- Test - lists.nanog.org

Autunomous system filtering?
by Giuseppe Spanò - Datacast Srl 18 Nov '16

18 Nov '16

Hi! We are experiencing a strange issue with announcements from our AS207029. On Sept. 16th we began to announce our prefixes 185.85.20.0/22 through our upstream provider AS28716 (E-Planet). Everything worked correctly. Suddenly during the night between 17th and 18th Sept. the visibility of those prefixes dropped heavily (source: ripe stats) and we began experiencing big issues with our customers. We decided then to differentiate the announcements as it follows: AS2876 announces 185.85.20.0/23 AS207029 announces 185.85.22.0/23 (those prefixes are idle at the moment) essentially we split the /22 into two /23 so to keep monitored our AS propagation. What’s happening is interesting: prefixes announced by AS2876 are regularly spread everywhere, those announced by AS207029 not. For example, we can see network 185.85.22.0/23 from HE looking glasses, but we cannot see it into Cogent, Level3 or Split looking glasses. It seems an AS filtering is acting somewhere, and this looks a bit weird to me. Did this ever happen to any of you? Do you have ideas? Our upstream provider (that owns peering sessions with all the above providers) opened tickets to them, but if Network Engineers from Cogent, Level3 or Split should be reading this, could they kindly have a look into their filter configurations? Thank you to all of you for your kind attention. Regards, Giuseppe Spanò - Datacast Srl spano(a)datacast.it

4 3

Weekly Routing Table Report
by cscora＠apnic.net 18 Nov '16

18 Nov '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 19 Nov, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 623487 Prefixes after maximum aggregation (per Origin AS): 220779 Deaggregation factor: 2.82 Unique aggregates announced (without unneeded subnets): 302048 Total ASes present in the Internet Routing Table: 55250 Prefixes per ASN: 11.28 Origin-only ASes present in the Internet Routing Table: 36327 Origin ASes announcing only one prefix: 15324 Transit ASes present in the Internet Routing Table: 6538 Transit-only ASes present in the Internet Routing Table: 164 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 36 Max AS path prepend of ASN ( 55644) 31 Prefixes from unregistered ASNs in the Routing Table: 64 Unregistered ASNs in the Routing Table: 20 Number of 32-bit ASNs allocated by the RIRs: 16184 Number of 32-bit ASNs visible in the Routing Table: 12385 Prefixes from 32-bit ASNs in the Routing Table: 50127 Number of bogon 32-bit ASNs visible in the Routing Table: 386 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 407 Number of addresses announced to Internet: 2832026276 Equivalent to 168 /8s, 205 /16s and 74 /24s Percentage of available address space announced: 76.5 Percentage of allocated address space announced: 76.5 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.3 Total number of prefixes smaller than registry allocations: 205446 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 157521 Total APNIC prefixes after maximum aggregation: 42753 APNIC Deaggregation factor: 3.68 Prefixes being announced from the APNIC address blocks: 171530 Unique aggregates announced from the APNIC address blocks: 70096 APNIC Region origin ASes present in the Internet Routing Table: 5184 APNIC Prefixes per ASN: 33.09 APNIC Region origin ASes announcing only one prefix: 1152 APNIC Region transit ASes present in the Internet Routing Table: 942 Average APNIC Region AS path length visible: 4.3 Max APNIC Region AS path length visible: 34 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2490 Number of APNIC addresses announced to Internet: 759721284 Equivalent to 45 /8s, 72 /16s and 109 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 187964 Total ARIN prefixes after maximum aggregation: 89402 ARIN Deaggregation factor: 2.10 Prefixes being announced from the ARIN address blocks: 194317 Unique aggregates announced from the ARIN address blocks: 89233 ARIN Region origin ASes present in the Internet Routing Table: 16138 ARIN Prefixes per ASN: 12.04 ARIN Region origin ASes announcing only one prefix: 5654 ARIN Region transit ASes present in the Internet Routing Table: 1711 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1591 Number of ARIN addresses announced to Internet: 1105690016 Equivalent to 65 /8s, 231 /16s and 125 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 149759 Total RIPE prefixes after maximum aggregation: 72610 RIPE Deaggregation factor: 2.06 Prefixes being announced from the RIPE address blocks: 160650 Unique aggregates announced from the RIPE address blocks: 98008 RIPE Region origin ASes present in the Internet Routing Table: 18155 RIPE Prefixes per ASN: 8.85 RIPE Region origin ASes announcing only one prefix: 7793 RIPE Region transit ASes present in the Internet Routing Table: 3037 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 27 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5091 Number of RIPE addresses announced to Internet: 709323136 Equivalent to 42 /8s, 71 /16s and 105 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 62852 Total LACNIC prefixes after maximum aggregation: 12642 LACNIC Deaggregation factor: 4.97 Prefixes being announced from the LACNIC address blocks: 79140 Unique aggregates announced from the LACNIC address blocks: 37727 LACNIC Region origin ASes present in the Internet Routing Table: 2477 LACNIC Prefixes per ASN: 31.95 LACNIC Region origin ASes announcing only one prefix: 552 LACNIC Region transit ASes present in the Internet Routing Table: 593 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 30 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2935 Number of LACNIC addresses announced to Internet: 170952512 Equivalent to 10 /8s, 48 /16s and 135 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 15199 Total AfriNIC prefixes after maximum aggregation: 3364 AfriNIC Deaggregation factor: 4.52 Prefixes being announced from the AfriNIC address blocks: 17443 Unique aggregates announced from the AfriNIC address blocks: 6616 AfriNIC Region origin ASes present in the Internet Routing Table: 741 AfriNIC Prefixes per ASN: 23.54 AfriNIC Region origin ASes announcing only one prefix: 173 AfriNIC Region transit ASes present in the Internet Routing Table: 180 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 278 Number of AfriNIC addresses announced to Internet: 85867520 Equivalent to 5 /8s, 30 /16s and 60 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5548 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3611 390 250 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2964 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9829 2713 1500 539 BSNL-NIB National Internet Backbone, IN 4766 2699 11132 739 KIXS-AS-KR Korea Telecom, KR 9808 2220 8698 33 CMNET-GD Guangdong Mobile Communication 4755 2044 428 216 TATACOMM-AS TATA Communications formerl 4808 1746 2278 510 CHINA169-BJ China Unicom Beijing Provin 45899 1703 1248 93 VNPT-AS-VN VNPT Corp, VN 24560 1565 542 229 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3564 2967 152 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3156 1333 82 SHAW - Shaw Communications Inc., CA 18566 2196 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 1948 2003 406 CHARTER-NET-HKY-NC - Charter Communicat 30036 1769 334 364 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1742 5069 657 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1677 848 227 ITCDELTA - Earthlink, Inc., US 701 1600 10634 657 UUNET - MCI Communications Services, In 7018 1480 20476 1047 ATT-INTERNET4 - AT&T Services, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3330 170 16 ALJAWWALSTC-AS , SA 20940 2937 1113 2082 AKAMAI-ASN1 , US 34984 1990 327 364 TELLCOM-AS , TR 9121 1719 1691 18 TTNET , TR 13188 1607 99 58 TRIOLAN , UA 12479 1375 1033 54 UNI2-AS , ES 8551 1202 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 6849 1142 355 21 UKRTELNET , UA 8402 1139 544 15 CORBINA-AS OJSC "Vimpelcom", RU 9198 1057 352 25 KAZTELECOM-AS , KZ Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3536 546 142 Telmex Colombia S.A., CO 8151 2287 3371 551 Uninet S.A. de C.V., MX 7303 1528 964 248 Telecom Argentina S.A., AR 6503 1486 437 54 Axtel, S.A.B. de C.V., MX 11830 1354 369 57 Instituto Costarricense de Electricidad 6147 1289 377 27 Telefonica del Peru S.A.A., PE 7738 1024 1882 41 Telemar Norte Leste S.A., BR 28573 1009 2260 177 CLARO S.A., BR 3816 987 474 192 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 909 126 79 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1192 402 50 LINKdotNET-AS, EG 36903 686 345 123 MT-MPLS, MA 37611 680 67 6 Afrihost, ZA 36992 575 1373 25 ETISALAT-MISR, EG 8452 481 1472 15 TE-AS TE-AS, EG 37492 396 288 72 ORANGE-TN, TN 24835 379 594 16 RAYA-AS, EG 29571 364 37 11 CITelecom-AS, CI 15399 309 35 6 WANANCHI-KE, KE 36974 275 140 11 AFNET-AS, CI Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5548 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3611 390 250 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3564 2967 152 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3536 546 142 Telmex Colombia S.A., CO 39891 3330 170 16 ALJAWWALSTC-AS , SA 6327 3156 1333 82 SHAW - Shaw Communications Inc., CA 17974 2964 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2937 1113 2082 AKAMAI-ASN1 , US 9829 2713 1500 539 BSNL-NIB National Internet Backbone, IN 4766 2699 11132 739 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3564 3412 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3536 3394 Telmex Colombia S.A., CO 7545 3611 3361 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3330 3314 ALJAWWALSTC-AS , SA 6327 3156 3074 SHAW - Shaw Communications Inc., CA 17974 2964 2893 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2220 2187 CMNET-GD Guangdong Mobile Communication 9829 2713 2174 BSNL-NIB National Internet Backbone, IN 18566 2196 2087 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 2056 BELLSOUTH-NET-BLK - BellSouth.net Inc., Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 64855 PRIVATE 41.220.200.0/21 36945 mcelISP, MZ 65001 PRIVATE 46.237.32.0/20 13118 ASN-YARTELECOM PJSC Rostelecom Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.128.12.0/22 55763 UNKNOWN 14.128.12.0/24 55763 UNKNOWN 14.128.13.0/24 55763 UNKNOWN 14.128.15.0/24 55763 UNKNOWN 27.100.7.0/24 56096 UNKNOWN 27.110.192.0/22 45664 UNKNOWN 27.110.196.0/22 45664 UNKNOWN 27.110.200.0/22 45664 UNKNOWN 27.110.204.0/22 45664 UNKNOWN 27.110.224.0/22 45664 UNKNOWN Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:102 /12:274 /13:522 /14:1049 /15:1785 /16:13149 /17:7845 /18:13078 /19:25562 /20:38332 /21:40986 /22:72413 /23:60828 /24:346224 /25:459 /26:365 /27:305 /28:61 /29:38 /30:12 /31:1 /32:32 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 2953 3156 SHAW - Shaw Communications Inc., CA 39891 2896 3330 ALJAWWALSTC-AS , SA 22773 2774 3564 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2089 2196 MEGAPATH5-US - MegaPath Corporation, US 30036 1586 1769 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 10620 1443 3536 Telmex Colombia S.A., CO 6389 1393 2095 BELLSOUTH-NET-BLK - BellSouth.net Inc., 13188 1351 1607 TRIOLAN , UA 6983 1323 1677 ITCDELTA - Earthlink, Inc., US 34984 1274 1990 TELLCOM-AS , TR Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1561 2:814 4:23 5:2338 6:32 8:1006 12:1805 13:53 14:1756 15:24 16:2 17:104 18:126 20:48 23:1916 24:1820 27:2377 31:1812 32:82 33:4 35:3 36:351 37:2423 38:1315 39:39 40:100 41:2936 42:455 43:1894 44:49 45:2250 46:2551 47:106 49:1182 50:936 51:16 52:575 53:2 54:352 55:7 56:4 57:40 58:1592 59:1006 60:378 61:1839 62:1476 63:1913 64:4584 65:2174 66:4353 67:2246 68:1141 69:3285 70:1294 71:560 72:2071 74:2595 75:404 76:414 77:1435 78:1536 79:923 80:1343 81:1401 82:994 83:714 84:868 85:1676 86:476 87:1122 88:697 89:2038 90:198 91:6142 92:958 93:2370 94:2416 95:2715 96:561 97:347 98:943 99:92 100:147 101:1179 103:12752 104:2583 105:145 106:465 107:1451 108:788 109:2487 110:1282 111:1645 112:1139 113:1154 114:1094 115:1692 116:1684 117:1559 118:2125 119:1568 120:968 121:1091 122:2287 123:2044 124:1599 125:1840 128:681 129:473 130:420 131:1383 132:617 133:175 134:521 135:205 136:404 137:391 138:1785 139:432 140:620 141:471 142:694 143:894 144:720 145:170 146:952 147:671 148:1386 149:551 150:669 151:971 152:693 153:309 154:692 155:950 156:537 157:564 158:437 159:1317 160:563 161:717 162:2434 163:545 164:778 165:1130 166:352 167:1214 168:2359 169:679 170:2321 171:258 172:819 173:1822 174:765 175:715 176:1743 177:4074 178:2376 179:1133 180:2150 181:1904 182:2117 183:1013 184:838 185:8043 186:3166 187:2136 188:2262 189:1768 190:7884 191:1307 192:9138 193:5752 194:4534 195:3864 196:1856 197:1257 198:5605 199:5830 200:7140 201:3730 202:10118 203:9800 204:4489 205:2764 206:3016 207:3129 208:4035 209:3886 210:3893 211:2050 212:2761 213:2437 214:863 215:67 216:5745 217:1989 218:812 219:598 220:1650 221:874 222:711 223:1344 End of report

1 0

Amsterdam/London Underesea Cables
by Rod Beck 18 Nov '16

18 Nov '16

Hi, I am trying to determine which undersea cables used for London/Amsterdam traffic are the most reliable - fewest outages due to shunt faults and other problems. Looks like most of the traffic traverses the following systems: Farland North UK-Netherlands Ulysses Circe North Concerto My recollection, which is foggy, is that Circe North was rebuilt due to repeated shunt faults. Feel free to contact me offlist so you can share the good, the bad, and the ugly. [😊] Roderick Beck Director of Global Sales United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> 85 Király utca, 1077 Budapest rod.beck(a)unitedcablecompany.com 36-30-859-5144 [1467221429846_image002.jpg][1467221477350_image005.png]

2 1

Re: Subject: Paging Olav van Doorn, Jan Willem Meijer, and Rutger Bevaart
by Rutger Bevaart 18 Nov '16

18 Nov '16

Hi Ronald, You obviously managed to find us ;-) All our contact details are on peeringdb.com, our corporate website, LinkedIn, etc. We should be pretty easy to reach. The message you sent to our 24x7 NOC was marked as “spam”, ironic. Thank you for bringing this to my attention, we’ve asked the customer for clarification on this and in the meantime blocked offending prefixes. We update our filters based on RADB entries which is why these were accepted (valid route entries exist), I’ll evaluate if we need to do more than that. Cheers, Rutger

1 0

Paging Olav van Doorn, Jan Willem Meijer, and Rutger Bevaart
by Ronald F. Guilmette 17 Nov '16

17 Nov '16

If anybody can give me an email for any of these principals of Xconnect42, Inc. (Neatherlands) aka AS260, I'd appreciate it. I tried to reach somebody (anybody) at their company via the address I found online for the company <gsc(a)custom-connect.com> but never got any response. That was a week ago. I'm real interested to have these guys explain to me why they are peering with the following ASNs, which all appear to have one and only one BGP peer, i.e. Xconnect24, Inc. AS7971 AS10505 AS6560 AS14029 AS37135 AS37137 Note that each and every one of the above six Afrinic-issued ASNs appears to be announcing routes to gobs and gobs of IPv4 space... mostly prevously abandoned AFRINIC space, but also, in the case of AS10505, numerous /17 hunks of Chinese IPv4 space... to which the ASNs in question do not appear to have any relationship, and where a great deal of the relevant IPv4 address space has been filed up to the brim by U.S.A. based snowshoe spammers, including, apparently, at least one convicted felon and former drug trafficker. Note also that two of the /17 routes currently being announced by AS10505 are for IPv4 space allocated by APNIC to Aliyun Computing, Ltd. which Bloomberg lists as a subsidiary of retail giant Alibaba, currently having a market cap of $232.4 bellion dollars (USD). I dunno. maybe it's just me, but I somehow think that a Chinese company worth almost a quarter of a trillion dollars probably doesn't really need to enlist the help of a long-dead South African ISP to route parts of their space for them. http://imgur.com/a/uR0qQ So anyway, I'd really like to have a brief chat with any or all of the following three gentlemen about all this: CEO - Olav van Doorn https://nl.linkedin.com/in/olavvandoorn Co-founder Jan Willem Meijer: https://www.loth.nl/company-profile-custom-connect/ CTO - Rutger Bevaart https://nl.linkedin.com/in/rutgerbevaart If anybody can put me in touch, I'd apperciate it. Thanks. Regards, rfg

1 0

Network Diagnostic Tool
by Mehrdad Arshad Rad 17 Nov '16

17 Nov '16

Hi, I've started to develop an open source tool 4 months ago to help neteng/sysadmin/sysops please take look at the below link and let me know if you have any suggestions. https://github.com/mehrdadrad/mylg p.s you can download it for different operating systems at http://mylg.io Thanks, Mehrdad

4 3

NEVERMIND! (was: Seeking Google reverse DNS delegation contact)
by Ronald F. Guilmette 17 Nov '16

17 Nov '16

My profuse apologies to everyone. It seems that Google is not in fact involved in any way with providing reverse DNS for the 204.8.136.0/21 IP address block. I was deceived into believing it was by some unusual trickey on the part of the spammer-controlled name servers ns1.saversagreeable.com and ns2.saversagreeable.com. You can see the clever deception toward the very end of the dig +trace listing I posted: http://pastebin.com/raw/VNwmgMHh It seems those clever rascal spammers tried to implicate Google's name servers, but it is only their's which are giving out the reverse DNS which suoorts their snowshoe spamming efforts in the 204.8.136.0/21 block. Sorry for my mistake everyone. I wasn't expecting quite this level or kind of reverse DNS delegation trickery. Regards, rfg

2 2

198.154.60.0/22 bogon/hijacked?
by Jeremy Parsons 16 Nov '16

16 Nov '16

3 2

Port 2323/tcp
by Stephen Satchell 16 Nov '16

16 Nov '16

I've been seeing a lot of rejections in my logs for 2323/tcp. According to the Storm Center, this is what the Mirai botnet scanner uses to look for other target devices. Is it worthwhile to report sightings to the appropriate abuse addresses? (That assumes there *is* an abuse address associated with the IPv4 address that is the source.) Would administrations receiving these notices do anything with them? Alternatively, is there anyone collecting this information from people like me to expose the IP addresses of possible infections? I am toying with the idea of setting up a honey-pot, but I'm so far behind with $DAYJOB that such a project will have to wait a bit. I want to be a good net citizen. I also want to make sure I'm not wasting my time. Today's crop: > 1.34.169.183 > 12.221.236.2 > 14.138.22.12 > 14.169.142.30 > 14.174.71.158 > 14.177.197.101 > 31.168.146.33 > 31.168.212.174 > 36.71.224.179 > 36.72.253.206 > 37.106.18.86 > 42.115.187.189 > 42.117.254.248 > 42.119.228.222 > 43.225.195.180 > 46.59.6.249 > 49.114.192.91 > 58.11.238.146 > 58.186.231.59 > 59.8.136.21 > 59.49.191.4 > 59.57.68.56 > 59.126.35.47 > 59.126.242.70 > 59.127.104.67 > 59.127.242.8 > 60.251.125.125 > 61.219.165.38 > 73.84.152.194 > 78.179.113.148 > 78.186.61.30 > 78.189.169.142 > 78.226.222.234 > 79.119.74.255 > 81.16.8.193 > 81.101.233.14 > 81.214.121.43 > 81.214.134.133 > 81.214.137.197 > 82.77.68.189 > 83.233.40.141 > 85.96.202.199 > 85.99.121.41 > 85.238.103.111 > 86.121.225.48 > 87.251.252.22 > 88.249.224.167 > 89.122.87.239 > 89.151.128.198 > 90.177.91.201 > 92.53.52.235 > 92.55.231.90 > 94.31.239.178 > 94.254.41.152 > 94.255.162.90 > 95.78.245.54 > 95.106.34.92 > 95.161.236.182 > 96.57.103.19 > 101.0.43.13 > 108.203.68.245 > 110.55.108.215 > 110.136.233.10 > 112.133.69.176 > 112.165.93.130 > 112.186.42.216 > 113.5.224.110 > 113.161.64.11 > 113.169.18.153 > 113.171.98.158 > 113.172.4.204 > 113.183.204.112 > 113.188.44.246 > 114.32.28.219 > 114.32.87.32 > 114.32.189.5 > 114.34.29.167 > 114.34.170.10 > 114.35.153.123 > 114.226.53.133 > 115.76.127.118 > 116.73.65.248 > 116.100.170.92 > 117.0.7.77 > 117.1.26.234 > 117.195.254.3 > 118.32.44.99 > 118.42.15.21 > 118.43.112.120 > 118.100.64.159 > 118.163.191.208 > 119.199.160.207 > 119.202.78.47 > 120.71.215.81 > 121.129.203.22 > 121.178.104.129 > 121.180.53.143 > 122.117.245.28 > 123.9.72.86 > 123.16.78.77 > 123.23.49.149 > 123.24.108.10 > 123.24.250.187 > 123.25.74.209 > 123.27.159.13 > 123.240.245.72 > 124.66.99.251 > 124.131.28.38 > 125.166.193.206 > 125.227.138.132 > 138.204.203.66 > 171.97.245.221 > 171.224.7.147 > 171.226.20.220 > 171.232.118.93 > 171.248.210.120 > 171.249.223.213 > 171.250.26.209 > 173.56.21.67 > 175.138.81.130 > 175.203.202.232 > 175.207.137.139 > 175.211.251.156 > 177.207.49.108 > 177.207.67.170 > 177.223.52.193 > 178.222.246.96 > 179.4.140.63 > 179.235.55.39 > 179.253.163.107 > 180.73.117.62 > 180.254.224.10 > 182.37.156.98 > 182.180.80.75 > 182.180.123.43 > 183.46.49.216 > 183.144.245.235 > 186.19.48.158 > 186.69.170.130 > 186.219.1.156 > 187.104.248.17 > 187.211.63.51 > 188.209.153.15 > 189.101.220.244 > 189.234.9.147 > 191.103.35.250 > 191.180.198.31 > 191.249.21.41 > 196.207.83.23 > 197.224.37.108 > 201.243.225.103 > 210.178.250.121 > 211.7.146.51 > 211.216.202.191 > 213.5.216.213 > 213.14.195.100 > 213.170.76.149 > 217.129.243.48 > 218.161.121.178 > 218.186.43.224 > 220.85.169.133 > 220.132.111.124 > 220.133.24.142 > 220.133.198.71 > 220.133.234.229 > 220.134.132.200 > 220.134.193.133 > 220.135.64.43 > 221.145.147.78 > 221.159.105.17 > 221.167.64.53 > 222.254.238.188 > 223.154.223.159

5 4

Contact at NY State Health Department
by Eric C. Miller 15 Nov '16

15 Nov '16

Is there anyone from NY State Health Department here that can help me with random connection drops? Thank you! Eric Miller

1 0