- Test - lists.nanog.org

rr.level3.net on autopilot?
by Jon Lewis 10 Sep '19

10 Sep '19

I was doing some IRR clean-up and after a few successful updates, I'm no longer able to alter or delete our objects in rr.level3.com. Emails to rpsl(a)level3.com result in no action and no response. I've tried reaching out to the Level3 (Centurylink) NOC via email and phone, and can't seem to find anyone who knows what rr.level3.com is, much less knows who to talk to about troubleshooting. Anyone know who (if anyone) keeps the wheels spinning on the Level3 IRR? ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

4 5

Google DNS Oddity
by Chip Marshall 09 Sep '19

09 Sep '19

Hello, I'm seeing an oddity when doing DNS lookups for www.google.com from our London datacenter, and I'm curious if other people are seeing the same behavior. It appears that when we ask for www.google.com. we sometimes get an answer that only contains records for www-anycast.google.com., which our resolver ignores as they don't match the query. As seen with dig: ``` # dig @ns1.google.com. www.google.com. aaaa ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @ns1.google.com. www.google.com. aaaa ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42641 ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;www.google.com. IN AAAA ;; ANSWER SECTION: www-anycast.google.com. 300 IN AAAA 2001:4860:4802:34::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:38::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:36::75 www-anycast.google.com. 300 IN AAAA 2001:4860:4802:32::75 ;; Query time: 7 msec ;; SERVER: 216.239.32.10#53(216.239.32.10) ;; WHEN: Fri Sep 06 19:05:32 UTC 2019 ;; MSG SIZE rcvd: 167 ``` So far I've observed this with A and AAAA queries. It's my understanding that without a CNAME record in the answer, the resolver is doing the right thing by ignoring the answer, as there's no linkage between www and www-anycast. Is this broken, or is this just some weird DNS trick I've not come across before? -- Chip Marshall <chip(a)2bithacker.net>

6 9

Spoofer Report for NANOG for Aug 2019
by CAIDA Spoofer Project 08 Sep '19

08 Sep '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Aug 2019: ASN Name Fixed-By 4 ISI 2019-08-06 6939 HURRICANE 2019-08-10 7922 COMCAST-7922 2019-08-16 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Aug 2019: ASN Name First-Spoofed Last-Spoofed 7029 WINDSTREAM 2016-06-21 2019-08-23 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2019-08-28 6128 CABLE-NET-1 2016-09-03 2019-08-28 27364 ACS-INTERNET 2016-09-27 2019-08-30 20412 CLARITY-TELECOM 2016-09-30 2019-08-28 6181 FUSE-NET 2016-10-10 2019-08-31 25787 ROWE-NETWORKS 2016-10-21 2019-08-25 32440 LONI 2016-11-03 2019-08-29 12083 WOW-INTERNET 2016-11-09 2019-08-26 39939 RISE-CO-AS39939 2016-11-11 2019-08-27 13427 SOFTCOM-INTERNET-COMMUNICATION 2016-11-14 2019-08-28 9009 M247 2017-01-10 2019-08-26 21832 KELLINCOM-1 2017-02-03 2019-08-21 19624 SERVERROOM 2017-06-02 2019-08-27 63296 AMARILLO-WIRELESS 2017-09-01 2019-08-29 546 PARSONS-PGS-1 2017-11-20 2019-08-23 54540 INCERO 2018-01-15 2019-08-26 12222 AKAMAI 2018-02-14 2019-08-30 4201 ORST 2018-04-19 2019-08-28 11827 WSU 2018-05-07 2019-08-26 393564 SPOKANE 2018-06-05 2019-08-27 225 VIRGINIA 2018-06-18 2019-08-28 33452 RW 2018-09-19 2019-08-29 20448 VPNTRANET-LLC 2018-09-20 2019-08-26 393437 KLAYER 2018-12-21 2019-08-13 63275 RADIOWIRE 2019-02-07 2019-08-14 8047 GCI 2019-04-11 2019-08-30 10745 ARIN-ASH-CHA 2019-04-29 2019-08-29 6058 NORTHWESTEL-INC 2019-05-06 2019-08-07 6536 CITYNET 2019-05-15 2019-08-20 138576 2019-05-21 2019-08-10 33387 DATASHACK 2019-06-06 2019-08-16 16787 CHARTER-16787 2019-06-17 2019-08-26 210 WEST-NET-WEST 2019-08-04 2019-08-04 13760 SOUTHERN-LIGHT 2019-08-13 2019-08-13 32 STANFORD 2019-08-21 2019-08-29 54600 PEGTECHINC 2019-08-28 2019-08-28 26658 HENGTONG-IDC-LLC 2019-08-30 2019-08-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

IPAM recommendations
by Mehmet Akcin 08 Sep '19

08 Sep '19

Looking for IPAM recommendations, preferably open source, API is a plus (almost must, almost..). 40-50K IPs to be managed. thanks in advance.

17 23

Re: Art and Tech is madness
by Scott Weeks 07 Sep '19

07 Sep '19

--- cboyd(a)gizmopartners.com wrote: From: Chris Boyd <cboyd(a)gizmopartners.com> There’s also this gem from 2005 or 2007 days. I’ve heard Cisco staff was involved in its creation. http://www.mattzrelak.com/mp3/t1down.htm ------------------------------ At work... ====================================== This site is blocked due to a security threat. www.mattzrelak.com This site is blocked due to a security threat that was discovered by the Cisco Umbrella security researchers. Report an incorrect block ===================================== scott

2 1

Cogent & FDCServers: Knowingly aiding and abetting fraud and theft?
by Ronald F. Guilmette 06 Sep '19

06 Sep '19

Few of you here probably know about this, but nearly a week ago now an article appeared in South Africa's largest and most popular online tech publication, MyBroadband.co.za. It detailed many, but certainly not all of the results of my multi-month investigation of a massive and ongoing fraud involving the theft of large numbers of large (generally /16 or larger) abandoned legacy blocks, taken from the AFRINIC region and beyond: https://mybroadband.co.za/news/internet/318205-the-big-south-african-ip-add… For various editorial reasons, the article that was published actually downplayed the magnitude of the of the thefts quite dramatically. The totality of the IPv4 space that has been stolen or squatted, primarily but not exclusively, from South African companies and South African national goverment agencies and departments is actually at least 5x bigger than what was reported in the MyBroadband.co.za article. The overwhelming majority of this stolen and squatted IPv4 space has been helpfully routed by Cogent (AS174), to their customer, FDCServers of Chicago, and then on to the prefered destinations of a certain Mr. Elad Cohen of Israel, and his company Netstyle Atarim, Ltd. (I have saved traceroutes up the wazoo that prove the involvement of FDCServers, in particular, in all of this.) Mr. Cohen has been exceptionally prolific in his IPv4 theft and squatting activities, basically grabbing everything that wasn't nailed down, both within the AFRINIC region and also within the APNIC region. In order to try to legitimize all of these thefts and squats, Mr. Cohen created quite a sizable number of fradulent route: objects within the Merit/RADB data base which, as most here should already know, has essentially zero authentication of any kind before it allows J. Random Luser to add pretty much any any route: object he wants to the RADB. Here's a full listing of all of Mr. Cohen's RADB route: objects as they existed as recently as August 17th: https://pastebin.com/raw/ZNgNuvtt And here is the short summary version showing just all of the prefixes/CIDRs that Mr. Cohen was effectively claiming rights and/or title to as of that same date: https://pastebin.com/raw/4LTaCg5R Plese do note the numerous blocks of size /16 or greater. The bottom line is that this one tiny little Israeli company was effectively claiming rights to a total of no fewer than 1,015,808 IPv4 addresses as of August 17th, 2019. (Not too shabby for one lone guy who teaches programming classes as a side job!) Vitrually all of the space is "legacy" IPv4 space, and generally consists of blocks having sizes of /16 or larger. Some of Mr. Cohen claims in his RADB entries are as humorous as they are pathetically fradulent. For example, Mr. Cohen has effectively claimed rights to 139.44.0.0/16 which unambiguously belongs to the Port Authority of the City of Melbourne, Australia. But hell! That's merely city property! Mr. Cohen's limitless appetite for other people's IPv4 space is more vividly on display in his claims to ownerhip over the 168.198.0.0/16 block, which actually belongs to the Department of Finance of the Australian national government. And I haven't even mentioned yet another of Mr. Cohen volumous IPv4 acqusitions, the 165.25.0.0/16 block, which he did not see fit to create an RADB entry for, but which he's been squatting on for for quite some time now, quite clearly with the aid and assistance of both Cogent and FDCServers. That one belongs to th City of Cape Town, South Africa. That city's engineers have been struggling to regain control of their block back from Cogent, from FDCServers, and from Mr. Cohen for some time now. I know because I've personally spoken to them about it. Cogent, in its infinite wisdom, is continuing to fight the city for control over property that clearly and righfully belongs to the City of Cape Town, even as we speak: https://drive.google.com/file/d/1ytRj1CtuVhDa0eGu4BT-oEz593y5EwJa/view When asked for LOAs attesting to his legitimate authority to route at least a few of these blocks, Mr. Cohen has produced blatantly forged documents, many of which appeared in the MyBroadband.co.za story. And when I say "blatant" that's a gross understatement. Any half-way decent forger would consider these documents an embarrasment. The documents all bear identical signatures, and identical and vaguely official looking stamps, and purport to actually be sales reciepts attesting to the alleged purchases, by Mr. Cohen's offshore Seychelles Islands shell company, Afri Holdings, Ltd., of various /16 blocks from a mysterious company called Afrivestment, Ltd., which may actually exist in some faraway galaxy, or in Mr. Cohen's active imagination, but which both Google and OpenCorporates.com seem to agree exists exactly noplace on this planet. Here are the manufactured LOAs supplied by Mr. Cohen: https://drive.google.com/file/d/1hVjmR6u0ANltuXtZ-Kng8io-EGFyevTR/view https://drive.google.com/file/d/1x_44_H5hkcFLhEwpkwfFoR5PJUyXHzxJ/view https://drive.google.com/file/d/1yQyqn4q_f3bt-wDVoN1FzbXf1k58DXtK/view Recently, Cohen started to move some, but not all, of his stolen and squatted IPv4 blocks off of Cogent/FDCServers and onto a friendly little bullet-proof hosting company in the Netherlands named IP Volume, Inc. (AS202425) and/or to its several sister networks, e.g. AS204655 - Novogara Ltd., all of which, coincidently, just happen to be owned by the exact same pair of Dutch gentlemen who previously owned the notorious Ecatel, follwed by the notorious Quasi Networks. (IP Volume, Inc. appears to have intherited all or nearly all of its legitimately assigned IP space from its predecessor entities, Ecatel and Quasi Networks.) Despite these relocations, many of Mr. Cohen's stolen and squatted blocks are still helpfully being routed to Mr. Cohen's preferred desitnations by his good friends at Cogent and FDCServers, even as we speak. The current set of such routes that Cogent is maintaining, at the moment, apparently on behalf of their customer, Mr. Cohen, consists of the prefixes listed here: https://pastebin.com/raw/EA3xJVLF When I noticed two days ago that all of these routes were still up I was deeply confused. Did both Cogent and FDCServrs not get the memo?? Do they not know yet that Cohen is stealing stuff, left, right, and sideways? Did nobody even tell them about the MyBroadband.co.za article which was published this past Sunday? I decided that it was incumbant upon me to find out. Thus, more that 48 hours ago now I sent the following polite but firm inquiry to Cogent, and a separate nearly identical one directly to the CEO of FDCServers, Mr. Petr Kral (petr(at)fdcservers.net) https://pastebin.com/raw/ztipqE96 A full forty eight hours later, I have received no reply whatsoever from either Cogent or FDCServers, not even a "Go pound sand" type of response. More importantly, most of the stolen IPv4 space that I called out, very specifically, to both Cogent and FDCservers two+ days ago now is still being routed by Cogent/FDCservers to their fun-loving and, I'm sure, promptly paying customer, Mr. Cohen. If neither Cogent nor FDCServers still do not know now that Mr. Cohen is a crook, and that he has glommed onto quite a lot of stolen and squatted IPv4 space... which they have been helpfully routing for him, no doubt in exchange for some handsome payments... then I am foreced to say that it appears to be a reasonable conclusion that it must be because neither Cogent nor FDCServers really wants to know what sort of a character Cohen is, or what he has been up to, specifically with their ongoing and material assistance. But you all be the judges. What does it look like to you? Regards, rfg

8 12

Weekly Routing Table Report
by cscora＠apnic.net 06 Sep '19

06 Sep '19

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 07 Sep, 2019 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 770473 Prefixes after maximum aggregation (per Origin AS): 296709 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 371261 Total ASes present in the Internet Routing Table: 65415 Prefixes per ASN: 11.78 Origin-only ASes present in the Internet Routing Table: 56261 Origin ASes announcing only one prefix: 24079 Transit ASes present in the Internet Routing Table: 9154 Transit-only ASes present in the Internet Routing Table: 269 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 43 Max AS path prepend of ASN ( 19955) 41 Prefixes from unregistered ASNs in the Routing Table: 25 Number of instances of unregistered ASNs: 25 Number of 32-bit ASNs allocated by the RIRs: 28534 Number of 32-bit ASNs visible in the Routing Table: 23329 Prefixes from 32-bit ASNs in the Routing Table: 106198 Number of bogon 32-bit ASNs visible in the Routing Table: 17 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 290 Number of addresses announced to Internet: 2836686336 Equivalent to 169 /8s, 20 /16s and 102 /24s Percentage of available address space announced: 76.6 Percentage of allocated address space announced: 76.6 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.3 Total number of prefixes smaller than registry allocations: 257262 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 208408 Total APNIC prefixes after maximum aggregation: 62204 APNIC Deaggregation factor: 3.35 Prefixes being announced from the APNIC address blocks: 203158 Unique aggregates announced from the APNIC address blocks: 84758 APNIC Region origin ASes present in the Internet Routing Table: 10041 APNIC Prefixes per ASN: 20.23 APNIC Region origin ASes announcing only one prefix: 2790 APNIC Region transit ASes present in the Internet Routing Table: 1505 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 28 Number of APNIC region 32-bit ASNs visible in the Routing Table: 5042 Number of APNIC addresses announced to Internet: 767127552 Equivalent to 45 /8s, 185 /16s and 112 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-141625 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 227493 Total ARIN prefixes after maximum aggregation: 106316 ARIN Deaggregation factor: 2.14 Prefixes being announced from the ARIN address blocks: 226235 Unique aggregates announced from the ARIN address blocks: 107595 ARIN Region origin ASes present in the Internet Routing Table: 18566 ARIN Prefixes per ASN: 12.19 ARIN Region origin ASes announcing only one prefix: 6861 ARIN Region transit ASes present in the Internet Routing Table: 1911 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 43 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2884 Number of ARIN addresses announced to Internet: 1069426304 Equivalent to 63 /8s, 190 /16s and 38 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 215319 Total RIPE prefixes after maximum aggregation: 100703 RIPE Deaggregation factor: 2.14 Prefixes being announced from the RIPE address blocks: 211327 Unique aggregates announced from the RIPE address blocks: 124619 RIPE Region origin ASes present in the Internet Routing Table: 26418 RIPE Prefixes per ASN: 8.00 RIPE Region origin ASes announcing only one prefix: 11653 RIPE Region transit ASes present in the Internet Routing Table: 3737 Average RIPE Region AS path length visible: 4.5 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 8451 Number of RIPE addresses announced to Internet: 721233280 Equivalent to 42 /8s, 253 /16s and 37 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 98559 Total LACNIC prefixes after maximum aggregation: 23000 LACNIC Deaggregation factor: 4.29 Prefixes being announced from the LACNIC address blocks: 99769 Unique aggregates announced from the LACNIC address blocks: 44405 LACNIC Region origin ASes present in the Internet Routing Table: 8784 LACNIC Prefixes per ASN: 11.36 LACNIC Region origin ASes announcing only one prefix: 2311 LACNIC Region transit ASes present in the Internet Routing Table: 1628 Average LACNIC Region AS path length visible: 5.5 Max LACNIC Region AS path length visible: 39 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 6347 Number of LACNIC addresses announced to Internet: 173868032 Equivalent to 10 /8s, 93 /16s and 4 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 20668 Total AfriNIC prefixes after maximum aggregation: 4466 AfriNIC Deaggregation factor: 4.63 Prefixes being announced from the AfriNIC address blocks: 29694 Unique aggregates announced from the AfriNIC address blocks: 9623 AfriNIC Region origin ASes present in the Internet Routing Table: 1321 AfriNIC Prefixes per ASN: 22.48 AfriNIC Region origin ASes announcing only one prefix: 464 AfriNIC Region transit ASes present in the Internet Routing Table: 257 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 27 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 605 Number of AfriNIC addresses announced to Internet: 104769536 Equivalent to 6 /8s, 62 /16s and 168 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 4966 599 583 TPG-INTERNET-AP TPG Telecom Limited, AU 7552 3245 1331 26 VIETEL-AS-AP Viettel Group, VN 45899 3054 1761 113 VNPT-AS-VN VNPT Corp, VN 9829 2733 1494 547 BSNL-NIB National Internet Backbone, IN 9808 2703 9043 63 CMNET-GD Guangdong Mobile Communication 4766 2545 11119 764 KIXS-AS-KR Korea Telecom, KR 7713 2258 685 603 TELKOMNET-AS-AP PT Telekomunikasi Indon 9498 2165 435 208 BBIL-AP BHARTI Airtel Ltd., IN 4755 2159 442 195 TATACOMM-AS TATA Communications formerl 9394 2079 4898 24 CTTNET China TieTong Telecommunications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7155 4065 280 25 VIASAT-SP-BACKBONE - ViaSat,Inc., US 11492 3656 238 673 CABLEONE - CABLE ONE, INC., US 6327 3496 1324 94 SHAW - Shaw Communications Inc., CA 22773 3454 2973 156 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 3119 6585 1472 AMAZON-02 - Amazon.com, Inc., US 16625 2766 1457 1992 AKAMAI-AS - Akamai Technologies, Inc., 30036 2188 349 170 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 20115 2146 2764 525 CHARTER-20115 - Charter Communications, 18566 2086 405 105 MEGAPATH5-US - MegaPath Corporation, US 5650 2074 3073 1453 FRONTIER-FRTR - Frontier Communications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5529 1615 141 UNI2-AS, ES 39891 3780 219 19 ALJAWWALSTC-AS, SA 8551 2912 379 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2744 498 1939 AKAMAI-ASN1, US 31334 2604 484 13 KABELDEUTSCHLAND-AS, DE 12389 2389 2231 685 ROSTELECOM-AS, RU 34984 2132 348 529 TELLCOM-AS, TR 9121 2040 1692 19 TTNET, TR 9009 1766 191 967 M247, GB 13188 1604 100 47 TRIOLAN, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6204 3352 610 Uninet S.A. de C.V., MX 10620 3368 534 445 Telmex Colombia S.A., CO 11830 2691 370 54 Instituto Costarricense de Electricidad 6503 1611 378 415 Axtel, S.A.B. de C.V., MX 7303 1479 1027 272 Telecom Argentina S.A., AR 28573 1167 2230 207 CLARO S.A., BR 6147 1103 380 35 Telefonica del Peru S.A.A., PE 3816 1059 538 124 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 13999 1003 482 249 Mega Cable, S.A. de C.V., MX 11172 932 110 60 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1121 393 23 LINKdotNET-AS, EG 36992 955 1535 73 ETISALAT-MISR, EG 24835 892 590 21 RAYA-AS, EG 36903 745 374 208 MT-MPLS, MA 8452 659 1857 19 TE-AS TE-AS, EG 29571 529 68 11 ORANGE-COTE-IVOIRE, CI 15399 415 45 11 WANANCHI-, KE 37342 369 32 1 MOVITEL, MZ 15706 362 32 6 Sudatel, SD 23889 359 231 15 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6204 3352 610 Uninet S.A. de C.V., MX 12479 5529 1615 141 UNI2-AS, ES 7545 4966 599 583 TPG-INTERNET-AP TPG Telecom Limited, AU 7155 4065 280 25 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 3780 219 19 ALJAWWALSTC-AS, SA 11492 3656 238 673 CABLEONE - CABLE ONE, INC., US 6327 3496 1324 94 SHAW - Shaw Communications Inc., CA 22773 3454 2973 156 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3368 534 445 Telmex Colombia S.A., CO 7552 3245 1331 26 VIETEL-AS-AP Viettel Group, VN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 5529 5388 UNI2-AS, ES 7545 4966 4383 TPG-INTERNET-AP TPG Telecom Limited, AU 7155 4065 4040 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 3780 3761 ALJAWWALSTC-AS, SA 6327 3496 3402 SHAW - Shaw Communications Inc., CA 22773 3454 3298 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7552 3245 3219 VIETEL-AS-AP Viettel Group, VN 11492 3656 2983 CABLEONE - CABLE ONE, INC., US 45899 3054 2941 VNPT-AS-VN VNPT Corp, VN 10620 3368 2923 Telmex Colombia S.A., CO Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 68710 UNALLOCATED 45.170.231.0/24 268710 UNKNOWN 260984 UNALLOCATED 45.175.186.0/23 16735 ALGAR TELECOM S/A, BR 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 65550 DOCUMENT 81.8.34.0/24 15924 BORUSANTELEKOM-AS, TR 65550 DOCUMENT 81.8.35.0/24 15924 BORUSANTELEKOM-AS, TR 65549 DOCUMENT 117.239.163.0/24 65544 UNKNOWN 64339 UNALLOCATED 143.0.108.0/22 18747 IFX18747 - IFX Corporation, US 64355 UNALLOCATED 156.40.196.0/24 30387 NIH-NET-NCCS - National Instit 64011 UNALLOCATED 166.133.128.0/18 20057 ATT-MOBILITY-LLC-AS20057 - AT& Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 27.126.156.0/22 55827 UNKNOWN 27.126.156.0/23 55827 UNKNOWN 27.126.158.0/23 55827 UNKNOWN 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.220.48.0/20 36900 -Reserved AS-, ZZ 41.242.92.0/24 37643 -Reserved AS-, ZZ 41.242.93.0/24 37643 -Reserved AS-, ZZ 43.229.16.0/22 136800 XIAOZHIYUN1-AS-AP ICIDC NETWORK, US Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:10 /9:12 /10:37 /11:99 /12:290 /13:573 /14:1145 /15:1917 /16:13245 /17:7986 /18:13746 /19:25628 /20:40262 /21:47249 /22:96314 /23:77879 /24:443175 /25:906 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4488 5529 UNI2-AS, ES 6327 3282 3496 SHAW - Shaw Communications Inc., CA 7155 3156 4065 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 2946 3780 ALJAWWALSTC-AS, SA 11492 2867 3656 CABLEONE - CABLE ONE, INC., US 22773 2684 3454 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 31334 2492 2604 KABELDEUTSCHLAND-AS, DE 8551 2365 2912 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 11830 2039 2691 Instituto Costarricense de Electricidad y Telec 18566 1981 2086 MEGAPATH5-US - MegaPath Corporation, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1732 2:1098 3:6 4:22 5:3028 6:50 7:1 8:1359 9:1 12:1795 13:398 14:2115 15:42 16:7 17:271 18:81 20:56 23:2912 24:2591 25:4 27:2465 31:2723 32:107 35:37 36:908 37:3125 38:1808 39:303 40:121 41:3371 42:835 43:2089 44:175 45:10235 46:3353 47:269 49:1446 50:1098 51:341 52:1063 54:265 55:686 56:6 57:47 58:2057 59:1115 60:582 61:2224 62:1989 63:1855 64:5031 65:2248 66:4806 67:2747 68:1200 69:3571 70:1386 71:671 72:2679 74:2692 75:1291 76:596 77:2546 78:1972 79:2151 80:1818 81:1505 82:1161 83:963 84:1171 85:2360 86:563 87:1567 88:1088 89:2563 90:230 91:6597 92:1449 93:2475 94:2585 95:3641 96:954 97:340 98:957 99:833 100:88 101:1197 102:651 103:22071 104:3631 105:282 106:815 107:1791 108:691 109:3564 110:1763 111:2021 112:1539 113:1427 114:1282 115:1781 116:1749 117:1971 118:2228 119:1656 120:1065 121:1047 122:2305 123:1860 124:1532 125:2019 128:1345 129:855 130:547 131:1810 132:755 133:224 134:1106 135:255 136:598 137:799 138:2050 139:949 140:635 141:873 142:785 143:1076 144:887 145:281 146:1369 147:856 148:1786 149:1033 150:825 151:1026 152:1375 153:359 154:4363 155:892 156:2230 157:1056 158:696 159:1942 160:1581 161:956 162:2986 163:837 164:1272 165:1157 166:517 167:1441 168:3462 169:472 170:4209 171:665 172:1714 173:2231 174:1040 175:1001 176:2442 177:3972 178:2723 179:1438 180:2142 181:2380 182:2780 183:1155 184:2278 185:15490 186:3714 187:2552 188:3435 189:2045 190:8258 191:1462 192:10087 193:6755 194:5529 195:4194 196:3101 197:1738 198:6019 199:5974 200:7147 201:5149 202:10377 203:10309 204:4567 205:3055 206:3224 207:3285 208:3934 209:4318 210:3930 211:2035 212:3276 213:2947 214:1128 215:54 216:5927 217:2245 218:871 219:601 220:1917 221:973 222:985 223:1379 End of report

1 0

gtt bgp fu?
by Randy Bush 06 Sep '19

06 Sep '19

hi. i would love to chat (email) with someone in gtt (AS3257) who has bgp fu. doing some bgp measurements, we see something we do not understand and would love a clue. thanks. randy

2 1

Art and Tech is madness
by Kasper Adel 06 Sep '19

06 Sep '19

In SPRING a time when segment and routing had no mismatch, a time when isis and ospf ate a forbidden encap, all they had to do was forward bgp like its hot, but crazy flapping doesnt leave any real LDP without some real FSM check, My dynamic unnumbered neighbor. Suddenly, Out of order, an AS is overridden, we see frames dropping, we sniff a bit and it turns out, sfps are burning, we are in a place right now where ping and pong are jittery, their latency is tested, they cant strengthen their icmp bond with a warm bfd message, how can they keep everyone in ACK, safe from teardown and dampening, with this kind of ixp relationship??! but oh admin, we know forwarding works in its own mysterious ways. We are left with two non rfc compliant scavengers, bastard 802.1ah fools in a leaky yet shaped, buffer display of some runts and nimbles, and a giant too. They start their life of a packet, leaving one interface to a neighbor, from an adjacency to a peer, an endless loop, its a prefix hijack, but as they move from one stack to another, finding their way through a tunnel of memory failures and RMAs, one hell of an LSP ride, through firewall horrors and MTU mismatches, leaving behind, a sea of syslog messages and snmp alarms. Anyway, Their ttl expired and one funny access list abruptly denies them life, sending them to Null0, where they can be peacefully discarded. Thats what tech does to yeh

5 4

Cat 5 hurricane -- How are the Bahamas doing?
by Sean Donelan 06 Sep '19

06 Sep '19

It is too early for damage assessments. BTC, local Bahama telecommunications company, is reporting widespread power outages, and intermittent mobile and wireline telephone service. The Abaco Islands in northern Bahamas seem to be taking the worst of it. Network measurements sites are reporting less than 6% reachability in Hope Town, Bahamas. Other parts of Bahamas have less than 50% reachability.

4 4