- Test - lists.nanog.org

Zayo woes
by JASON BOTHE 14 Nov '23

14 Nov '23

Does anyone know what’s happening at Zayo? Tickets are taking weeks and months to get resolved, much less get a tech assigned to them. The folks answering the noc phone are mere order takers and are only reading from a script, manager on duty/escalation lines go to voicemail. If anyone can help get to a human in the transport group, that would be great. I’ve given up all hope at this point. Appreciated. Jason

15 29

Strange IPSEC traffic
by Shawn L 14 Nov '23

14 Nov '23

Is anyone else seeing a lot of 'strange' IPSEC traffic? We started seeing logs of IPSEC with invalid spi on Friday. We're seeing it on pretty much all of our PE routers, none of which are setup to do anything VPN related. Most are just routing local customer traffic. decaps: rec'd IPSEC packet has invalid spi for destaddr=X.X.X.X, prot=50, spi=0x9D2D0000(2636972032), srcaddr=211.112.195.167, input interface=TenGigabitEthernet0/0/11 decaps: rec'd IPSEC packet has invalid spi for destaddr=Y.Y.Y.Y, prot=50, spi=0x14690000(342425600), srcaddr=74.116.56.244, input interface=TenGigabitEthernet0/0/5 The destination address is always one of our customer's ip addresses. The source seems to be all over the place, mostly Russia, Korea, China or south east asia. It's not really impacting anything at the moment, just rather annoying. Thanks Shawn

8 7

Celebration: RADB appears to now filter RPKI-invalid IRR route/route6 objects
by Job Snijders 14 Nov '23

14 Nov '23

Dear NANOG, It appears the WHOIS service at whois.radb.net is now filtering out RPKI-invalid IRR route/route6 objects for common expansion queries! This really is exciting and excellent news. I'll elaborate a bit on what this exactly means. Example ROA & IRR object ======================== Take for example the 194.32.71.0/24 test prefix: https://irrexplorer.nlnog.net/prefix/194.32.71.0/24 For experimental purposes, NTT (ages ago) created a cryptographically verifiable RPKI ROA to indicate that any BGP announcements for 194.32.71.0/24 or-longer are RPKI-invalid: https://console.rpki-client.org/rpki.ripe.net/repository/DEFAULT/01/ee8b98-… RPKI ROA: +--------------------------------+ | Prefix: 194.32.71.0/24 | | Origin: AS 0 | | Trust Anchor: RIPE NCC | +--------------------------------+ Additionally, an IRR route object was created in the RIPE NCC managed 'RIPE' IRR database: https://apps.db.ripe.net/db-web-ui/query?bflag=false&dflag=false&rflag=true… IRR Route Object: +--------------------------------+ | route: 194.32.71.0/24 | | origin: AS15562 | | pingable: 194.32.71.1 | | ... | | source: RIPE | +--------------------------------+ Obviously, the above IRR route object is in conflict with the sole RPKI ROA for 194.32.71.0/24, which designated AS 0 exclusively. Following the reasoning that IRR route objects describe possible BGP states, and in BGP the combo 194.32.71.0/24AS15562 would be rejected; it makes sense to go a step further and filter out IRR objects which are RPKI-invalid too. This concept of filtering out RPKI-invalid IRR objects was described in https://www.ripe.net/publications/docs/ripe-731 and also implemented in IRRd v4. RPKI-Invalids no longer visible via whois.radb.net ================================================== Since recently, whois.radb.net indeed applies such filtering and no longer displays the RPKI-conflicting IRR object for 194.32.71.0/24: $ whois -h whois.radb.net 194.32.71.0/24 % No entries found for the selected source(s). The above 'No entries found' output means that the IRRd instance filtered out the RPKI-invalid IRR objects! This is great :-) In doing so, RADB actively helps safeguard the interests of resource holders: it no longer is possible for adversaries to create IRR route objects which are in conflict with RPKI ROAs via the RADB service, and RADB also filters out RPKI-invalid IRR route/route6 objects received via the NRTM mirror streams; additionally, this filter mechanism helps clean up historical route objects that have become irrelevant due to transfers. The RPKI-based filtering mechanism cleans up the past and helps protect going forward. Of course RADB isn't the only IRR operator who apply RPKI-based filtering, NTT is another one, as is TC, etc; but this week's RADB migration it certainly moves the needle in a significant way: now all the world's largest IRR mirrors apply RPKI-based filtering! :-) Thanks ====== I'd like to express appreciation to the NTT crew (past and present) for helping launch the IRRd v4 initiative: Dorian Kim, Shawn Morris, Michael Wheeler, Dan Lowe, Troy Boudreau, Camilo Cardona; to Sasha Romijn from Reliably Coded for leading the development of IRRd v4; and to the Merit crew who diligently worked to migrate RADB away from legacy IRRd - I believe we collectively benefit from their efforts. The IRRd cross-organizational open-source project is here: http://irrd.net/ お疲れ様です! Kind regards, Job

1 0

Am I the only one who thinks this is disconcerting?
by Owen DeLong 13 Nov '23

13 Nov '23

https://dnsviz.net/d/10.159.192.in-addr.arpa/dnssec/ Seems to report a bunch of errors in the DS records for 192.in-addr.arpa held in the in-addr.arpa zone. I figured I’d wait a few days and try again the first few times I encountered this, but it’s persisted for more than two weeks now. Owen

8 12

Appropriate venue to find out about the state of art of spear phishing defense?
by Michael Thomas 13 Nov '23

13 Nov '23

I know this is only tangentially relevant to nanog, but I'm curious if anybody knows where I can ask what orgs do to combat spear phishing? Spear phishing doesn't require that you deploy DMARC since you can know your own policy even if you aren't comfortable publishing it to the world. tia, Mike

2 2

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 10 Nov '23

10 Nov '23

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 11 Nov, 2023 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 935006 Prefixes after maximum aggregation (per Origin AS): 355778 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 454622 Total ASes present in the Internet Routing Table: 75042 Prefixes per ASN: 12.46 Origin-only ASes present in the Internet Routing Table: 64403 Origin ASes announcing only one prefix: 26462 Transit ASes present in the Internet Routing Table: 10639 Transit-only ASes present in the Internet Routing Table: 480 Average AS path length visible in the Internet Routing Table: 4.2 Max AS path length visible: 55 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1071 Number of instances of unregistered ASNs: 1077 Number of 32-bit ASNs allocated by the RIRs: 43033 Number of 32-bit ASNs visible in the Routing Table: 35370 Prefixes from 32-bit ASNs in the Routing Table: 177646 Number of bogon 32-bit ASNs visible in the Routing Table: 32 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 511 Number of addresses announced to Internet: 3051023104 Equivalent to 181 /8s, 218 /16s and 235 /24s Percentage of available address space announced: 82.4 Percentage of allocated address space announced: 82.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 310908 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 248524 Total APNIC prefixes after maximum aggregation: 71578 APNIC Deaggregation factor: 3.47 Prefixes being announced from the APNIC address blocks: 241689 Unique aggregates announced from the APNIC address blocks: 98997 APNIC Region origin ASes present in the Internet Routing Table: 13744 APNIC Prefixes per ASN: 17.59 APNIC Region origin ASes announcing only one prefix: 4126 APNIC Region transit ASes present in the Internet Routing Table: 1842 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 32 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9077 Number of APNIC addresses announced to Internet: 772185472 Equivalent to 46 /8s, 6 /16s and 157 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 273613 Total ARIN prefixes after maximum aggregation: 124339 ARIN Deaggregation factor: 2.20 Prefixes being announced from the ARIN address blocks: 278141 Unique aggregates announced from the ARIN address blocks: 132362 ARIN Region origin ASes present in the Internet Routing Table: 19066 ARIN Prefixes per ASN: 14.59 ARIN Region origin ASes announcing only one prefix: 6939 ARIN Region transit ASes present in the Internet Routing Table: 1955 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 25 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4822 Number of ARIN addresses announced to Internet: 1277098496 Equivalent to 76 /8s, 30 /16s and 250 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 262130 Total RIPE prefixes after maximum aggregation: 124509 RIPE Deaggregation factor: 2.11 Prefixes being announced from the RIPE address blocks: 256809 Unique aggregates announced from the RIPE address blocks: 160658 RIPE Region origin ASes present in the Internet Routing Table: 28492 RIPE Prefixes per ASN: 9.01 RIPE Region origin ASes announcing only one prefix: 12103 RIPE Region transit ASes present in the Internet Routing Table: 3948 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 36 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11443 Number of RIPE addresses announced to Internet: 715368320 Equivalent to 42 /8s, 163 /16s and 167 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 119600 Total LACNIC prefixes after maximum aggregation: 28609 LACNIC Deaggregation factor: 4.18 Prefixes being announced from the LACNIC address blocks: 118470 Unique aggregates announced from the LACNIC address blocks: 49382 LACNIC Region origin ASes present in the Internet Routing Table: 11049 LACNIC Prefixes per ASN: 10.72 LACNIC Region origin ASes announcing only one prefix: 2665 LACNIC Region transit ASes present in the Internet Routing Table: 2337 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8879 Number of LACNIC addresses announced to Internet: 178404608 Equivalent to 10 /8s, 162 /16s and 61 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 30068 Total AfriNIC prefixes after maximum aggregation: 6014 AfriNIC Deaggregation factor: 5.00 Prefixes being announced from the AfriNIC address blocks: 39386 Unique aggregates announced from the AfriNIC address blocks: 12797 AfriNIC Region origin ASes present in the Internet Routing Table: 1808 AfriNIC Prefixes per ASN: 21.78 AfriNIC Region origin ASes announcing only one prefix: 629 AfriNIC Region transit ASes present in the Internet Routing Table: 347 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 31 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1149 Number of AfriNIC addresses announced to Internet: 107544064 Equivalent to 6 /8s, 104 /16s and 254 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9716 8730 43 CHINAMOBILE-CN China Mobile Communicati 7545 5716 786 692 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4192 75 ERX-CERNET-BKB China Education and Rese 18403 4255 347 25 FPT-AS-AP FPT Telecom Company, VN 7713 3604 1047 70 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3260 1872 99 VNPT-AS-VN VNPT Corp, VN 9498 3251 491 240 BBIL-AP BHARTI Airtel Ltd., IN 7552 2976 1330 20 VIETEL-AS-AP Viettel Group, VN 24560 2580 851 375 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 4766 2536 11270 600 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 9176 11051 3360 AMAZON-02, US 11492 4550 302 673 CABLEONE, US 7155 4174 288 100 VIASAT-SP-BACKBONE, US 6327 3554 1320 67 SHAW, CA 22773 3510 3055 301 ASN-CXA-ALL-CCI-22773-RDC, US 749 3160 54933 2412 DNIC-AS-00749, US 16625 3114 1382 2295 AKAMAI-AS, US 367 3039 3870 1438 DNIC-ASBLK-00306-00371, US 396982 2720 3626 394 GOOGLE-CLOUD-PLATFORM, US 7018 2522 23616 1600 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7434 1713 145 UNI2-AS, ES 39891 4570 271 54 ALJAWWALSTC-AS, SA 20940 4006 3397 141 AKAMAI-ASN1, NL 8551 3443 368 34 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 9009 3418 296 1593 M247, RO 12389 2971 2295 914 ROSTELECOM-AS, RU 34984 2323 361 591 TELLCOM-AS, TR 58224 1661 913 572 TCI, IR 13188 1607 100 26 TRIOLAN, UA 8452 1518 1852 14 TE-AS TE-AS, EG Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12000 3371 600 UNINET, MX 10620 3541 504 860 Telmex Colombia S.A., CO 13999 2444 333 634 Mega Cable, S.A. de C.V., MX 11830 2006 369 64 Instituto Costarricense de Electricidad 28573 1332 2322 236 Claro NXT Telecomunicacoes Ltda, BR 3816 1297 778 195 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6503 1250 342 505 Axtel, S.A.B. de C.V., MX 6147 1105 369 22 Telefonica del Peru S.A.A., PE 11664 1056 168 431 Techtel LMDS Comunicaciones Interactiva 26615 1038 2501 51 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1611 393 19 LINKdotNET-AS, EG 24835 1549 549 28 RAYA-AS, EG 36992 1358 1518 280 ETISALAT-MISR, EG 36903 1248 553 98 MT-MPLS, MA 29571 1045 67 53 ORANGE-COTE-IVOIRE, CI 36935 935 521 43 Vodafone-, EG 6713 552 1861 34 IAM-AS, MA 15399 521 54 46 WANANCHI-, KE 37342 493 32 1 MOVITEL, MZ 24757 461 73 5 EthioNet-AS, ET Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12000 3371 600 UNINET, MX 9808 9716 8730 43 CHINAMOBILE-CN China Mobile Communicati 16509 9176 11051 3360 AMAZON-02, US 12479 7434 1713 145 UNI2-AS, ES 7545 5716 786 692 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4192 75 ERX-CERNET-BKB China Education and Rese 39891 4570 271 54 ALJAWWALSTC-AS, SA 11492 4550 302 673 CABLEONE, US 18403 4255 347 25 FPT-AS-AP FPT Telecom Company, VN 7155 4174 288 100 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9716 9673 CHINAMOBILE-CN China Mobile Communications Grou 12479 7434 7289 UNI2-AS, ES 16509 9176 5816 AMAZON-02, US 7545 5716 5024 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4846 ERX-CERNET-BKB China Education and Research Net 39891 4570 4516 ALJAWWALSTC-AS, SA 18403 4255 4230 FPT-AS-AP FPT Telecom Company, VN 7155 4174 4074 VIASAT-SP-BACKBONE, US 11492 4550 3877 CABLEONE, US 20940 4006 3865 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 216013 UNALLOCATED 2.57.240.0/24 20473 AS-CHOOPA, US 33492 UNALLOCATED 8.6.184.0/23 33650 COMCAST-33650, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 396894 UNALLOCATED 8.28.201.0/24 46887 LIGHTOWER, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.176.160.0/24 Origin: 397327 RESERVED, ZZ 23.176.160.0/24 Transit: 19108 SUDDENLINK-COMMUNICATIONS, US 23.189.192.0/24 Origin: 27593 RESERVED, ZZ 23.189.192.0/24 Transit: 174 COGENT-174, US 36.255.139.0/24 Origin: 56050 NEW-SHINE-INTERNET-TH 134 Yenchit Road, 36.255.139.0/24 Transit: 58913 HCL-TH 4819 Supapong 3 Alley, Srinakarin Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:38 /11:100 /12:299 /13:582 /14:1195 /15:2060 /16:13478 /17:8334 /18:13826 /19:25156 /20:44401 /21:51568 /22:110631 /23:99458 /24:563121 /25:729 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6524 7434 UNI2-AS, ES 8151 6024 12000 UNINET, MX 11492 3463 4550 CABLEONE, US 6327 3364 3554 SHAW, CA 39891 3324 4570 ALJAWWALSTC-AS, SA 7155 3119 4174 VIASAT-SP-BACKBONE, US 8551 2920 3443 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2564 3510 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2140 2485 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2115 3541 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2250 2:1437 3:271 4:5 5:4378 6:161 7:6 8:1538 9:1 11:172 12:1495 13:354 14:2319 15:304 16:202 17:364 18:671 20:317 21:4 22:188 23:6520 24:2560 25:2 27:2526 29:19 31:2560 32:61 34:29 35:118 36:2023 37:4461 38:5563 39:866 40:149 41:3971 42:2079 43:2302 44:329 45:16828 46:4391 47:372 49:1871 50:1888 51:575 52:1587 54:392 55:885 56:5 57:127 58:1884 59:1173 60:1012 61:2567 62:2699 63:1904 64:5502 65:2329 66:5015 67:3060 68:1350 69:4126 70:1179 71:605 72:2926 74:2641 75:1567 76:636 77:2336 78:1828 79:3014 80:2109 81:1852 82:1525 83:1305 84:1616 85:2993 86:754 87:1941 88:1229 89:3954 90:627 91:7878 92:2134 93:2638 94:3583 95:3999 96:1300 97:315 98:1078 99:735 100:91 101:1150 102:2958 103:32269 104:4824 105:574 106:986 107:2789 108:1140 109:4224 110:2133 111:3196 112:2077 113:1743 114:1712 115:1987 116:1938 117:2495 118:2717 119:1942 120:1804 121:1247 122:2627 123:2230 124:1622 125:2654 128:1478 129:923 130:1056 131:1997 132:822 133:408 134:1698 135:301 136:907 137:988 138:2720 139:1578 140:1331 141:1330 142:1553 143:1524 144:1007 145:343 146:1969 147:1628 148:2465 149:2341 150:877 151:1250 152:1844 153:536 154:5332 155:1388 156:2106 157:1355 158:1051 159:2201 160:2620 161:1600 162:3526 163:1616 164:1660 165:1853 166:1078 167:1752 168:3868 169:793 170:4682 171:957 172:3872 173:2996 174:957 175:1193 176:3625 177:4649 178:3523 179:2224 180:2264 181:3581 182:3414 183:1999 184:2270 185:20661 186:4773 187:4238 188:4058 189:3964 190:9314 191:1472 192:11013 193:8983 194:7313 195:5132 196:3128 197:2497 198:6020 199:6464 200:8057 201:6257 202:10604 203:10033 204:4555 205:3699 206:4438 207:3527 208:4129 209:4930 210:4520 211:2554 212:4257 213:3410 214:1116 215:71 216:6710 217:2779 218:1323 219:582 220:2034 221:1006 222:860 223:2218 End of report

1 0

AS8003 mysteries
by Dave Taht 09 Nov '23

09 Nov '23

Anyone have an update as to where this effort, announcing qute a bit of usa government space, stands? https://www.kentik.com/blog/the-mystery-of-as8003/ -- Oct 30: https://netdevconf.info/0x17/news/the-maestro-and-the-music-bof.html Dave Täht CSO, LibreQos

4 4

Spoofer Report for NANOG for Oct 2023
by CAIDA Spoofer Project 08 Nov '23

08 Nov '23

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Oct 2023: ASN Name Fixed-By 10796 TWC-10796-MIDWEST 2023-10-19 23483 SHASTACOE 2023-10-19 11878 TZULO 2023-10-24 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Oct 2023: ASN Name First-Spoofed Last-Spoofed 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2023-10-26 20412 CLARITY-TELECOM 2016-09-30 2023-10-31 25787 ROWE-NETWORKS 2016-10-21 2023-10-29 11427 TWC-11427-TEXAS 2016-10-21 2023-10-09 271 BCNET 2016-10-24 2023-10-29 6461 ZAYO-6461 2017-06-21 2023-10-11 14031 SCXY 2018-10-18 2023-10-24 55016 IMPER-AS-1 2021-05-18 2023-10-14 46997 2021-12-22 2023-10-26 394414 E2WS 2022-05-08 2023-10-26 400517 2022-10-03 2023-10-08 12183 TALKIE-COMMUNICATIONS 2022-12-10 2023-10-31 3701 NERONET 2023-04-18 2023-10-26 400282 2023-04-27 2023-10-27 46690 SNET-FCC 2023-05-20 2023-10-28 36687 WILINE 2023-08-02 2023-10-10 394660 CHOICETEL-ER 2023-10-07 2023-10-07 19126 KIZAWIRELESS 2023-10-16 2023-10-24 18526 2023-10-17 2023-10-17 393899 RWLV 2023-10-17 2023-10-17 20119 ARROW 2023-10-19 2023-10-21 23483 SHASTACOE 2023-10-19 2023-10-19 12129 123NET 2023-10-20 2023-10-20 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

.US Harbors Prolific Malicious Link Shortening Service
by goemon＠sasami.anime.net 07 Nov '23

07 Nov '23

https://krebsonsecurity.com/2023/10/us-harbors-prolific-malicious-link-shor… "The NTIA recently published a proposal that would allow registrars to redact all registrant data from WHOIS registration records for .US domains. A broad array of industry groups have filed comments opposing the proposed changes, saying they threaten to remove the last vestiges of accountability for a top-level domain that is already overrun with cybercrime activity." What hope is there when registrars are actively aiding and abeting criminal enterprises? Are there any legitimate services running solely on .us domain names? -Dan

14 16

Survey for operators on IPv6 Extension Headers
by Justin Iurman 06 Nov '23

06 Nov '23

Hi NANOG, On behalf of the University of Liege (Belgium), we've been doing measurements on IPv6 Extension Headers over the last two years. More specifically, we're trying to evaluate how they are processed by routers along the path, and so from the edge. Now, we would like to compare our observations with the reality of operators. For that, we propose this very short survey [1] to operators and would really appreciate if you could complete it. Note that we guarantee anonymity of your answers by not sharing any data. Looking forward to your input. Thanks, Justin [1] https://docs.google.com/forms/d/e/1FAIpQLSeHgEWVQMrAbB9-pRf-T-mDHXxRxw-mAqO…

1 0