- Test - lists.nanog.org

Proofpoint Contact?
by Benoit Garcia 10 Sep '18

10 Sep '18

Hello, Could a Proofpoint e-mail blacklist contact me off list? I'm looking for some help to solve an undelivered email issue. Thanks in advance. -- Regards, Benoit.

2 1

Service provider story about tracking down TCP RSTs
by frnkblk＠iname.com 10 Sep '18

10 Sep '18

I want to share a little bit of our journey in tracking down the TCP RSTs that impacted some of our customers for almost ten weeks. Almost immediately after we turned up two new Arista border routers in late July we started receiving a trickle of complaints from customers regarding their inability to access certain websites (mostly B2B). All the packet captures showed the standard TCP SYN/SYN-ACK pair, then a TCP RST from the website after the client sent a TLS/SSL Client Hello. As the reports continued to come in, we built a Google Doc to keep track and it became clear that most of the sites were hosted by Incapsula/Imperva, but there were also a few by Sucuri and Fastly. Knowing that Incapsula provides DoS protection, we attempted to work with them (providing websites, source/destination IPs, traceroutes, and packet captures) to find out why their hosts were issuing our customers a TCP RST, but we made little progress. We moved some of the affected customers to different IP addresses but that didn't resolve the issue. We also asked our customer to work with the website to see if they would be willing to open a ticket with Incapsula. In the meantime, customers were getting frustrated! They couldn't visit Incapsula-hosted healthcare websites, financial firms, product dealers, etc. Over the weeks, a few of those customers purchased/borrowed different routers and some of those didn't have website issues anymore. And more than a few of them discovered that the websites worked fine from home or their mobile phone/hotspot, but not from their Internet connection with us. You can guess where they were applying pressure! That said, we didn't know why a small handful of companies, known for DoS protection, were issuing TCP RSTs to just some of our customers. Earlier this week we received four or five more websites from yet another affected customer, but most of those were with Fastly. By this time, we had been able to replicate the issue in our lab. Feeling desperate to make some tangible progress on this issue, I reached out to the Fastly NOC. In less than 12 hours they provided some helpful feedback, pointing out that a single traceroute to a Fastly site was hitting two of their POPs (they use anycast) and because they don't sync state between POPs the second POP would naturally issue a TCP RST (sidebar: fascinating blog article on Fastly's infrastructure here: https://www.fastly.com/blog/building-and-scaling-fastly-network-part-2-balan cing-requests). In subsequent email exchanges, the Fastly NOC suggested that it appeared that we were "spraying flows" (that is, packets related to single client session were egressing our network via different paths). Because Fastly is also present with us at an IX (though they weren't advertising their anycast IPs at the time), they suggested that we look at how our traffic egresses our network (IX versus transit) and our routers' outbound load-balancing/hashing schemes. The IX turned up to be a red herring, so I turned my attention to our transit. Each of our border routers has two BGP sessions over two circuits to transit provider POP A and two BGP sessions over two circuits to transit provider POP B, for a total of four BGP sessions per border router, a total of eight BGP sessions altogether. Starting with our core router, I confirmed that its ECMP hashing was consistent such that Fastly-bound traffic always went to border router 1 or border router 2. Then I looked at the ECMP hashing scheme on our border routers and noticed something unique - by default Arista also uses TTL: IPv4 hash fields: Source IPv4 Address is ON Protocol is ON Time-To-Live is ON Destination IPv4 Address is ON Since the source and destination IPs and protocol weren't changing, perhaps the TTL was not consistent? I opened the first packet trace in Wireshark and jackpot - the TTL value was 128 on the SYN but 127 on the TLS/SSL Client Hello. I adjusted the Arista's load-balancing profile not to use TTL and immediately my MTR in the background changed and all the sites on the lab machine that couldn't load before . were now loading. Fastly also pointed me to another article written by Joel Jaeggli (https://blog.apnic.net/2018/01/11/ipv6-flow-label-misuse-hashing/) that discusses IPv6 flow labels - we removed that from the border routers' IPv6 hash fields, too. I reviewed the packet traces today and noticed that TTL values remained consistent at 128 *behind* the router CPE. In packet captures on the WAN interface of the router CPE I see that the SYN remains at 128, but the TLS/Client Hello is properly decremented to 127. So, it appears that some router CPE (and there were a variety of makes and models) are doing something special to certain packets and not decrementing the TTL. This explains why: * our customers had issues with all their devices behind their router CPE * the issue remained regardless of what public IP address their router CPE obtained via DHCP or was assigned * some customers who changed their router CPE didn't have the issue anymore - they got lucky with a router that doesn't adjust/reset the TTL * why customers who used our managed Wi-Fi router did not see the issue, because that model doesn't apparently manipulate the TTL, at least not in an inconsistent way. Lesson learned: review a device's hashing mechanism before going into production. For those interested, I have links to the packet traces below my signature, showing the inconsistent TTL values. Thanks again to the fantastic group of folk at the Fastly NOC who so ably pointed us in the right direction! Frank https://www.premieronline.net/~fbulk/example1.pcapng https://www.premieronline.net/~fbulk/example2.pcapng https://www.premieronline.net/~fbulk/example3.pcapng

11 16

Vultr contact
by Mehmet Akcin 10 Sep '18

10 Sep '18

Hello, I have been looking for a contact in Vultr for awhile now. Can anyone help me contact with them? (i need help beyond their sales/support channels) mehmet

4 5

Study on configuration change practices
by Aaron Gember-Jacobson 08 Sep '18

08 Sep '18

We are a team of networking researchers at the University of Wisconsin-Madison and Colgate University investigating methods for automatically synthesizing router configurations from high-level requirements (or intents). To guide our research, we seek to better understand the configuration change practices used in production networks. We would appreciate if you could take 3 minutes to complete our brief, anonymous survey: https://colgate.co1.qualtrics.com/jfe/form/SV_3ee26xayy70jP3D To learn more about our research, visit http://aaron.gember-jacobson.com/research/repair Thanks, Aaron Gember-Jacobson *Assistant Professor of Computer Science* *Colgate University*

2 2

Spoofer Report for NANOG for Aug 2018
by CAIDA Spoofer Project 08 Sep '18

08 Sep '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Aug 2018: ASN Name Fixed-By 33651 CMCS 2018-08-15 2152 CSUNET-NW 2018-08-20 54417 STIMULUS-TECHNOLOGIES 2018-08-22 21949 BEANFIELD 2018-08-29 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Aug 2018: ASN Name First-Spoofed Last-Spoofed 3356 LEVEL3 2016-03-06 2018-08-13 577 BACOM 2016-03-09 2018-08-27 7922 COMCAST-7922 2016-06-04 2018-08-28 20115 CHARTER-NET-HKY-NC 2016-06-09 2018-08-23 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2018-08-29 6128 CABLE-NET-1 2016-09-03 2018-08-11 11232 MIDCO-NET 2016-09-22 2018-08-11 20412 CLARITY-TELECOM 2016-09-30 2018-08-28 6181 FUSE-NET 2016-10-10 2018-08-31 15305 SYRINGANETWORKS 2016-10-21 2018-08-25 25787 ROWE-NETWORKS 2016-10-21 2018-08-29 174 COGENT-174 2016-10-21 2018-08-22 271 BCNET 2016-10-24 2018-08-17 2828 XO-AS15 2016-10-25 2018-08-24 30341 SCTA-ASN 2016-10-31 2018-08-26 32440 LONI 2016-11-03 2018-08-29 33182 DimeNOC 2016-11-08 2018-08-30 12083 WOW-INTERNET 2016-11-09 2018-08-31 1403 EBOX 2016-11-12 2018-08-19 22561 CENTURYLINK-LEGACY-LIGHTCORE 2016-11-27 2018-08-06 21947 BCI 2017-01-06 2018-08-27 7106 INDEPENDENTSFIBERNETWORK 2017-01-09 2018-08-17 9009 M247 2017-01-10 2018-08-24 21832 KELLINCOM-1 2017-02-03 2018-08-25 7122 MTS-ASN 2017-05-16 2018-08-27 701 UUNET 2017-06-14 2018-08-13 22402 NEXTCO 2017-06-19 2018-08-16 6461 ZAYO-6461 2017-06-21 2018-08-28 20394 MASHELL-TELECOM 2017-06-29 2018-08-07 63296 AMARILLO-WIRELESS 2017-09-01 2018-08-30 7233 YAHOO-US 2017-09-07 2018-08-09 2152 CSUNET-NW 2017-11-08 2018-08-30 546 PARSONS-PGS-1 2017-11-20 2018-08-29 54540 INCERO 2018-01-15 2018-08-27 12222 AKAMAI 2018-02-14 2018-08-31 3257 GTT-BACKBONE 2018-03-06 2018-08-31 29384 Qatar-Foundation 2018-03-08 2018-08-26 23148 TERRENAP 2018-03-15 2018-08-30 54417 STIMULUS-TECHNOLOGIES 2018-03-29 2018-08-28 20009 WADSNET 2018-04-13 2018-08-29 4201 ORST 2018-04-19 2018-08-24 11827 WSU 2018-04-19 2018-08-29 393564 SPOKANE 2018-06-05 2018-08-15 35911 BNQ-1 2018-06-06 2018-08-29 225 VIRGINIA 2018-06-18 2018-08-21 30174 UTA 2018-08-03 2018-08-10 22773 ASN-CXA-ALL-CCI-22773-RDC 2018-08-04 2018-08-28 33588 BRESNAN 2018-08-05 2018-08-05 22742 CT-EDU-NET 2018-08-08 2018-08-29 53646 HARRIS-BROADBAND 2018-08-10 2018-08-10 55053 COLOWAREHOUSEONTARIO 2018-08-14 2018-08-15 54804 CSMIII-BUNKIELA 2018-08-21 2018-08-30 20057 ATT-MOBILITY-LLC-AS20057 2018-08-23 2018-08-23 15320 PRIMELINK 2018-08-23 2018-08-23 17025 ZAYO-CUSTOMER-17025 2018-08-23 2018-08-23 33452 RW 2018-08-24 2018-08-24 11260 EASTLINK-HSI 2018-08-26 2018-08-26 11996 LOBOIS 2018-08-28 2018-08-28 394153 VELOXINET 2018-08-28 2018-08-28 20448 VPNTRANET-LLC 2018-08-29 2018-08-29 40911 L2NC 2018-08-31 2018-08-31 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

uCPE or SD-WAN Devices with LTE Support
by Colton Conor 08 Sep '18

08 Sep '18

We have been using cradlepoint routers, but we want a device that has the functionality of a cradlepoint with the ability to run own own applications naively on Linux. cradlepoint does not allow you to run your own apps on the device itself eventhogh the newer cradlepoint has a quad core processor. Does anyone have recommendations for a UCPE or SD-WAN device that: cost about what a Cradlepoint cost ($500 to $750) have built in LTE (or supports a M.2 LTE card) has at least one Ethernet port has remote management, and can load your own application onto? We could probably build out own with a marker board of some sort and a Sierra Wireless LTE card, but what linux operating system would be best for this?

1 0

Weekly Routing Table Report
by cscora＠apnic.net 07 Sep '18

07 Sep '18

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG, IRNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 08 Sep, 2018 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 714282 Prefixes after maximum aggregation (per Origin AS): 274250 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 343136 Total ASes present in the Internet Routing Table: 61743 Prefixes per ASN: 11.57 Origin-only ASes present in the Internet Routing Table: 53330 Origin ASes announcing only one prefix: 23274 Transit ASes present in the Internet Routing Table: 8413 Transit-only ASes present in the Internet Routing Table: 260 Average AS path length visible in the Internet Routing Table: 4.0 Max AS path length visible: 34 Max AS path prepend of ASN ( 30873) 32 Prefixes from unregistered ASNs in the Routing Table: 70 Number of instances of unregistered ASNs: 70 Number of 32-bit ASNs allocated by the RIRs: 23997 Number of 32-bit ASNs visible in the Routing Table: 19338 Prefixes from 32-bit ASNs in the Routing Table: 80928 Number of bogon 32-bit ASNs visible in the Routing Table: 30 Special use prefixes present in the Routing Table: 2 Prefixes being announced from unallocated address space: 309 Number of addresses announced to Internet: 2854496324 Equivalent to 170 /8s, 36 /16s and 40 /24s Percentage of available address space announced: 77.1 Percentage of allocated address space announced: 77.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.0 Total number of prefixes smaller than registry allocations: 238728 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 194899 Total APNIC prefixes after maximum aggregation: 55458 APNIC Deaggregation factor: 3.51 Prefixes being announced from the APNIC address blocks: 193038 Unique aggregates announced from the APNIC address blocks: 79417 APNIC Region origin ASes present in the Internet Routing Table: 9064 APNIC Prefixes per ASN: 21.30 APNIC Region origin ASes announcing only one prefix: 2553 APNIC Region transit ASes present in the Internet Routing Table: 1359 Average APNIC Region AS path length visible: 4.0 Max APNIC Region AS path length visible: 31 Number of APNIC region 32-bit ASNs visible in the Routing Table: 4025 Number of APNIC addresses announced to Internet: 767575043 Equivalent to 45 /8s, 192 /16s and 68 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-139577 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 212189 Total ARIN prefixes after maximum aggregation: 100504 ARIN Deaggregation factor: 2.11 Prefixes being announced from the ARIN address blocks: 211894 Unique aggregates announced from the ARIN address blocks: 100633 ARIN Region origin ASes present in the Internet Routing Table: 18243 ARIN Prefixes per ASN: 11.62 ARIN Region origin ASes announcing only one prefix: 6778 ARIN Region transit ASes present in the Internet Routing Table: 1805 Average ARIN Region AS path length visible: 3.6 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2425 Number of ARIN addresses announced to Internet: 1100193184 Equivalent to 65 /8s, 147 /16s and 157 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 195459 Total RIPE prefixes after maximum aggregation: 93307 RIPE Deaggregation factor: 2.09 Prefixes being announced from the RIPE address blocks: 191769 Unique aggregates announced from the RIPE address blocks: 113734 RIPE Region origin ASes present in the Internet Routing Table: 25451 RIPE Prefixes per ASN: 7.53 RIPE Region origin ASes announcing only one prefix: 11468 RIPE Region transit ASes present in the Internet Routing Table: 3511 Average RIPE Region AS path length visible: 4.1 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 7369 Number of RIPE addresses announced to Internet: 714094464 Equivalent to 42 /8s, 144 /16s and 55 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 92235 Total LACNIC prefixes after maximum aggregation: 20783 LACNIC Deaggregation factor: 4.44 Prefixes being announced from the LACNIC address blocks: 93668 Unique aggregates announced from the LACNIC address blocks: 40918 LACNIC Region origin ASes present in the Internet Routing Table: 7510 LACNIC Prefixes per ASN: 12.47 LACNIC Region origin ASes announcing only one prefix: 2075 LACNIC Region transit ASes present in the Internet Routing Table: 1412 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 34 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 5055 Number of LACNIC addresses announced to Internet: 172160544 Equivalent to 10 /8s, 66 /16s and 246 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 19429 Total AfriNIC prefixes after maximum aggregation: 4138 AfriNIC Deaggregation factor: 4.70 Prefixes being announced from the AfriNIC address blocks: 23604 Unique aggregates announced from the AfriNIC address blocks: 8169 AfriNIC Region origin ASes present in the Internet Routing Table: 1189 AfriNIC Prefixes per ASN: 19.85 AfriNIC Region origin ASes announcing only one prefix: 400 AfriNIC Region transit ASes present in the Internet Routing Table: 238 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 26 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 464 Number of AfriNIC addresses announced to Internet: 100022272 Equivalent to 5 /8s, 246 /16s and 56 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 4686 4192 74 ERX-CERNET-BKB China Education and Rese 7545 4426 478 471 TPG-INTERNET-AP TPG Telecom Limited, AU 7552 2993 1154 90 VIETEL-AS-AP Viettel Group, VN 4766 2823 11135 771 KIXS-AS-KR Korea Telecom, KR 9829 2811 1495 540 BSNL-NIB National Internet Backbone, IN 45899 2719 1650 158 VNPT-AS-VN VNPT Corp, VN 9394 2630 4907 32 CTTNET China TieTong Telecommunications 9808 2263 8699 26 CMNET-GD Guangdong Mobile Communication 17974 2258 962 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4755 2122 417 204 TATACOMM-AS TATA Communications formerl Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6327 3472 1324 84 SHAW - Shaw Communications Inc., CA 11492 3339 238 497 CABLEONE - CABLE ONE, INC., US 22773 3227 2970 149 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 2283 4874 785 AMAZON-02 - Amazon.com, Inc., US 18566 2166 405 109 MEGAPATH5-US - MegaPath Corporation, US 20115 2151 2699 508 CHARTER-NET-HKY-NC - Charter Communicat 209 2039 5085 603 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 30036 2037 346 138 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 16625 2010 1054 1477 AKAMAI-AS - Akamai Technologies, Inc., 7018 1726 19679 1261 ATT-INTERNET4 - AT&T Services, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 4771 1613 125 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 3065 378 44 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2573 622 1911 AKAMAI-ASN1, US 12389 2042 1897 734 ROSTELECOM-AS, RU 34984 2028 336 510 TELLCOM-AS, TR 9121 1852 1692 19 TTNET, TR 13188 1604 100 43 TRIOLAN, UA 6849 1241 355 21 UKRTELNET, UA 8402 1218 544 14 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5216 3352 606 Uninet S.A. de C.V., MX 10620 3394 516 588 Telmex Colombia S.A., CO 11830 2651 369 78 Instituto Costarricense de Electricidad 6503 1671 444 65 Axtel, S.A.B. de C.V., MX 7303 1430 953 206 Telecom Argentina S.A., AR 28573 1094 2231 192 CLARO S.A., BR 3816 1022 510 116 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 932 128 70 Alestra, S. de R.L. de C.V., MX 6147 929 377 31 Telefonica del Peru S.A.A., PE 18881 916 1082 27 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1195 396 48 LINKdotNET-AS, EG 37611 900 107 9 Afrihost, ZA 36903 778 391 137 MT-MPLS, MA 36992 746 1411 41 ETISALAT-MISR, EG 24835 641 818 18 RAYA-AS, EG 8452 597 1728 14 TE-AS TE-AS, EG 37492 474 470 57 ORANGE-, TN 29571 464 70 11 ORANGE-COTE-IVOIRE, CI 37342 386 32 1 MOVITEL, MZ 23889 375 231 15 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5216 3352 606 Uninet S.A. de C.V., MX 12479 4771 1613 125 UNI2-AS, ES 4538 4686 4192 74 ERX-CERNET-BKB China Education and Rese 7545 4426 478 471 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 203 20 ALJAWWALSTC-AS, SA 6327 3472 1324 84 SHAW - Shaw Communications Inc., CA 10620 3394 516 588 Telmex Colombia S.A., CO 11492 3339 238 497 CABLEONE - CABLE ONE, INC., US 22773 3227 2970 149 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 8551 3065 378 44 BEZEQ-INTERNATIONAL-AS Bezeqint Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 4771 4646 UNI2-AS, ES 4538 4686 4612 ERX-CERNET-BKB China Education and Research Net 7545 4426 3955 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 3758 ALJAWWALSTC-AS, SA 6327 3472 3388 SHAW - Shaw Communications Inc., CA 22773 3227 3078 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 3065 3021 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7552 2993 2903 VIETEL-AS-AP Viettel Group, VN 11492 3339 2842 CABLEONE - CABLE ONE, INC., US 10620 3394 2806 Telmex Colombia S.A., CO Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 4200003000 PRIVATE 47.89.98.0/24 45102 CNNIC-ALIBABA-CN-NET-AP Alibab 64513 PRIVATE 62.150.101.0/24 9155 QNET Kuwait, KW 65537 DOCUMENT 62.162.120.0/24 6821 MT-AS-OWN bul. Orce Nikolov bb 64121 UNALLOCATED 98.159.9.0/24 19555 KMI-NETWORK - Kinder Morgan, I 64121 UNALLOCATED 98.159.12.0/24 19555 KMI-NETWORK - Kinder Morgan, I 64140 UNALLOCATED 98.159.14.0/24 64121 UNKNOWN 64544 PRIVATE 103.55.56.0/24 133831 IDNIC-ID Indonesia Network Inf Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 100.66.224.0/19 209 CENTURYLINK-US-LEGACY-QWEST - Qwest Communicati 198.18.1.19/32 7497 CSTNET-AS-AP Computer Network Information Cente Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.179.2.0/24 6939 HURRICANE - Hurricane Electric LLC, US 27.100.7.0/24 56096 UNKNOWN 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.92.0/22 14988 BTC-GATE1, BW 41.78.180.0/23 37265 -Reserved AS-, ZZ 43.251.20.0/22 9381 WTT-AS-AP WTT HK Limited, HK 45.121.32.0/22 134356 UNKNOWN 45.124.164.0/22 38803 GTELECOM-AUSTRALIA Gtelecom-AUSTRALIA, AU 45.252.236.0/22 38803 GTELECOM-AUSTRALIA Gtelecom-AUSTRALIA, AU Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:14 /9:11 /10:36 /11:99 /12:290 /13:565 /14:1096 /15:1885 /16:13335 /17:7923 /18:13795 /19:25364 /20:39518 /21:45692 /22:88657 /23:72277 /24:401525 /25:819 /26:616 /27:633 /28:35 /29:20 /30:19 /31:4 /32:54 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 3521 4771 UNI2-AS, ES 6327 3260 3472 SHAW - Shaw Communications Inc., CA 39891 2946 3778 ALJAWWALSTC-AS, SA 11492 2661 3339 CABLEONE - CABLE ONE, INC., US 8551 2527 3065 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2494 3227 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 18566 2060 2166 MEGAPATH5-US - MegaPath Corporation, US 11830 2001 2651 Instituto Costarricense de Electricidad y Telec 30036 1785 2037 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 10620 1545 3394 Telmex Colombia S.A., CO Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1596 2:833 4:18 5:2825 6:44 7:1 8:1129 12:1870 13:209 14:1806 15:32 16:3 17:194 18:54 20:51 23:2460 24:2311 25:2 27:2483 31:1984 32:88 35:29 36:530 37:2822 38:1496 39:261 40:116 41:3198 42:706 43:1945 44:112 45:5463 46:3133 47:209 49:1354 50:1055 51:318 52:1087 54:368 55:1 56:8 57:38 58:1632 59:993 60:408 61:2112 62:1896 63:1800 64:5046 65:2218 66:4693 67:2660 68:1153 69:3349 70:1156 71:576 72:2220 74:2734 75:420 76:465 77:1648 78:1712 79:2240 80:1565 81:1398 82:1064 83:785 84:1034 85:2027 86:563 87:1417 88:914 89:2339 90:210 91:6434 92:1250 93:2377 94:2460 95:2966 96:933 97:355 98:926 99:138 100:86 101:1188 102:203 103:18597 104:3522 105:216 106:771 107:1776 108:706 109:3323 110:1644 111:1795 112:1345 113:1302 114:1138 115:1668 116:1657 117:1778 118:2208 119:1660 120:1032 121:1042 122:2422 123:1659 124:1427 125:1935 128:1125 129:679 130:492 131:1631 132:734 133:191 134:1029 135:235 136:507 137:655 138:1909 139:681 140:485 141:747 142:844 143:1025 144:816 145:480 146:1245 147:733 148:1654 149:773 150:762 151:1101 152:833 153:323 154:1627 155:803 156:1443 157:802 158:660 159:1855 160:1365 161:823 162:2672 163:605 164:1088 165:1552 166:455 167:1210 168:3139 169:829 170:3880 171:491 172:992 173:2099 174:977 175:803 176:2059 177:3977 178:2515 179:1259 180:2179 181:2432 182:2580 183:1250 184:1056 185:13996 186:3540 187:2506 188:2879 189:2033 190:8197 191:1349 192:9831 193:6141 194:5015 195:3994 196:2699 197:1608 198:5589 199:5940 200:7321 201:4975 202:10293 203:10291 204:4584 205:2905 206:3222 207:3195 208:3927 209:4082 210:3891 211:1999 212:3044 213:2831 214:1047 215:55 216:5998 217:2135 218:863 219:566 220:1806 221:999 222:990 223:1395 End of report

1 0

Last call for presentations and Draft programme for RIPE 77
by Benno Overeinder 07 Sep '18

07 Sep '18

Colleagues, A list of currently accepted RIPE 77 presentations is now published at: https://ripe77.ripe.net/programme/meeting-plan/plenary/ There are still plenary, BoF, tutorial and workshop slots remaining for the final RIPE 77 programme and RIPE Programme Committee will accept new proposals until *21 September 2018*. This is our last call for you to submit your proposals. You can find the CFP for RIPE 77 below or at https://ripe77.ripe.net/submit-topic/cfp/, for your proposals for plenary session presentations, tutorials, workshops, BoFs (Birds of a Feather sessions) and lightning talks. Please also note that speakers do not receive any extra reduction or funding towards the meeting fee at the RIPE Meetings, see the "Speakers" paragraph in CFP for more information. Kind regards, Benno Overeinder RIPE PC Chair https://ripe77.ripe.net/ripe-pc/ -------------------->>><<<-------------------- Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. *RIPE 77 will take place from 15-19 October in Amsterdam, The Netherlands* The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 77. See the full descriptions of the different presentation formats: https://ripe77.ripe.net/submit-topic/presentation-formats/ Proposals for plenary sessions, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than *21 September 2018*. Proposals submitted after this date will be considered depending on the slots still available in the programme. The PC is looking for presentations covering the topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) ---- Speakers ---- Presenters, RIPE Working Group Chairs and the RIPE Programme Committee are required to cover their own costs to attend a RIPE Meeting (meeting ticket, travel and accommodation). We have various ticket options available depending on your needs. In extraordinary circumstances, the RIPE Chair can waive the meeting fee for presenters. These requests are dealt with on a case-by-case basis via pc(a)ripe.net. Also note that, on an individual basis, participants can apply for a RIPE Fellowship or RACI to develop their professional or academic career. For more information, please visit: https://www.ripe.net/participate/ripe/ripe-fellowship https://www.ripe.net/participate/ripe/raci ---- Submissions ---- Presenters should be clear on whether they wish to submit a presentation for a plenary or working group (WG) session. At present, most working groups will solicit policy proposals, discussion points or other content directly via their mailing lists. If you’re not sure what kind of session you should be presenting at, please visit: https://ripe77.ripe.net/plenary-or-wg/ RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and should not attempt a product demonstration. Presenters should indicate how much time they will require. In general, the time allocated for the different presentation formats is as follows: - Plenary presentations: 20-25 minutes presentation with 5-10 minutes discussion - Tutorials: up to two hours (Monday morning) - Workshops: one hour (during evening sessions) to two hours (Monday morning) - BoFs: approximately one hour (during evening sessions) - Lightning talks: 10 minutes in total for both the presentation and any discussion The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe77.ripe.net/submit-topic/ - Lightning talks should also be submitted using the meeting submission system (https://ripe77.ripe.net/submit-topic/) and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced on short notice, in some cases on the same day but often one day prior to the time slot allocated. - Presenters who propose a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panellists, presenters and moderators. ---- Diversity and Inclusion - On-Site Childcare and the RIPE Meeting Code of Conduct ---- Did you know that RIPE Meetings now have on-site childcare? You can reserve a spot for your child (age 6 months – 10 years) during the registration process for the meeting. Registrations for RIPE 77 will open mid-July. Childcare places are limited, so please be quick to reserve a spot for your child! Read about the experiences of our next generation of engineers at: https://labs.ripe.net/Members/agowland/ripe-meeting-diversity-efforts-on-si… Ensuring that RIPE Meeting values are upheld and that attendees experience a professional, respectful and safe meeting is a priority. Please do read the RIPE Meeting Code of Conduct: https://www.ripe.net/participate/meetings/ripe-meetings/ripe-meeting-code-o… --- If you have any questions or requests concerning content submissions, please email pc(a)ripe.net.

1 0

Fubo.tv Another erroneous Geoblock
by Michael Crapse 06 Sep '18

06 Sep '18

anyone know who to contact at fubo.tv? Getting an improper geoblock for our location

1 0

automatic rtbh trigger using flow data
by Aaron Gould 06 Sep '18

06 Sep '18

Hi, does anyone know how to use flow data to trigger a rtbh (remotely triggered blackhole) route using bgp ? .I'm thinking we could use quagga or a script of some sort to interact with a router to advertise to bgp the /32 host route of the victim under attack. Btw, I already have nfsen running and we receive real-time alters of various types of attacks, high volume, high ports, etc. and then we telnet into a cisco trigger router and drop a few lines of code into it and then bgp does the rest within seconds, the upstream providers learn of this route via communities and they rtbh it in their cloud, BUT, I would like my alerts to do this automatically. that would be very nice. Any guidance would be appreciated. -Aaron

11 37