- Test - lists.nanog.org

RE: attribution
by Jakob Heitz (jheitz) 17 Apr '20

17 Apr '20

From version 6.3.1, IOS XR supports "if community length" in route-policy. Regards, Jakob. -----Original Message----- Date: Fri, 17 Apr 2020 12:29:33 +0100 From: <adamv0025(a)netconsultings.com> On the point of as-path length limit, Yes I know of at least one tier-1 that does it and since I left some 8 years back I do it everywhere I go. In addition to the above (best common practice, id' say) -on junos you can do community length limiting -and on cisco you can do attribute filtering -hence my question to this forum some time back about whether folks do filter all the "experiments" for the sake of running a successful business (paraphrasing...) adam

1 0

Weekly Routing Table Report
by cscora＠apnic.net 17 Apr '20

17 Apr '20

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 18 Apr, 2020 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 806496 Prefixes after maximum aggregation (per Origin AS): 306294 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 393395 Total ASes present in the Internet Routing Table: 67775 Prefixes per ASN: 11.90 Origin-only ASes present in the Internet Routing Table: 58227 Origin ASes announcing only one prefix: 24284 Transit ASes present in the Internet Routing Table: 9548 Transit-only ASes present in the Internet Routing Table: 293 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 43 Max AS path prepend of ASN ( 27978) 31 Prefixes from unregistered ASNs in the Routing Table: 1135 Number of instances of unregistered ASNs: 1138 Number of 32-bit ASNs allocated by the RIRs: 31315 Number of 32-bit ASNs visible in the Routing Table: 25896 Prefixes from 32-bit ASNs in the Routing Table: 119373 Number of bogon 32-bit ASNs visible in the Routing Table: 21 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 887 Number of addresses announced to Internet: 2854764032 Equivalent to 170 /8s, 40 /16s and 62 /24s Percentage of available address space announced: 77.1 Percentage of allocated address space announced: 77.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 271711 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 212063 Total APNIC prefixes after maximum aggregation: 62008 APNIC Deaggregation factor: 3.42 Prefixes being announced from the APNIC address blocks: 205066 Unique aggregates announced from the APNIC address blocks: 85529 APNIC Region origin ASes present in the Internet Routing Table: 10525 APNIC Prefixes per ASN: 19.48 APNIC Region origin ASes announcing only one prefix: 2927 APNIC Region transit ASes present in the Internet Routing Table: 1567 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 25 Number of APNIC region 32-bit ASNs visible in the Routing Table: 5590 Number of APNIC addresses announced to Internet: 766930816 Equivalent to 45 /8s, 182 /16s and 111 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-141625 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 235932 Total ARIN prefixes after maximum aggregation: 108500 ARIN Deaggregation factor: 2.17 Prefixes being announced from the ARIN address blocks: 233397 Unique aggregates announced from the ARIN address blocks: 118491 ARIN Region origin ASes present in the Internet Routing Table: 18432 ARIN Prefixes per ASN: 12.66 ARIN Region origin ASes announcing only one prefix: 6715 ARIN Region transit ASes present in the Internet Routing Table: 1916 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 22 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3207 Number of ARIN addresses announced to Internet: 1079340032 Equivalent to 64 /8s, 85 /16s and 108 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 229210 Total RIPE prefixes after maximum aggregation: 105765 RIPE Deaggregation factor: 2.17 Prefixes being announced from the RIPE address blocks: 225876 Unique aggregates announced from the RIPE address blocks: 132192 RIPE Region origin ASes present in the Internet Routing Table: 27022 RIPE Prefixes per ASN: 8.36 RIPE Region origin ASes announcing only one prefix: 11738 RIPE Region transit ASes present in the Internet Routing Table: 3805 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 9112 Number of RIPE addresses announced to Internet: 724136832 Equivalent to 43 /8s, 41 /16s and 115 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 105790 Total LACNIC prefixes after maximum aggregation: 24575 LACNIC Deaggregation factor: 4.30 Prefixes being announced from the LACNIC address blocks: 107128 Unique aggregates announced from the LACNIC address blocks: 46384 LACNIC Region origin ASes present in the Internet Routing Table: 9739 LACNIC Prefixes per ASN: 11.00 LACNIC Region origin ASes announcing only one prefix: 2419 LACNIC Region transit ASes present in the Internet Routing Table: 1843 Average LACNIC Region AS path length visible: 5.5 Max LACNIC Region AS path length visible: 43 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 7312 Number of LACNIC addresses announced to Internet: 174516992 Equivalent to 10 /8s, 102 /16s and 235 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 22365 Total AfriNIC prefixes after maximum aggregation: 4707 AfriNIC Deaggregation factor: 4.75 Prefixes being announced from the AfriNIC address blocks: 34142 Unique aggregates announced from the AfriNIC address blocks: 10047 AfriNIC Region origin ASes present in the Internet Routing Table: 1383 AfriNIC Prefixes per ASN: 24.69 AfriNIC Region origin ASes announcing only one prefix: 485 AfriNIC Region transit ASes present in the Internet Routing Table: 270 Average AfriNIC Region AS path length visible: 5.1 Max AfriNIC Region AS path length visible: 23 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 675 Number of AfriNIC addresses announced to Internet: 109336832 Equivalent to 6 /8s, 132 /16s and 89 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 5397 681 640 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4651 4192 73 ERX-CERNET-BKB China Education and Rese 7552 3398 1330 22 VIETEL-AS-AP Viettel Group, VN 45899 3145 1802 105 VNPT-AS-VN VNPT Corp, VN 7713 2709 831 503 TELKOMNET-AS-AP PT Telekomunikasi Indon 9808 2544 9043 62 CMNET-GD Guangdong Mobile Communication 4766 2288 11102 560 KIXS-AS-KR Korea Telecom, KR 9498 2259 434 221 BBIL-AP BHARTI Airtel Ltd., IN 4755 2135 441 192 TATACOMM-AS TATA Communications formerl 9394 2041 4914 20 CTTNET China TieTong Telecommunications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11492 4121 274 632 CABLEONE, US 7155 4034 280 28 VIASAT-SP-BACKBONE, US 16509 3978 7874 1759 AMAZON-02, US 22773 3533 2969 150 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3363 1324 92 SHAW, CA 16625 3005 1585 2171 AKAMAI-AS, US 30036 2365 362 91 MEDIACOM-ENTERPRISE-BUSINESS, US 209 2357 5076 535 CENTURYLINK-US-LEGACY-QWEST, US 5650 2300 2981 1621 FRONTIER-FRTR, US 26484 2196 137 172 IKGUL-26484, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5780 1603 138 UNI2-AS, ES 31334 4765 484 13 KABELDEUTSCHLAND-AS, DE 39891 3651 203 20 ALJAWWALSTC-AS, SA 8551 3193 379 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2957 460 2024 AKAMAI-ASN1, EU 12389 2492 2251 725 ROSTELECOM-AS, RU 9009 2168 229 1172 M247, GB 34984 2056 350 563 TELLCOM-AS, TR 9121 1878 1691 18 TTNET, TR 13188 1606 100 36 TRIOLAN, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6463 3307 604 Uninet S.A. de C.V., MX 10620 3357 530 519 Telmex Colombia S.A., CO 11830 2671 369 63 Instituto Costarricense de Electricidad 6503 1689 327 387 Axtel, S.A.B. de C.V., MX 7303 1553 1032 259 Telecom Argentina S.A., AR 28573 1366 2242 203 CLARO S.A., BR 13999 1302 486 329 Mega Cable, S.A. de C.V., MX 6147 1139 379 39 Telefonica del Peru S.A.A., PE 3816 1090 565 144 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 957 112 71 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1470 393 22 LINKdotNET-AS, EG 24835 1109 574 25 RAYA-AS, EG 36992 1093 1539 76 ETISALAT-MISR, EG 36903 890 467 88 MT-MPLS, MA 29571 592 68 12 ORANGE-COTE-IVOIRE, CI 6713 579 1863 34 IAM-AS, MA 37342 480 32 1 MOVITEL, MZ 36935 411 522 44 Vodafone-, EG 23889 368 231 15 MauritiusTelecom, MU 15399 337 45 10 WANANCHI-, KE Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6463 3307 604 Uninet S.A. de C.V., MX 12479 5780 1603 138 UNI2-AS, ES 7545 5397 681 640 TPG-INTERNET-AP TPG Telecom Limited, AU 31334 4765 484 13 KABELDEUTSCHLAND-AS, DE 4538 4651 4192 73 ERX-CERNET-BKB China Education and Rese 11492 4121 274 632 CABLEONE, US 7155 4034 280 28 VIASAT-SP-BACKBONE, US 16509 3978 7874 1759 AMAZON-02, US 39891 3651 203 20 ALJAWWALSTC-AS, SA 22773 3533 2969 150 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 5780 5642 UNI2-AS, ES 7545 5397 4757 TPG-INTERNET-AP TPG Telecom Limited, AU 31334 4765 4752 KABELDEUTSCHLAND-AS, DE 4538 4651 4578 ERX-CERNET-BKB China Education and Research Net 7155 4034 4006 VIASAT-SP-BACKBONE, US 39891 3651 3631 ALJAWWALSTC-AS, SA 11492 4121 3489 CABLEONE, US 22773 3533 3383 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3398 3376 VIETEL-AS-AP Viettel Group, VN 6327 3363 3271 SHAW, CA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 174 COGENT-174, US 62485 UNALLOCATED 8.23.229.0/24 3356 LEVEL3, US 32985 UNALLOCATED 8.28.31.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 14109 UNALLOCATED 8.38.252.0/24 3356 LEVEL3, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 26584 UNALLOCATED 8.42.62.0/23 209 CENTURYLINK-US-LEGACY-QWEST, 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 40544 UNALLOCATED 12.0.33.0/24 6461 ZAYO-6461, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.137.192.0/24 Origin: 31798 CANAD-86-31798, CA Transit: 174 COGENT-174, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY 27.126.158.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:10 /9:11 /10:38 /11:99 /12:285 /13:579 /14:1165 /15:1915 /16:13351 /17:8183 /18:13912 /19:25839 /20:40482 /21:48011 /22:99841 /23:82315 /24:469179 /25:1281 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4780 5780 UNI2-AS, ES 31334 4610 4765 KABELDEUTSCHLAND-AS, DE 11492 3241 4121 CABLEONE, US 6327 3151 3363 SHAW, CA 7155 3125 4034 VIASAT-SP-BACKBONE, US 39891 2801 3651 ALJAWWALSTC-AS, SA 22773 2751 3533 ASN-CXA-ALL-CCI-22773-RDC, US 8551 2652 3193 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 8151 2191 6463 Uninet S.A. de C.V., MX 30036 2112 2365 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1654 2:1145 3:30 4:19 5:3337 6:50 8:1403 9:1 11:1 12:1797 13:500 14:2268 15:75 16:9 17:299 18:81 20:83 23:3492 24:2269 25:2 27:2555 31:3051 32:103 34:3 35:41 36:925 37:3290 38:1938 39:327 40:124 41:3599 42:701 43:2095 44:196 45:14051 46:3708 47:286 49:1433 50:1243 51:93 52:1130 54:270 55:650 56:6 57:52 58:1775 59:1188 60:718 61:2234 62:2278 63:1942 64:5091 65:2300 66:4901 67:2859 68:1228 69:3853 70:1430 71:679 72:2877 74:2600 75:1434 76:681 77:2818 78:1876 79:2366 80:1898 81:1606 82:1298 83:1175 84:1200 85:2544 86:549 87:1707 88:1131 89:2702 90:315 91:7903 92:1493 93:2457 94:2647 95:3978 96:1092 97:335 98:954 99:974 100:87 101:983 102:887 103:23488 104:3387 105:376 106:830 107:1971 108:702 109:3710 110:1807 111:2000 112:1606 113:1403 114:1542 115:1843 116:1793 117:2091 118:2152 119:1738 120:835 121:1043 122:2432 123:1985 124:1555 125:2025 128:1350 129:943 130:631 131:1839 132:762 133:300 134:1305 135:305 136:610 137:845 138:2165 139:986 140:638 141:931 142:899 143:1229 144:973 145:329 146:1481 147:1038 148:2129 149:1173 150:810 151:1292 152:1488 153:379 154:4749 155:1045 156:3398 157:1104 158:827 159:1947 160:1920 161:1014 162:3046 163:856 164:1462 165:1272 166:535 167:1627 168:3679 169:514 170:4269 171:769 172:1923 173:2464 174:1014 175:1015 176:2629 177:4208 178:3042 179:1497 180:2321 181:2525 182:3082 183:1130 184:2409 185:16350 186:3792 187:2692 188:4055 189:2254 190:8623 191:1442 192:10347 193:7448 194:6117 195:4369 196:3310 197:1881 198:6107 199:5954 200:7201 201:5207 202:10511 203:10167 204:4520 205:3126 206:3249 207:3282 208:4050 209:4427 210:4011 211:2007 212:3310 213:3061 214:1171 215:61 216:5933 217:2404 218:876 219:609 220:2034 221:897 222:992 223:1468 End of report

1 0

attribution
by Randy Bush 17 Apr '20

17 Apr '20

Apr 12 17:57:42 r0.iad rpd[1752]: Prefix Send failed ! 103.148.41.0/24 bgp_rt_trace_too_big_message:1209 path attribute too big. Cannot build update. so some idiot is barfing out a ridiculous as_path. dear lazynet, is there an easy way to get attribution for this stupidity? i.e. the as_path. e.g. a nice query to ris or rv given the prefix, 103.148.41.0/24, and the uct time, Apr 12 17:57:42. randy

8 8

Re: UDP/123 policers & status
by Hal Murray 17 Apr '20

17 Apr '20

Steven Sommars said: > The secure time transfer of NTS was designed to avoid amplification attacks. I work on NTP software (ntpsec). I have a couple of low cost cloud servers in the pool where I can test things and collect data. I see bursts of 10K to several million packets "from" the same IP Address at 1K to 10K packets per second. Ballpark of 100 events per day, depending on the size cutoff. I saw one that lasted for most of a day at 1K packeets/sec. All the packets I've seen have been vanilla NTP requests - no attempt at amplification. I'm only checking a very small fraction of the garbage. I haven't seen any pattern in the target IP Address. Reverse DNS names that look like servers are rare. I see legitimate NTP requests from some of the targets. Would data be useful? If so, who, what, ... (poke me off list) I don't see any good solution that a NTP server can implement. If I block them all, the victim can't get time. If I let some fraction through, that just reduces the size of the DDoS. I don't see a fraction that lets enough through so the victim is likely to get a response to a legitimate request without also getting a big chunk of garbage. I'm currently using a fraction of 0. If the victim is using several servers, one server getting knocked out shouldn't be a big deal. (The pool mode of ntpd should drop that system and use DNS to get another.) If NTS is used, it would be possible to include the clients IP Address in the cookie and only respond to requests with cookies that were issued to the client. That has privacy/tracking complications. ---------- I don't want to start a flame war, but why isn't BCP 38 widely deployed? Can somebody give me a pointer to a talk at NANOG or such? What fraction of the world does implement BCP 38? I'd also be interested in general background info on DDoS. Who is DDoS-ing whom and/or why? Is this gamers trying to get an advantage on a competitor? Bad guys making a test run to see if the server can be used for a real run? Is DDoS software widely available on the dark web? ... -- These are my opinions. I hate spam.

6 29

BIRD / BGP-ORR experiences?
by Deepak Jain 16 Apr '20

16 Apr '20

Thinking about setting up BGP-ORR on some BIRD VMs (https://bird.network.cz) for lab purposes, I'm sure its more than sufficient. Does anyone use these in production? Any thoughts, experiences, caveats? Do we even like BGP ORR? Thanks in advance, Deepak

6 21

RE: Route aggregation w/o AS-Sets
by Jakob Heitz (jheitz) 15 Apr '20

15 Apr '20

Suppose you had a set of customers than all announced to you a set of routes and all those routes complete an aggregate and you announce only the aggregate to those customers and you include an AS_SET with it then those customers will drop your aggregate, thinking there is an AS-loop and those customers will not be able to reach each other. An AS_SET does not prevent routing loops and can prevent correct routing. But you must include the ATOMIC_AGGREGATE attribute, so that someone else does not disaggregate your aggregate that does not have the AS_SET. Regards, Jakob. -----Original Message----- Date: Tue, 14 Apr 2020 02:32:37 -0700 From: Matthew Petach <mpetach(a)netflight.com> I generally would use the atomic-aggregate knob to generate aggregate routes for blocks I controlled, when the downstream ASN information was not necessary to propagate outside my network (usually cases where I had multiple internal ASNs, but all connectivity funneled though a single upstream pathway.) If you have discrete downstream ASNs with potentially different external pathways, you shouldn't be generating aggregate routes that cover them; that's just bad routing 101. Thus, my rules for aggregation always came down to: 1) is there more than one external/upstream pathway for the ASN and prefix? If so, don't aggregate. 2) is redundant, reliable connectivity between all the external gateway routers that would be announcing the aggregate? If not, don't generate a covering aggregate. 3) If there's only a single upstream pathway through you for the ASN and prefix, and that won't be changing any time soon (eg, you have a collection of downstream datacenter with their own ASNs and prefixes, but they all route through a common backbone), then use the atomic-aggregate option to suppress the more specific AS_PATH information, and simply announce the space as a single aggregate coming from your backbone ASN. That way, there's no confusion with RPKI and AS_SETS; all you're ever announcing are simple AS_PATHs for a given prefix. Best of luck! Matt

2 2

Fastly.com security team
by Josh Luthman 15 Apr '20

15 Apr '20

Can someone from Fastly reach out to me? I believe you're blocking some of our IPs. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373

2 1

Route aggregation w/o AS-Sets
by Lars Prehn 15 Apr '20

15 Apr '20

Hi everyone, how exactly do you aggregate routes? When do you add the AS_SET attribute, when do you omit it? How does the latter interplay with RPKI? Best regards, Lars

6 7

Netflix Open Connect
by John Alcock 14 Apr '20

14 Apr '20

I figure Netflix is busy just like every other company during the pandemic. I sent a request several weeks ago for Netflix OCA. I have not heard anything. Anyone from Netflix contact me off list? I am in charge of AS395437 John

2 1

Re: Constant Abuse Reports / Borderline Spamming from RiskIQ
by Tom Beecher 14 Apr '20

14 Apr '20

Jonathan- First time posts to the list are , pardon the phrase, quarantined out of the gate. Once it's obvious that it's not spam or a problem individual, that gets released and future messages go straight out. This is still a manual process done by one person in the NANOG organization, so it's not always that fast. You likely just got caught up in that, and didn't do anything incorrectly. On Tue, Apr 14, 2020 at 4:25 AM Jonathan M <jonathan-m(a)riskiq.net> wrote: > My bad - This was not for Rich but for Kushal who initiated the thread > taking the survey about us being "spammers". I'm contacting the > administrator at Nanog.org now to figure out what I did wrong to properly > post to the thread as I haven't used the mailing list before. Have a good > day. Jonathan > > On Mon, Apr 13, 2020 at 9:55 PM Jonathan M <jonathan-m(a)riskiq.net> wrote: > >> This may not have been approved yet by the moderator but was sent to the >> list about 30 minutes ago....I'm sorry, but I'm just learning how to use >> this list and I am concerned that my post was not properly sent--thus, >> replying to the thread here....thx >> >> Re: https://twitter.com/RiskIQ_IRT/status/1249721818602070016?s=20 >> >> Hi, Rich, >> >> I hope you are well. If you ever encounter an incident that you think >> could have been handled better on our end, we aspire to continuously >> improve, and don't claim to be perfect. >> >> Rather than blocking our abuse notification to the abuse POC, it would be >> better to let us know you have concerns so that we can improve our >> communications. Blocking us on Twitter and shutting off communication is no >> better than if we were to just send your customer's domain to a blacklist >> without notifying you of a compromise so that it can possibly be patched. >> Let's keep the overall goal in mind -- it's to make the internet safer by >> flagging possible violations of your acceptable use policy that may lead to >> compromised personal data or sensitive credentials of innocent visitors >> online. >> >> Before anything is posted to Twitter, I personally review the history of >> the event to see if we have exhausted all reasonable steps to mitigate >> harmful cyber activity or operations on network infrastructure short of >> always picking up the phone or using the fax. While we have attempted to do >> that in the past for each event, there is just too much harmful cyber >> activity going on for us to be relying on phone calls to try and reach the >> abuse team to ask that our ticket be prioritised after an unreasonable >> period of time has elapsed. We have thousands of escalations that we need >> to handle and most of the time though not across the board, when we call to >> reach the abuse teams, we are unsuccessful in reducing the time to >> remediation. >> >> The goal is not to shame anyone per se. It's to create more transparency >> regarding a problem that we all need to work together on. It's similar to >> where nation state actors use public attribution as part of mitigation to >> improve the Internet from cyber attacks. We did not block you on Twitter, >> and after every tweet, we follow-up to the appropriate abuse point of >> contact to raise visibility of the matter, as well as to the PR team, and >> applicable computer emergency response teams as well as attorney generals >> or other applicable authorities. >> >> We all need to work together. Please do not hesitate to contact me and I >> will make sure we are meeting our end of aspiring to be a good partner, and >> look forward to working with you as the need arises. Stay safe and healthy >> in these challenging times, and we wish you the best. >> >> I'm happy to discuss offline as well. We can set up a time to discuss and >> improve the mitigation workflow on both sides. >> >> Best regards, >> Jonathan Matkowsky >> VP, Digital Risk >> RiskIQ, Inc. >> >> >> On Mon, Apr 13, 2020 at 9:41 PM Tom Beecher <beecher(a)beecher.cc> wrote: >> >>> I would agree that Twitter is not a primary place for abuse reporting. >>> >>> If they are reporting things via your correct abuse channel and you are >>> indeed handling them within 48 business hours, then I would also agree this >>> much extra spray and pray is excessive. However RiskIQ is known to be >>> pretty responsible, so if they are doing this they likely feel like they >>> are NOT getting appropriate responses from you and are resorting to >>> scorched earth. Have you attempted to reach out to them and make sure they >>> have the proper direct channel for abuse reporting? >>> >>> On Mon, Apr 13, 2020 at 1:45 PM Kushal R. <kushal.r(a)h4g.co> wrote: >>> >>>> All abuse reports that we receive are dealt within 48 business hours. >>>> As far as that tweet is concerned, it’s pending for 16 days because they >>>> have been blocked from sending us any emails due to the sheer amount of >>>> emails they started sending and then our live support chats. >>>> >>>> We send our abuse reports to, but we don’t spam them to every publicly >>>> available email address for an organisation, it isn’t difficult to lookup >>>> the Abuse POC for an IP or network and just because you do not get a >>>> response in 24 hours does not mean you forward the same report to 10 other >>>> email addresses. Similarly twitter isn’t a place to report abuse either. >>>> >>>> >>>> On Apr 13, 2020 at 9:37 PM, <Rich Kulawiec <rsk(a)gsp.org>> wrote: >>>> >>>> >>>> On Mon, Apr 13, 2020 at 07:55:37PM +0530, Kushal R. wrote: > We understand these reports and deal with them as per our policies and timelines but this constant spamming by them from various channels is not appreciated. Quoting from: https://twitter.com/RiskIQ_IRT/status/1249696689985740800 which is dated 9:15 AM 4/13/2020: 5 #phishing URLs on admin12.find-textbook[.]com were reported to @Host4Geeks (Walnut, CA) from as far back as 16 days ago, and they are all STILL active 16 days is unacceptable. If you can't do better than that -- MUCH better -- then shut down your entire operation today as it's unworthy of being any part of the Internet community. ---rsk >>>> >>>> >>>> > ******************************************************************* > This message was sent from RiskIQ, and is intended only for the designated > recipient(s). It may contain confidential or proprietary information and > may be subject to confidentiality protections. If you are not a designated > recipient, you may not review, copy or distribute this message. If you > receive this in error, please notify the sender by reply e-mail and delete > this message. Thank you. > > *******************************************************************

1 0