- Test - lists.nanog.org

RE: Top-50 Report
by Jim Browning 16 Sep '96

16 Sep '96

>From: Brett D. Watson[SMTP:bwatson@genuity.net] >Sent: Saturday, September 14, 1996 11:12 AM > > this is what i was getting at in my note a week ago or so. it >appears that many more networks are being announced by 2+ as's. so >i'm assuming we're sort of doomed to poor aggregation as more and >more people dual-home to providers. This is a trend (multi-homing) which will not only continue, but will definitely accelerate. -- Jim

4 4

Re: SYN floods (was: does history repeat itself?)
by Vadim Antonov 16 Sep '96

16 Sep '96

Jeremy Hall <jhall(a)rex.isdn.net> wrote: >In order for your idea to work, the router where you're doing the >filtering must know how to get to all destinations on the Internet, must >not have a default network or route, and they must be symetrical. Well, that is certainly not the case. For reverse-route filters to work paths do not have to be symmetrical. In fact, in interdomain routing the condition for applicability of reverse-route filters is that filtered AS must not do transit. (Note that reverse filters i described do _not_ require that the route back must be best. It just have to be present in the RIB corresponding to exterior routing session over the interface in question.) >As far as your other statement, when an instability occurs, all traffic >starts getting slow because the routers are trying to reroute around a >flapping t3 or whatever caused the outage. Since the whole point around a >denial of service attack is to deny service, by adding in the fact that >we need to know how to get to the source address before we forward the >packet introduces more problems. Ughm, i do not see the relation between flapping and more problems created by reverse-route filtering. >I think you would find this hurts more >than it helps. Would you elaborate? There's certainly little hope that SYN flooding (as well as most of other denial of service attacks) cannot be effectively prevented w/o more robust source identification, so pros are quite obvious. The fact that source identification works, and works well enough even to do billing is beyond any doubt. RELCOM does that on large scale. >Even if you limit this kind of lookups to when the packet >happens to be a TCP packet with the syn option, you still have a problem >in establishing a connection. This creates frustration on the part of the >end user. I will not comment, as that corollary is based on something which is not likely to be true. --vadim

3 3

Re: Top-50 Report
by Sean Donelan 16 Sep '96

16 Sep '96

>Then one must ask, why are so many people finding it necessary to >become multi-homed? A lot of it is kind of a vicious wheel. >Because "NSP A" had routeing problems "customer X" had to backup >their link to "NSP B". I personally think most of its down to a lack >of education to the customers. Will people please stop asking this question, it seems to put a jinx on the net. Everytime it gets asked, some major provider kills their network for a day, giving the answer to the question. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

SYN Flooding [info] (fwd)
by Michael Dillon 15 Sep '96

15 Sep '96

This company has a tool that will supposedly alleviate the effects of a SYN attack. Michael Dillon - ISP & Internet Consulting Memra Software Inc. - Fax: +1-604-546-3049 http://www.memra.com - E-mail: michael(a)memra.com ---------- Forwarded message ---------- Date: Fri, 13 Sep 1996 10:56:28 -0400 (EDT) From: Christopher Klaus <cklaus(a)iss.net> To: firewalls(a)GreatCircle.COM Subject: SYN Flooding [info] [Below we have a software tool that will recognize SYN floods and correct the problem.] Possible solution to SYN Flooding attacks The attack is on! Both 2600 and Phrack, 2 of the biggest well-known underground hacking magazines, have posted exploit code to do one of the nastiest denial of service attacks that the Internet has seen so far. Hundreds of people have access to these programs to bring down services on the Internet. Many of these people are targeting their attacks at various organizations such as ISP. Panix, an ISP, has been under attack for quite a few days now and they have not been able to receive email. Many other ISPs are suffering from the SYN flood attack. This attack is being discussed on many mailing lists, newsgroups, and Thursday's Wall Street Journal (9/12/96). Fortunately a solution already exists as we discuss below. Everyone connected to the Internet relies on TCP/IP. When you establish a connection with TCP, you do a 3-way handshake. The connecting host sends a SYN packet to the receiving host. The receiving host sends a SYN|ACK packet back and to fully establish a connection, the connecting host finally responds with an ACK packet. In a SYN flood attack, an attacker host sends many SYN packets and does not respond with an ACK to the SYN|ACK's. As the receiving host is waiting for more and more ACK's, the buffer queue will fill up and the receiving machine can no longer accepts legitimate connections. This means that attackers can block your email, web, or any other service you are providing on the Internet. To even make this attack worse, the code exploiting the problem randomizes the source address of the attacking host. Thus, the receiving machine gets packets that appear to be from all over the Internet, hiding the location of the attacker. Solution There are several things we can do to stop these attacks from being effective. With the routers for most ISP, they should be blocking any non-internal addresses from leaving their network and going to the Internet. This will stop an attacker if their ISP implements this. Unfortunately, this does not stop an attack from areas on the Internet that do not block that. But at least the ISP can feel comfortable to know that an attacker can not launch his attack from that ISP. Here are two methods of helping eliminate the problem. Some of the exploit code I have seen does not pick a random source port. It would be easy to block the attack with a router denying any packets coming from a specific source port. This may not be too effective because of the trivial nature of adding code to randomize the source port, sequence number, source address, and TTL. But it might help you temporarily if you notice the attacks have any pattern that can be blocked by router rules. Another way to fix this is to set the kernel maximum number of half open connections allowed (SO_MAXCONN) to a higher number than the default value. We have a tool that will look for SYN packets that do not get followed with ACK and clean the half open connections by sending a RST packet. This unclogs the port and allows legitimate connections to happen. This tool is called RealSecure (tm). To obtain a copy of the RealSecure tool, send email to majordomo(a)Iss.net and within the body of the message, type: subscribe realsecure RealSecure (tm) is a comprehensive attack recognition and real time response tool that ISS is alpha testing and will expire in 60 days. -- Christopher William Klaus Voice: (770)395-0150. Fax: (770)395-1972 Internet Security Systems, Inc. "Internet Scanner finds Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes Web: http://www.iss.net/ Email: cklaus(a)iss.net before the hackers do."

4 4

Re: SYN Flooding [info] (fwd)
by Sean Donelan 15 Sep '96

15 Sep '96

>While I agree with the goal here, I've been a bit disturbed by the >undercurrent of antipathy toward 'clueless small ISPs'. I'm as small >as ISPs come, and I've been outbound filtering against source >addresses not in my address space at least since last April. How many >of the clueful here can say that? Not many, I'll venture. For that >matter, when did Alexis begin filtering outbound? Cluelessness has very little to do with the size of the ISP, as anyone who has had to call the customer service line of any large or small ISP can attest. I've been filtering inbound and outbound since before most of the "major" ISPs got in the Internet business. But I'm not smart enough to have thought up the idea on my own. I read someone else's paper and followed their suggestions. Of course, there were a lot fewer papers and books about TCP/IP back then, so it was easier to read them all. >I'd like the concept changed from 'forcing' to 'educating' and to have >it done without disparagement for not already knowing. Once again it does bring up the importance of inter-provider cooperation. It doesn't really matter if you a a huge ISP or a little ISP, your actions have network-wide effects. Any provider who ignores a problem report from any source puts not only their own network at risk, but everyone elses as well. The problem won't go away just because you hang up the phone or ignore the e-mail message. Putting your head in the sand, or saying you will only accept problem referrals from arbitrarily defined "peer" providers just means you won't learn about the problem in a timely fashion. We've tried the one golden rule, the one with the gold makes the rules. Maybe its time to try the other golden rule, treat other providers as you would have them treat you. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: SYN floods (was: does history repeat itself?)
by Vadim Antonov 15 Sep '96

15 Sep '96

Jeremy Hall <jhall(a)rex.isdn.net> wrote: >You may not have said it, but I remember someone said the route had to be >in the routing table. I would agree with you if it looked up the source >in the BGP table and if it considered history or dampened paths valid. If >your asymetry runs over multiple interfaces, then the best path might not >be on the interface the packet is arriving on. Ok, i assume that was clarified. >I am referring to end-user problems. When a line flaps, especially a >backbone line, lots of destinations suddenly become unreachable. You don't do any filtering on backbone lines. Particularly because they belong to transit routing domains, where the reverse-routing filters cannot work. When a tail circuit flaps you lose connectivity in both directions, so that's also not a problem. Finally, if a multi-homed non-transit AS loses an access circuit there's no problem because all interfaces on remote ends of those circuits allow incoming packets, because their BGPs have reverse routes in their RIBs. (As a side note -- in cases when something is screwed up _not_ allowing packets through is a definite plus. It can prevent nasty routing loops and resulting BGP session flaps due to router overload.) -->The fact that source identification works, and works well enough even -->to do billing is beyond any doubt. RELCOM does that on large scale. >Do they deny packets because you aren't a relcom customer? This is a nice >idea on a sunny day, don't get me wrong, but I am wondering how the >routers would react when an unusual condition occurs. Are you certain >relcom bills its customers for *EVERY* source packet, or can account for >them at least? Yes, they do, and bill differently for interior traffic (which is cheaper) and much more expensive capacity of international circuits. Nobody cares about tracing every packets, just counting them on per-customer basis. >Please explain. If your router does not know how to get back to the >source in the split second it got the packet, it might know how to get to >the destination and could send the packet on its way. Communication requires bidirectional connectivity. So routers _must_ have both routes or you can't talk. >Maybe by the time >the web server responded, traffic could resume a normal route, or perhaps >outbound traffic for the web server is unimpared because you chose to >implement asymetry. Throwing packets aways (and reducing traffic in other ways) during periods of instability is a Good Thing; as most of the nastiness in instabilities is caused by the surges of load on the routers. Having the boxes to process traffic going in strange ways (often resulting in expensive things like sending out ICMPs) does not help for network to stabilize. --vadim

1 0

What it will look like
by Tony Bates 15 Sep '96

15 Sep '96

Okay, This is the basic top-20 I used to do. It will show 3 things. 1) Interesting aggreagates. 2) Top-20 (can make this 50 if folks think would be more useful) 3) Daily deltas in terms of withdrawn and added numbers of routes. Find below what it looks like after two days of data. Note also, AS560 fixed a fairly large leak and moved straight off the number 1 slot ;-) losing 1344 routes pushing the routing table back under 40K. I'm considering splitting the report up as it is perhaps a little long. Feedback directly to me. The plan will be to mail this once a week on Friday I expect. Thanks, --Tony ------- This is an auto-generated mail on Sat Sep 14 17:53:22 PDT 1996 It is not checked before it leaves my workstation. This is a list of the "Top 20" players who if CIDRizing at the AS level could make a significant gain in the reduction of the size of Internet routing tables. This may be an over-estimation but it is hoped that this can act as an incentive for the "Top 20" and others to look at their CIDR capability. Please also find a summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does some indication of ASes participating in CIDR. Also, for a short time this gives details of any possibly interesting aggregates currently seen. Interesting here means not an aggregate made as a set of classful routes. Note that this also excludes the net39 experimnet. This a daily snapshot of changes in classfull routes being withdrawn and added. the deltas are calculated over a rolling 7 day period. Please bear in mind this is purely a "snapshot" and a large flucuation could be caused by a connectivity problem for example. However, this does give some indication of service providers that are moving to classless routing. Top 20 Withdrawn Routes from 13Sep96 to 14Sep96 -1344 AS560 BBN Planet, New England Region (N -170 AS2900 Westnet Arizona (ASU) -84 AS701 Alternet -40 AS174 Performance Systems International -34 AS3255 Ukrainian Academic and Research N -32 AS681 KAWAIHIKO-1 -30 AS2687 OpenNet-AP -29 AS5650 Electric Lightwave Inc, 801-521-3 -20 AS3848 WORLDLINX -18 AS281 UNKNOWN -16 AS1706 University of Arizona -11 AS1220 Infonet Services Corporation -10 AS4474 Global Village Communication -8 AS1292 ITESM Campus -- Monterrey -7 AS786 The JANET IP Service -5 AS1822 BBN Planet, New England Region (N -4 AS2493 FONOROLA-EAST -3 AS3561 MCI -2 AS2015 Msen, Inc. -1 AS6255 UNKNOWN Top 20 Added Routes from 13Sep96 to 14Sep96 46 AS1221 AARNET-AS 31 AS278 Red Academica de la UNAM, Mexico. 17 AS3603 CETCOL - Uniandes 11 AS1790 SprintLink Washington D.C. 9 AS1740 CERFnet 5 AS1792 SprintLink Stockton CA 4 AS2044 WORLDNET-AS 3 AS3734 SJEN 2 AS22 NOSC (Naval Ocean Systems Center) 1 AS5536 Internet Egypt Network List of possibly interesting aggregates --------------------------------------- aggregate origin-AS AS Description 9.2.0.0/16 AS1747 IBM Watson, Yorktown Heights, 9.20.0.0/17 AS2686 Autonomous System number for I 9.67.0.0/19 AS3561 MCI 24.0.0.0/14 AS6172 @Home Corp 24.48.0.0/18 AS1677 ANS Hartford - CNSS 53 24.64.0.0/19 AS6327 Shaw Fiberlink Ltd. 24.64.32.0/19 AS6327 Shaw Fiberlink Ltd. 24.96.0.0/18 AS6541 GTE Intelligent Network Servic 24.112.0.0/18 AS6463 Rogers Network Services 24.113.0.0/18 AS6177 SPRINTLINK11 24.124.0.0/18 AS3561 MCI 24.128.0.0/18 AS7015 UNKNOWN 24.129.0.0/18 AS7017 UNKNOWN 24.131.0.0/18 AS7016 UNKNOWN 38.231.198.0/24 AS3951 ICONNET 57.12.0.0/16 AS5384 Etisalat Emirates Internet 128.145.228.0/24 AS174 Performance Systems Internatio 128.188.1.0/24 AS560 BBN Planet, New England Region 128.193.0.0/19 AS4201 ORST-AS 129.181.216.0/22 AS517 Xlink 130.168.105.0/24 AS1270 EUnet Germany 130.168.115.0/24 AS1270 EUnet Germany 130.168.125.0/24 AS1270 EUnet Germany 130.205.64.0/18 AS3561 MCI 130.252.178.0/24 AS1321 ANS San Francisco - DNSS 11 131.114.192.0/18 AS2598 Consiglio Nazionale delle Rice 131.115.211.0/24 AS3301 TeliaNet Sweden 131.117.0.0/17 AS559 SWITCH, Swiss Academic and Res 131.119.63.0/24 AS201 BBN BARRNET, Inc. 132.235.204.0/24 AS3561 MCI 134.33.100.0/24 AS701 Alternet 134.204.14.0/24 AS3561 MCI 134.204.176.0/24 AS3561 MCI 134.241.109.0/24 AS560 BBN Planet, New England Region 135.14.65.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 135.37.2.0/24 AS3561 MCI 135.37.4.0/24 AS3561 MCI 135.37.10.0/24 AS3561 MCI 135.37.14.0/24 AS3561 MCI 135.40.66.0/24 AS3561 MCI 136.140.9.0/24 AS3561 MCI 137.62.197.0/24 AS1794 SprintLink Pennsauken NJ 138.95.80.0/24 AS701 Alternet 138.108.100.0/24 AS3561 MCI 138.182.252.0/24 AS5855 Secretary of the Navy 138.182.254.0/24 AS5855 Secretary of the Navy 139.46.35.0/24 AS560 BBN Planet, New England Region 139.61.102.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 139.61.103.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 139.162.128.0/17 AS1136 Unisource Internet Service NL 140.188.86.0/24 AS174 Performance Systems Internatio 140.188.129.0/24 AS174 Performance Systems Internatio 140.188.198.0/24 AS174 Performance Systems Internatio 140.222.27.0/24 AS690 NSFNET-T3-RT-AS 140.222.43.0/24 AS690 NSFNET-T3-RT-AS 140.222.48.0/24 AS690 NSFNET-T3-RT-AS 140.222.96.0/24 AS690 NSFNET-T3-RT-AS 140.231.44.0/24 AS3561 MCI 141.227.111.0/24 AS2529 Demon Internet Ltd 142.77.19.0/24 AS813 UUNET Canada (ASN-UUNETCA-AS1) 142.77.248.0/24 AS813 UUNET Canada (ASN-UUNETCA-AS1) 143.93.32.0/19 AS517 Xlink 143.222.116.0/24 AS3407 Interpath 143.252.80.0/24 AS2856 BTnet UK Regional network 144.192.181.0/24 AS4200 AGIS (Apex Global Information 144.199.161.0/24 AS1238 ICM Malaysia (MIMOS) connectee 144.224.11.0/24 AS1239 SprintLink Backbone 144.224.12.0/24 AS1239 SprintLink Backbone 144.224.13.0/24 AS6176 SPRINTLINK10 144.224.14.0/24 AS6176 SPRINTLINK10 144.224.15.0/24 AS6176 SPRINTLINK10 144.224.16.0/24 AS6176 SPRINTLINK10 144.224.21.0/24 AS1239 SprintLink Backbone 144.224.22.0/24 AS1239 SprintLink Backbone 144.224.23.0/24 AS6175 SPRINTLINK9 144.224.24.0/24 AS6175 SPRINTLINK9 144.224.25.0/24 AS6175 SPRINTLINK9 144.224.26.0/24 AS6175 SPRINTLINK9 144.228.22.0/24 AS1790 SprintLink Washington D.C. 144.228.23.0/24 AS1790 SprintLink Washington D.C. 144.228.25.0/24 AS1790 SprintLink Washington D.C. 144.228.29.0/24 AS1790 SprintLink Washington D.C. 144.228.37.0/24 AS1791 SprintLink Fort Worth TX 144.228.38.0/24 AS1791 SprintLink Fort Worth TX 144.228.39.0/24 AS1791 SprintLink Fort Worth TX 144.228.41.0/24 AS1239 SprintLink Backbone 144.228.44.0/24 AS1239 SprintLink Backbone 144.228.47.0/24 AS1792 SprintLink Stockton CA 144.228.48.0/24 AS1792 SprintLink Stockton CA 144.228.49.0/24 AS1792 SprintLink Stockton CA 144.228.54.0/24 AS1239 SprintLink Backbone 144.228.55.0/24 AS1793 SprintLink Chicago IL 144.228.57.0/24 AS1793 SprintLink Chicago IL 144.228.58.0/24 AS1793 SprintLink Chicago IL 144.228.59.0/24 AS1793 SprintLink Chicago IL 144.228.63.0/24 AS1794 SprintLink Pennsauken NJ 144.228.64.0/24 AS1794 SprintLink Pennsauken NJ 144.228.65.0/24 AS1794 SprintLink Pennsauken NJ 144.228.66.0/24 AS1794 SprintLink Pennsauken NJ 144.228.67.0/24 AS1794 SprintLink Pennsauken NJ 144.228.68.0/24 AS1794 SprintLink Pennsauken NJ 144.228.69.0/24 AS1794 SprintLink Pennsauken NJ 144.228.73.0/24 AS1795 SprintLink Anaheim CA 144.228.74.0/24 AS1795 SprintLink Anaheim CA 144.228.75.0/24 AS1795 SprintLink Anaheim CA 144.228.76.0/24 AS1795 SprintLink Anaheim CA 144.228.77.0/24 AS1795 SprintLink Anaheim CA 144.228.78.0/24 AS1795 SprintLink Anaheim CA 144.228.79.0/24 AS1795 SprintLink Anaheim CA 144.228.83.0/24 AS6174 SPRINTLINK8 144.228.84.0/24 AS6174 SPRINTLINK8 144.228.85.0/24 AS6174 SPRINTLINK8 144.228.91.0/24 AS1239 SprintLink Backbone 144.228.93.0/24 AS6177 SPRINTLINK11 144.228.94.0/24 AS6177 SPRINTLINK11 144.228.95.0/24 AS6177 SPRINTLINK11 144.228.96.0/24 AS6177 SPRINTLINK11 144.228.103.0/24 AS1239 SprintLink Backbone 144.228.104.0/24 AS1239 SprintLink Backbone 144.228.120.0/24 AS1790 SprintLink Washington D.C. 144.228.121.0/24 AS1790 SprintLink Washington D.C. 144.228.122.0/24 AS1790 SprintLink Washington D.C. 144.228.123.0/24 AS1790 SprintLink Washington D.C. 144.228.124.0/24 AS1790 SprintLink Washington D.C. 144.228.125.0/24 AS1790 SprintLink Washington D.C. 144.228.126.0/24 AS1790 SprintLink Washington D.C. 144.228.127.0/24 AS1790 SprintLink Washington D.C. 144.228.128.0/24 AS1790 SprintLink Washington D.C. 144.228.130.0/24 AS1791 SprintLink Fort Worth TX 144.228.131.0/24 AS1791 SprintLink Fort Worth TX 144.228.132.0/24 AS1791 SprintLink Fort Worth TX 144.228.133.0/24 AS1791 SprintLink Fort Worth TX 144.228.134.0/24 AS1791 SprintLink Fort Worth TX 144.228.135.0/24 AS1791 SprintLink Fort Worth TX 144.228.140.0/24 AS1792 SprintLink Stockton CA 144.228.141.0/24 AS1792 SprintLink Stockton CA 144.228.142.0/24 AS1792 SprintLink Stockton CA 144.228.143.0/24 AS1792 SprintLink Stockton CA 144.228.144.0/24 AS1792 SprintLink Stockton CA 144.228.145.0/24 AS1792 SprintLink Stockton CA 144.228.146.0/24 AS1792 SprintLink Stockton CA 144.228.147.0/24 AS1792 SprintLink Stockton CA 144.228.148.0/24 AS1792 SprintLink Stockton CA 144.228.150.0/24 AS1793 SprintLink Chicago IL 144.228.151.0/24 AS1793 SprintLink Chicago IL 144.228.152.0/24 AS1793 SprintLink Chicago IL 144.228.154.0/24 AS1793 SprintLink Chicago IL 144.228.155.0/24 AS1239 SprintLink Backbone 144.228.156.0/24 AS1793 SprintLink Chicago IL 144.228.157.0/24 AS1793 SprintLink Chicago IL 144.228.158.0/24 AS1793 SprintLink Chicago IL 144.228.159.0/24 AS1793 SprintLink Chicago IL 144.228.160.0/24 AS1794 SprintLink Pennsauken NJ 144.228.161.0/24 AS1239 SprintLink Backbone 144.228.162.0/24 AS1794 SprintLink Pennsauken NJ 144.228.163.0/24 AS1794 SprintLink Pennsauken NJ 144.228.164.0/24 AS1794 SprintLink Pennsauken NJ 144.228.165.0/24 AS1794 SprintLink Pennsauken NJ 144.228.166.0/24 AS1792 SprintLink Stockton CA 144.228.214.0/24 AS1792 SprintLink Stockton CA 145.17.100.0/24 AS2856 BTnet UK Regional network 145.72.32.0/19 AS5484 BTnet Netherlands Regional Ser 145.72.64.0/19 AS5484 BTnet Netherlands Regional Ser 145.246.16.0/24 AS2856 BTnet UK Regional network 145.246.17.0/24 AS2856 BTnet UK Regional network 145.248.112.0/24 AS2706 HKSUPER 145.248.155.0/24 AS2706 HKSUPER 145.248.157.0/24 AS2706 HKSUPER 145.248.159.0/24 AS2706 HKSUPER 145.248.161.0/24 AS2706 HKSUPER 145.248.165.0/24 AS2706 HKSUPER 146.75.254.0/24 AS3301 TeliaNet Sweden 146.188.254.0/24 AS1849 PIPEX, Public IP EXchange 147.85.21.0/24 AS3951 ICONNET 147.85.25.0/24 AS3951 ICONNET 147.85.39.0/24 AS3951 ICONNET 147.85.44.0/24 AS3951 ICONNET 147.85.51.0/24 AS3951 ICONNET 147.85.115.0/24 AS3951 ICONNET 147.160.0.0/17 AS3561 MCI 147.160.128.0/18 AS3561 MCI 147.160.192.0/20 AS3561 MCI 147.160.208.0/20 AS3561 MCI 147.160.224.0/20 AS3561 MCI 147.160.224.0/19 AS3561 MCI 147.206.20.0/24 AS3561 MCI 148.59.5.0/24 AS2015 Msen, Inc. 148.59.15.0/24 AS2015 Msen, Inc. 148.59.16.0/24 AS2015 Msen, Inc. 148.59.221.0/24 AS2015 Msen, Inc. 148.59.224.0/24 AS2015 Msen, Inc. 148.59.228.0/24 AS2015 Msen, Inc. 148.59.229.0/24 AS2015 Msen, Inc. 148.59.231.0/24 AS2015 Msen, Inc. 148.59.232.0/24 AS2015 Msen, Inc. 148.59.234.0/24 AS2015 Msen, Inc. 148.59.241.0/24 AS2015 Msen, Inc. 148.59.242.0/24 AS2015 Msen, Inc. 148.59.245.0/24 AS2015 Msen, Inc. 148.59.246.0/24 AS2015 Msen, Inc. 148.59.247.0/24 AS2015 Msen, Inc. 148.59.252.0/24 AS2015 Msen, Inc. 148.94.210.0/24 AS5714 EDS-WEB 148.185.45.0/24 AS1849 PIPEX, Public IP EXchange 148.252.1.0/24 AS1849 PIPEX, Public IP EXchange 149.20.64.0/24 AS701 Alternet 150.185.128.0/18 AS1800 ICM-Atlantic 150.185.192.0/18 AS1800 ICM-Atlantic 151.185.7.0/24 AS279 SURAnet Southern AS 151.185.10.0/24 AS279 SURAnet Southern AS 152.129.186.0/24 AS4478 PNET-STL 152.158.0.0/17 AS2686 Autonomous System number for I 152.158.192.0/18 AS2687 OpenNet-AP 152.158.208.1/32 AS2687 OpenNet-AP 152.158.212.1/32 AS2687 OpenNet-AP 152.158.212.16/28 AS2687 OpenNet-AP 152.158.212.32/28 AS2687 OpenNet-AP 152.158.212.64/32 AS2687 OpenNet-AP 152.158.212.66/32 AS2687 OpenNet-AP 152.158.212.67/32 AS2687 OpenNet-AP 152.158.212.68/32 AS2687 OpenNet-AP 152.158.212.69/32 AS2687 OpenNet-AP 152.158.212.70/32 AS2687 OpenNet-AP 152.158.212.71/32 AS2687 OpenNet-AP 152.158.212.72/32 AS2687 OpenNet-AP 152.158.212.80/32 AS2687 OpenNet-AP 152.158.245.1/32 AS2687 OpenNet-AP 152.158.248.0/24 AS2687 OpenNet-AP 152.158.248.2/32 AS2687 OpenNet-AP 152.158.248.16/28 AS2687 OpenNet-AP 152.158.248.32/27 AS2687 OpenNet-AP 152.158.248.103/32 AS2687 OpenNet-AP 152.158.254.1/32 AS2687 OpenNet-AP 152.163.193.64/26 AS2056 AOL-AS 152.163.199.0/24 AS2056 AOL-AS 152.163.200.0/28 AS2056 AOL-AS 152.163.200.0/24 AS2056 AOL-AS 152.163.231.0/24 AS2056 AOL-AS 152.163.232.0/23 AS2056 AOL-AS 152.163.234.0/23 AS2056 AOL-AS 152.175.0.0/17 AS1668 ANS-BLK1 152.176.0.0/17 AS1333 ANS Atlanta - DNSS 107 152.176.128.0/17 AS1330 ANS St. Louis - DNSS 83 152.177.0.0/17 AS1332 ANS Denver - DNSS 99 152.177.128.0/17 AS1328 ANS Houston - DNSS 67 152.178.0.0/18 AS1328 ANS Houston - DNSS 67 152.178.64.0/18 AS1335 ANS Honolulu - CNSS 120 152.178.128.0/17 AS1322 ANS Los Angeles - DNSS 19 152.179.0.0/17 AS1321 ANS San Francisco - DNSS 11 152.179.128.0/17 AS1326 ANS Hartford - DNSS 51 152.180.0.0/17 AS-set UNKNOWN 152.180.128.0/17 AS-set UNKNOWN 152.181.0.0/18 AS1329 ANS Greensboro - DNSS 75 152.181.128.0/17 AS-set UNKNOWN 152.181.184.0/22 AS1667 ANS-BLK1 152.181.240.0/26 AS1670 ANS-BLK AS 152.182.0.0/17 AS1323 ANS Chicago - DNSS 27 152.183.0.0/17 AS1331 ANS Seattle - DNSS 91 152.183.128.0/17 AS1334 ANS Albuquerque - CNSS 112 152.184.0.0/17 AS1333 ANS Atlanta - DNSS 107 152.184.128.0/17 AS1330 ANS St. Louis - DNSS 83 152.185.0.0/17 AS1332 ANS Denver - DNSS 99 152.185.128.0/17 AS1328 ANS Houston - DNSS 67 152.186.0.0/18 AS1328 ANS Houston - DNSS 67 152.186.64.0/18 AS1335 ANS Honolulu - CNSS 120 152.186.128.0/17 AS1322 ANS Los Angeles - DNSS 19 152.187.0.0/17 AS1321 ANS San Francisco - DNSS 11 152.187.128.0/17 AS1326 ANS Hartford - DNSS 51 152.188.0.0/17 AS-set UNKNOWN 152.188.128.0/17 AS-set UNKNOWN 152.189.0.0/18 AS1329 ANS Greensboro - DNSS 75 152.189.128.0/17 AS1327 ANS Washington D.C. - DNSS 59 152.189.184.0/22 AS1667 ANS-BLK1 152.190.0.0/17 AS1323 ANS Chicago - DNSS 27 152.191.0.0/17 AS1331 ANS Seattle - DNSS 91 152.191.128.0/17 AS1334 ANS Albuquerque - CNSS 112 153.2.164.0/24 AS3561 MCI 153.39.129.0/24 AS701 Alternet 153.39.130.0/24 AS701 Alternet 153.39.132.0/24 AS701 Alternet 153.39.192.0/24 AS701 Alternet 153.39.193.0/24 AS701 Alternet 153.39.236.0/24 AS701 Alternet 153.39.237.0/24 AS701 Alternet 153.39.238.0/24 AS701 Alternet 153.39.239.0/24 AS701 Alternet 153.39.240.0/24 AS701 Alternet 153.39.241.0/24 AS701 Alternet 153.39.242.0/24 AS701 Alternet 153.39.244.0/24 AS701 Alternet 153.39.245.0/24 AS701 Alternet 153.39.246.0/24 AS701 Alternet 153.39.247.0/24 AS701 Alternet 153.39.248.0/24 AS701 Alternet 153.39.249.0/24 AS701 Alternet 153.39.251.0/24 AS701 Alternet 153.39.252.0/24 AS701 Alternet 153.39.253.0/24 AS701 Alternet 153.96.80.0/21 AS517 Xlink 153.96.92.0/24 AS517 Xlink 153.96.188.0/22 AS517 Xlink 153.96.230.0/24 AS517 Xlink 155.39.191.0/24 AS2685 IGN OpenNet - US 155.134.60.0/24 AS701 Alternet 155.140.124.0/24 AS1849 PIPEX, Public IP EXchange 155.173.244.0/24 AS3561 MCI 155.203.254.0/24 AS3561 MCI 155.229.176.0/22 AS7045 UNKNOWN 156.46.0.0/17 AS4550 Alpha.net Corporation (ASN-AN- 156.46.128.0/17 AS4550 Alpha.net Corporation (ASN-AN- 156.51.204.0/24 AS3301 TeliaNet Sweden 156.114.200.0/24 AS2529 Demon Internet Ltd 157.25.64.0/23 AS1887 NASK 157.25.98.0/24 AS1887 NASK 157.184.150.0/24 AS1330 ANS St. Louis - DNSS 83 157.232.100.0/24 AS3561 MCI 158.43.200.0/24 AS701 Alternet 158.118.51.0/24 AS701 Alternet 158.155.24.0/22 AS1221 AARNET-AS 158.174.254.0/24 AS2856 BTnet UK Regional network 159.24.7.0/24 AS4286 IMCI 159.87.34.0/24 AS200 BBN Planet Western Region 159.179.0.0/24 AS3561 MCI 159.197.158.0/23 AS2529 Demon Internet Ltd 159.245.84.0/22 AS1849 PIPEX, Public IP EXchange 159.245.104.0/22 AS1849 PIPEX, Public IP EXchange 160.92.0.0/17 AS3215 RAIN 160.92.128.0/24 AS3215 RAIN 160.92.129.0/24 AS2917 OLEANE - PIPEX International 160.92.130.0/23 AS3215 RAIN 160.92.132.0/22 AS3215 RAIN 160.92.136.0/21 AS3215 RAIN 160.92.144.0/20 AS3215 RAIN 160.92.160.0/19 AS3215 RAIN 160.92.192.0/18 AS3215 RAIN 161.51.224.0/20 AS1849 PIPEX, Public IP EXchange 161.120.6.0/24 AS3561 MCI 161.223.220.0/22 AS1 BBN Planet backbone 161.223.224.0/24 AS1 BBN Planet backbone 162.81.141.0/24 AS3561 MCI 162.118.201.0/24 AS3561 MCI 163.12.0.0/23 AS3576 PREPnet-EAST 163.12.5.0/24 AS3576 PREPnet-EAST 163.12.16.0/22 AS3576 PREPnet-EAST 163.12.21.0/24 AS3576 PREPnet-EAST 163.12.22.0/24 AS3576 PREPnet-EAST 163.12.23.0/24 AS3576 PREPnet-EAST 163.12.24.0/21 AS3576 PREPnet-EAST 163.12.32.0/19 AS3576 PREPnet-EAST 163.12.64.0/20 AS3576 PREPnet-EAST 163.12.81.0/24 AS3576 PREPnet-EAST 163.12.84.0/22 AS3576 PREPnet-EAST 163.12.88.0/21 AS3576 PREPnet-EAST 163.12.96.0/19 AS3576 PREPnet-EAST 163.12.128.0/21 AS3576 PREPnet-EAST 163.12.136.0/22 AS3576 PREPnet-EAST 163.12.144.0/20 AS3576 PREPnet-EAST 163.12.160.0/19 AS3576 PREPnet-EAST 163.12.192.0/21 AS3576 PREPnet-EAST 163.12.240.0/20 AS3576 PREPnet-EAST 163.49.131.0/24 AS3561 MCI 163.49.132.0/22 AS3561 MCI 163.49.136.0/22 AS3561 MCI 163.49.140.0/23 AS3561 MCI 163.49.142.0/24 AS3561 MCI 163.249.43.0/24 AS3739 NEWNET 163.249.53.0/24 AS3739 NEWNET 163.249.54.0/24 AS3739 NEWNET 163.249.57.0/24 AS3739 NEWNET 163.249.140.0/22 AS3739 NEWNET 163.249.160.0/21 AS3739 NEWNET 163.249.168.0/24 AS3739 NEWNET 163.249.169.0/24 AS3739 NEWNET 163.249.170.0/24 AS3739 NEWNET 164.99.56.192/26 AS2041 CRL-GATE 164.100.64.0/20 AS3561 MCI 164.100.80.0/24 AS3561 MCI 164.100.81.0/24 AS3561 MCI 164.100.82.0/23 AS3561 MCI 164.100.84.0/22 AS3561 MCI 164.100.88.0/21 AS3561 MCI 164.100.96.0/19 AS3561 MCI 164.100.128.0/17 AS3561 MCI 164.100.167.0/24 AS3561 MCI 164.100.199.0/24 AS3561 MCI 164.103.3.0/24 AS3561 MCI 164.131.247.0/24 AS3215 RAIN 164.131.248.0/24 AS3215 RAIN 165.113.197.0/24 AS6006 UNKNOWN 165.113.198.0/24 AS6006 UNKNOWN 165.113.199.0/24 AS6006 UNKNOWN 165.113.211.0/24 AS6006 UNKNOWN 165.113.219.0/24 AS6006 UNKNOWN 165.166.123.0/24 AS3561 MCI 165.215.64.0/18 AS4183 CompuServe, Incorporated 165.215.191.0/24 AS5090 CWI-NYD 166.38.40.0/24 AS3561 MCI 166.147.0.0/18 AS3561 MCI 166.147.64.0/18 AS3561 MCI 166.147.128.0/18 AS3561 MCI 166.147.192.0/18 AS3561 MCI 166.150.0.0/18 AS3561 MCI 166.150.64.0/18 AS3561 MCI 166.150.128.0/18 AS3561 MCI 166.150.192.0/18 AS3561 MCI 166.151.0.0/18 AS3561 MCI 166.151.64.0/18 AS3561 MCI 166.151.128.0/18 AS3561 MCI 166.151.192.0/18 AS3561 MCI 167.72.128.0/24 AS3561 MCI 167.77.32.0/24 AS3561 MCI 167.79.70.0/24 AS1790 SprintLink Washington D.C. 167.79.91.0/24 AS1790 SprintLink Washington D.C. 167.105.232.0/24 AS3561 MCI 167.170.6.0/23 AS3313 I.Net S.p.A. 168.14.1.0/24 AS3561 MCI 168.14.2.0/23 AS3561 MCI 168.14.4.0/22 AS3561 MCI 168.14.8.0/21 AS3561 MCI 168.14.16.0/20 AS3561 MCI 168.29.0.0/17 AS3492 ATLANTA 168.175.70.0/24 AS3561 MCI 168.175.170.0/24 AS3561 MCI 168.175.171.0/24 AS3561 MCI 168.175.172.0/24 AS3561 MCI 168.224.128.0/24 AS2856 BTnet UK Regional network 168.247.253.0/24 AS174 Performance Systems Internatio 168.247.254.0/24 AS174 Performance Systems Internatio 169.132.80.0/24 AS5000 IDT Corporation 169.200.1.0/24 AS3561 MCI 170.11.20.0/24 AS3561 MCI 170.11.49.0/24 AS3561 MCI 170.11.50.0/24 AS3561 MCI 170.11.88.0/24 AS3561 MCI 170.115.249.0/24 AS4969 Net Access 170.194.51.0/24 AS1849 PIPEX, Public IP EXchange 170.215.192.0/20 AS5650 Electric Lightwave Inc. and XM 171.25.128.0/20 AS3301 TeliaNet Sweden 171.25.144.0/21 AS3301 TeliaNet Sweden 171.25.152.0/21 AS3301 TeliaNet Sweden 171.30.170.0/24 AS2856 BTnet UK Regional network 192.103.70.0/26 AS1673 ANS-BLK1 192.103.74.0/27 AS1673 ANS-BLK1 192.231.184.4/32 AS174 Performance Systems Internatio 194.23.1.36/30 AS3305 Internet Service Provider back 194.51.28.152/30 AS1667 ANS-BLK1 194.178.245.32/28 AS5417 Demon Internet Ltd 195.212.2.0/28 AS2686 Autonomous System number for I 195.212.6.0/26 AS2686 Autonomous System number for I 195.212.48.0/27 AS2686 Autonomous System number for I 195.212.69.0/26 AS2686 Autonomous System number for I 195.212.74.0/27 AS2686 Autonomous System number for I 195.212.78.0/28 AS2686 Autonomous System number for I 195.212.106.0/26 AS2686 Autonomous System number for I 195.212.110.0/27 AS2686 Autonomous System number for I 195.212.226.0/28 AS2686 Autonomous System number for I 198.83.24.0/26 AS1673 ANS-BLK1 198.83.47.0/26 AS1673 ANS-BLK1 198.83.195.0/26 AS1673 ANS-BLK1 198.83.209.0/26 AS1673 ANS-BLK1 198.83.210.0/26 AS1673 ANS-BLK1 199.99.247.32/27 AS174 Performance Systems Internatio 199.221.28.0/26 AS1673 ANS-BLK1 199.221.38.0/27 AS1673 ANS-BLK1 199.221.47.0/25 AS1673 ANS-BLK1 199.222.34.0/26 AS1673 ANS-BLK1 200.229.224.8/29 AS2685 IGN OpenNet - US 200.229.224.16/29 AS2685 IGN OpenNet - US 200.229.229.64/26 AS2685 IGN OpenNet - US 200.229.229.128/26 AS2685 IGN OpenNet - US 200.229.231.16/28 AS2685 IGN OpenNet - US 200.229.231.32/28 AS2685 IGN OpenNet - US 200.229.234.0/25 AS2685 IGN OpenNet - US 202.50.137.64/27 AS2687 OpenNet-AP 202.135.17.0/30 AS2687 OpenNet-AP 202.135.17.8/30 AS2687 OpenNet-AP 202.135.17.12/30 AS2687 OpenNet-AP 202.135.18.0/28 AS2687 OpenNet-AP 202.135.18.16/28 AS2687 OpenNet-AP 202.135.18.32/28 AS2687 OpenNet-AP 202.135.18.48/28 AS2687 OpenNet-AP 202.135.18.64/28 AS2687 OpenNet-AP 202.135.18.96/28 AS2687 OpenNet-AP 202.135.20.0/26 AS2687 OpenNet-AP 202.135.20.128/26 AS2687 OpenNet-AP 202.135.22.0/26 AS2687 OpenNet-AP 202.135.22.64/26 AS2687 OpenNet-AP 202.135.22.128/26 AS2687 OpenNet-AP 202.135.22.192/26 AS2687 OpenNet-AP 204.117.90.128/25 AS3491 CAIS-ASN 204.137.135.0/28 AS3830 Net99 204.146.30.25/32 AS2686 Autonomous System number for I 204.148.62.0/26 AS1673 ANS-BLK1 204.148.68.0/26 AS1673 ANS-BLK1 204.150.183.0/25 AS1667 ANS-BLK1 204.151.106.0/26 AS1673 ANS-BLK1 204.151.152.0/26 AS1673 ANS-BLK1 204.157.1.0/30 AS3830 Net99 204.157.228.0/30 AS3830 Net99 205.156.223.176/28 AS2702 Spry AS Here follows the last weeks "Top 20" list with the corresponding date. --- 14Sep96 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS174 1255 920 335 26.7% Performance Systems International AS2493 724 454 270 37.3% i*internet AS3602 546 313 233 42.7% Intergrated Network Services Inc. AS1 458 290 168 36.7% BBN Planet backbone AS3397 255 94 161 63.1% EMI-AS AS3804 384 241 143 37.2% WorldLinx 3 AS1691 293 155 138 47.1% ANS-BLK1 AS568 375 265 110 29.3% JIS (Joint Interconnection Servic AS86 292 184 108 37.0% SURAnet Northern AS AS2386 234 140 94 40.2% INS-AS AS1717 450 361 89 19.8% RENATER AS2704 269 183 86 32.0% HOOKUP-NET-A AS721 344 263 81 23.5% DLA-ASNBLOCK-AS AS3215 126 52 74 58.7% RAIN AS3301 344 277 67 19.5% TeliaNet Sweden AS1790 272 208 64 23.5% SprintLink Washington D.C. AS813 213 151 62 29.1% UUNET Canada (ASN-UUNETCA-AS1) AS2711 109 50 59 54.1% SUNBELT-AS AS855 120 65 55 45.8% NBTel AS839 90 35 55 61.1% North West Territories Regional N --- 13Sep96 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS560 1697 877 820 48.3% BBN Planet, New England Region (N AS174 1295 938 357 27.6% Performance Systems International AS2493 728 456 272 37.4% FONOROLA-EAST AS3602 546 313 233 42.7% Intergrated Network Services Inc. AS1 462 293 169 36.6% BBN Planet backbone AS3397 255 94 161 63.1% EMI-AS AS3804 384 241 143 37.2% WorldLinx 3 AS1691 294 156 138 46.9% UNKNOWN AS86 293 183 110 37.5% SURAnet Northern AS AS568 375 265 110 29.3% JIS (Joint Interconnection Servic AS2386 235 140 95 40.4% INS-AS AS2704 271 182 89 32.8% HOOKUP-NET-A AS1717 451 362 89 19.7% RENATER AS721 348 267 81 23.3% UNKNOWN AS2900 207 126 81 39.1% Westnet Arizona (ASU) AS3215 127 53 74 58.3% RAIN AS3301 344 277 67 19.5% TeliaNet Sweden AS813 215 151 64 29.8% UUNET Canada (ASN-UUNETCA-AS1) AS701 868 809 59 6.8% Alternet AS2711 108 49 59 54.6% SUNBELT-AS

2 1

Re: Re[4]: SYN floods (was: does history repeat itself?)
by James D. Butt 'J.D.' 15 Sep '96

15 Sep '96

> (Whats needed, I think, is a cheap box that just does filtering. If > it did it in hardware, it could be very fast (needed for high speed > lines) and possibly even cheap. You would still need the software some where in the picture. The hardware in pretty useless without some type of software. Do you know something that I don't? How do you store the filtering paramaters into the hardware? There is still software in the hardware,,,, ----------------------------------------------------------- James 'J.D.' Butt Voice 319.557.8463 Network Engineer pager 319.557.6347 MidWest Communications, Inc. fax 319.557.9771 241 Main St. noc(a)mwci.net Dubuque, IA 52001 jbutt(a)mwci.net ----------------------------------------------------------- "I used up all my sick days... so I'm calling in dead" "Lets fight against continental drift!"

1 0

Re: Top-50 Report
by Peter Kline 15 Sep '96

15 Sep '96

At 09:43 AM 9/14/96 -0700, Tony Bates wrote: > [..] >Or a lot less care and letting classful size announcments leak out and >not aggregating to the allocation folks were given. To highlight I pick >the last 50 classful entries I see in the 193, 198 and 206 range just >to give a random sample and to illustrate. >[...] >206 >206.249.87.0 in AS4200 >206.249.112.0 in AS4200 >206.249.113.0 in AS4200 >206.249.114.0 in AS4200 >206.249.115.0 in AS4200 >206.249.182.0 in AS4200 >206.249.183.0 in AS4200 >206.250.25.0 in AS4200 >206.250.26.0 in AS4200 >206.250.40.0 in AS4200 >206.250.41.0 in AS4200 >206.250.192.0 in AS4200 >206.250.193.0 in AS4200 >206.250.200.0 in AS4200 >206.250.201.0 in AS4200 >206.250.205.0 in AS4200 >206.250.249.0 in AS4200 >206.250.250.0 in AS4200 The above are a legacy of the net99 assimilation into AGIS and will disappear as we revise our filtering to reflect the completion of that task. Peter _Lucem Diffundo_

1 0

Re: Top-50 Report
by dgaudet＠hotwired.com 15 Sep '96

15 Sep '96

In article <hot.mailing-lists.nanog-m0v1zka-000NjOC(a)aero.branch.com>, Jon Zeeff <jon(a)branch.com> wrote: > ISPs should provide >good prices on backups connections (ie, connections that almost >never get any traffic). And then when they do get traffic they'll be overloaded. Either overloaded because the backup provider has no way to budget for your needs, or because you and a hundred other people are using them for backup. Personally I wouldn't trust "backup" lines that I'm not using regularly. Who knows if they'll even be working when I need them. If there were an analysis of the dual-home pairings we might find that only a handful (say 8) of pairings have significant numbers of dual-homed customers. I.e. suppose that MCI/UUNET is the most common dualhoming pair, then a jointly allocated block could be divided amongst their dual-homed customers. Not perfect by far, but something worth considering. Dean

1 0