

1 0

attribution
by Randy Bush 17 Apr '20

17 Apr '20

Apr 12 17:57:42 r0.iad rpd[1752]: Prefix Send failed ! 103.148.41.0/24 bgp_rt_trace_too_big_message:1209 path attribute too big. Cannot build update. so some idiot is barfing out a ridiculous as_path. dear lazynet, is there an easy way to get attribution for this stupidity? i.e. the as_path. e.g. a nice query to ris or rv given the prefix, 103.148.41.0/24, and the uct time, Apr 12 17:57:42. randy

8 8

Re: UDP/123 policers & status
by Hal Murray 17 Apr '20

17 Apr '20

Steven Sommars said: > The secure time transfer of NTS was designed to avoid amplification attacks. I work on NTP software (ntpsec). I have a couple of low cost cloud servers in the pool where I can test things and collect data. I see bursts of 10K to several million packets "from" the same IP Address at 1K to 10K packets per second. Ballpark of 100 events per day, depending on the size cutoff. I saw one that lasted for most of a day at 1K packeets/sec. All the packets I've seen have been vanilla NTP requests - no attempt at amplification. I'm only checking a very small fraction of the garbage. I haven't seen any pattern in the target IP Address. Reverse DNS names that look like servers are rare. I see legitimate NTP requests from some of the targets. Would data be useful? If so, who, what, ... (poke me off list) I don't see any good solution that a NTP server can implement. If I block them all, the victim can't get time. If I let some fraction through, that just reduces the size of the DDoS. I don't see a fraction that lets enough through so the victim is likely to get a response to a legitimate request without also getting a big chunk of garbage. I'm currently using a fraction of 0. If the victim is using several servers, one server getting knocked out shouldn't be a big deal. (The pool mode of ntpd should drop that system and use DNS to get another.) If NTS is used, it would be possible to include the clients IP Address in the cookie and only respond to requests with cookies that were issued to the client. That has privacy/tracking complications. ---------- I don't want to start a flame war, but why isn't BCP 38 widely deployed? Can somebody give me a pointer to a talk at NANOG or such? What fraction of the world does implement BCP 38? I'd also be interested in general background info on DDoS. Who is DDoS-ing whom and/or why? Is this gamers trying to get an advantage on a competitor? Bad guys making a test run to see if the server can be used for a real run? Is DDoS software widely available on the dark web? ... -- These are my opinions. I hate spam.

6 29