- Test - lists.nanog.org

CGNAT growing pains
by Jon Lewis 13 Oct '24

13 Oct '24

We started rolling out CGNAT about 6 months ago. It was smooth sailing for the first few months, but we eventually did run into a number of issues. Our customer base is primarily FTTH with "dynamic" IP assignment via DHCP. Since connections are always-on, customer ONTs/routers get an IP assigned, and then when the lease is renewed, they request a new lease for the existing IP, and, in general, that request is granted. This gives customers the mistaken impression they have a static IP. So, my impression, from working with some customers who've needed to be moved from CGNAT back to public IP is that customers who are doing port-forwarding don't even bother with dynamic DNS. They just know they can connect to their IP as they've never seen it change. We do offer/sell static IP, but pre-CGNAT, it was strictly for business customers. i.e. A residential customer could only get static IP service by converting their account to a business account. That may change in the near future. One issue we didn't foresee has been IP Geo issues. i.e. We all knew that streaming services like Netflix use IP Geo to determine what content should be made available, but that's, AFAIK, limited by country or region. What we didn't anticipate is services like Hulu Live TV doing IP Geo down to the city level to determine which local channels are a subscriber's local channels. We're using Juniper MX gear and SPC3 cards for our CGNAT routers, each one having a single large external pool. Since we serve most of FL, one external pool can't IP Geo correctly for customers as far apart as Miami and Jacksonville hitting the same CGNAT router. We don't currently have an acceptable solution to this other than moving impacted customers off CGNAT. One of the great unknowns (at least for us) with CGNAT was what our PBA settings should be. i.e. How large each port-block should be, and how many port-blocks to allow per customer. We started with 256x4. It seemed to work. We eventually noticed that we were logging port-block exceeded errors. This is one aspect where Juniper's CGNAT support is lacking. There's a counter for these errors, and it's available via SNMP, but there's no way to attribute the errors to subscriber IPs. We're polling the mib and graphing it, so we know it's a continuing issue and can see when it's incrementing faster/slower, but Junos provides no means for determining if "PBEs" are all being caused by a single customer, a handful of customers, etc. We have a JTAC case open on this. As a quick & hopeful fix, we both increased the port-block size and block limit. That helped, but didn't stop the errors. It also cut our CGNAT ratio by more than half (64:1 -> 28:1), if we stay at this ratio, we'll need much larger external pools than originally anticipated. Tuning these settings is kind of painful as JTAC strongly recommends bouncing the CGNAT service anytime CGNAT related config changes are made. This means briefly breaking Internet access for all CGNAT'd customers. For the PBEs, JTAC's suggestions so far have been to shorten some of the timeouts in the config and to keep doing what we're doing, which is a cron job that essentially does a "show services nat source port-block", parses the output looking for subscriber IPs that have used up the ports in several of their port-blocks, then does a "show services sessions source-prefix ..." and logs all of this. This at least gives us snapshots of "who's a heavy user right now" and lets us look at how they were using all their ports. i.e. was it bittorent, are they compromised and scanning the internet for more systems to compromise, is it legit looking traffic - just lots of it, etc.? The latest CGNAT issue is a customer with a Palo Alto Networks firewall connected to our network and several of their employees are our FTTH customers. On their PANW firewall, they're doing IP Geo based filtering, limiting access to internal servers to "US IPs". Since we only CGNAT traffic to the external Internet, their on-net employees hit the firewall from their 100.64/10 IPs and get blocked. I suggested they whitelist 100.64/10, saying we block traffic from 100.64/10 from entering our network via peering and transit, so they can be assured anything from 100.64/10 came from inside our network / our customers. They say the firewall won't let them whitelist 100.64.0.0/10, giving an error that it's invalid IP space. I know we're not the first to implement CGNAT, so I'm curious if others have run into these sorts of issues, or others we haven't run into yet, and if so, how you solved them. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Blue Stream Fiber, Sr. Neteng | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

10 14

Frustration with increasing information demands from Network Vendors
by chiel 12 Oct '24

12 Oct '24

Hi, I have an handful of Juniper devices (mx204 / QFX5100). I recently bought a new QFX5110 switch I want to update to a newer software release. My account on the Juniper website seems to be disabled and therefor I send an email to customer care. They replied with a form that I have to fill in. A couple of of the questions are "/$ Revenue Range/", "/# of Sales Reps/", "/# of Office Locations/". "/Details of potential opportunities in progress (also Provide)/". I only filled in the form with my own details (name, email address, etc..) and said I refused to give information about the other questions. Juniper (customer care) replied with "/Please note we need these details to reinstate the account. We can not proceed if the form is incomplete/. " I really really really find it disgusting that companies have no problem asking for this kind of information!! Its not only Juniper but also other major brands. I just bought a single switch and I can't update it without sharing all this information. I'm I do only one that feels this strongly about this?

13 17

China Telecom Global down at NL-IX
by Brandon Zhi 11 Oct '24

11 Oct '24

Hello, Anyone here from China Telecom? It looks like the server in NL-IX is down. 193.239.118.168 Best, *Brandon Zhi* HUIZE LTD www.huize.asia <https://huize.asia/>| www.ixp.su | Twitter This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. HUIZE LTD can’t take any liability and guarantee of the text of the email message and virus.

1 0

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 11 Oct '24

11 Oct '24

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 12 Oct, 2024 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 963835 Prefixes after maximum aggregation (per Origin AS): 366444 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 467822 Number of IPv4 prefixes with a valid ROA: 251079 Number of IPv4 prefixes with an invalid ROA: 896 Number of IPv4 prefixes with no ROA: 711860 Total ASes present in the Internet Routing Table: 76310 Prefixes per ASN: 12.63 Origin-only ASes present in the Internet Routing Table: 65358 Origin ASes announcing only one prefix: 26835 Transit ASes present in the Internet Routing Table: 10952 Transit-only ASes present in the Internet Routing Table: 536 Average AS path length visible in the Internet Routing Table: 5.3 Max AS path length visible: 89 Max AS path prepend of ASN (152107) 85 Prefixes from unregistered ASNs in the Routing Table: 1024 Number of instances of unregistered ASNs: 1029 Number of 32-bit ASNs allocated by the RIRs: 45532 Number of 32-bit ASNs visible in the Routing Table: 37216 Prefixes from 32-bit ASNs in the Routing Table: 193048 Number of bogon 32-bit ASNs visible in the Routing Table: 44 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 536 Number of addresses announced to Internet: 3031616768 Equivalent to 180 /8s, 178 /16s and 205 /24s Percentage of available address space announced: 81.9 Percentage of allocated address space announced: 81.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 315313 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 257911 Total APNIC prefixes after maximum aggregation: 75407 APNIC Deaggregation factor: 3.42 Prefixes being announced from the APNIC address blocks: 249925 Unique aggregates announced from the APNIC address blocks: 101043 APNIC Region origin ASes present in the Internet Routing Table: 14398 APNIC Prefixes per ASN: 17.36 APNIC Region origin ASes announcing only one prefix: 4382 APNIC Region transit ASes present in the Internet Routing Table: 1906 Average APNIC Region AS path length visible: 5.5 Max APNIC Region AS path length visible: 89 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9826 Number of APNIC addresses announced to Internet: 759576960 Equivalent to 45 /8s, 70 /16s and 57 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 281522 Total ARIN prefixes after maximum aggregation: 126053 ARIN Deaggregation factor: 2.23 Prefixes being announced from the ARIN address blocks: 284724 Unique aggregates announced from the ARIN address blocks: 135340 ARIN Region origin ASes present in the Internet Routing Table: 19155 ARIN Prefixes per ASN: 14.86 ARIN Region origin ASes announcing only one prefix: 6968 ARIN Region transit ASes present in the Internet Routing Table: 2005 Average ARIN Region AS path length visible: 4.6 Max ARIN Region AS path length visible: 33 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5018 Number of ARIN addresses announced to Internet: 1267562240 Equivalent to 75 /8s, 141 /16s and 119 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 267847 Total RIPE prefixes after maximum aggregation: 129219 RIPE Deaggregation factor: 2.07 Prefixes being announced from the RIPE address blocks: 264570 Unique aggregates announced from the RIPE address blocks: 168060 RIPE Region origin ASes present in the Internet Routing Table: 28759 RIPE Prefixes per ASN: 9.20 RIPE Region origin ASes announcing only one prefix: 12125 RIPE Region transit ASes present in the Internet Routing Table: 3979 Average RIPE Region AS path length visible: 5.3 Max RIPE Region AS path length visible: 43 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12038 Number of RIPE addresses announced to Internet: 722329216 Equivalent to 43 /8s, 13 /16s and 222 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 122358 Total LACNIC prefixes after maximum aggregation: 28521 LACNIC Deaggregation factor: 4.29 Prefixes being announced from the LACNIC address blocks: 120046 Unique aggregates announced from the LACNIC address blocks: 48601 LACNIC Region origin ASes present in the Internet Routing Table: 11179 LACNIC Prefixes per ASN: 10.74 LACNIC Region origin ASes announcing only one prefix: 2673 LACNIC Region transit ASes present in the Internet Routing Table: 2479 Average LACNIC Region AS path length visible: 5.9 Max LACNIC Region AS path length visible: 61 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9083 Number of LACNIC addresses announced to Internet: 177601280 Equivalent to 10 /8s, 149 /16s and 251 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 33173 Total AfriNIC prefixes after maximum aggregation: 6588 AfriNIC Deaggregation factor: 5.04 Prefixes being announced from the AfriNIC address blocks: 44034 Unique aggregates announced from the AfriNIC address blocks: 14329 AfriNIC Region origin ASes present in the Internet Routing Table: 1890 AfriNIC Prefixes per ASN: 23.30 AfriNIC Region origin ASes announcing only one prefix: 687 AfriNIC Region transit ASes present in the Internet Routing Table: 371 Average AfriNIC Region AS path length visible: 6.0 Max AfriNIC Region AS path length visible: 46 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1251 Number of AfriNIC addresses announced to Internet: 104261632 Equivalent to 6 /8s, 54 /16s and 232 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 10066 8751 76 CHINAMOBILE-CN China Mobile Communication 7545 5959 840 657 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4951 4192 74 ERX-CERNET-BKB China Education and Resear 18403 4481 347 23 FPT-AS-AP FPT Telecom Company, VN 7552 3981 1331 25 VIETEL-AS-AP Viettel Group, VN 9498 3840 512 268 BBIL-AP BHARTI Airtel Ltd., IN 7713 3640 1036 71 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3262 1841 105 VNPT-AS-VN VNPT Corp, VN 24560 2775 828 539 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2273 11520 578 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 10880 11907 3789 AMAZON-02, US 11492 4660 310 547 CABLEONE, US 174 4467 8765 869 COGENT-174, US 7155 4166 287 88 VIASAT-SP-BACKBONE, US 6327 3603 1320 79 SHAW, CA 22773 3414 3035 188 ASN-CXA-ALL-CCI-22773-RDC, US 749 3264 54912 2511 DNIC-AS-00749, US 7018 3192 23677 1975 ATT-INTERNET4, US 396982 2865 3652 422 GOOGLE-CLOUD-PLATFORM, US 16625 2853 1250 2128 AKAMAI-AS, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7652 1708 141 UNI2-AS, ES 39891 4668 282 60 ALJAWWALSTC-AS, SA 20940 3836 3395 129 AKAMAI-ASN1, NL 9009 3642 312 1850 M247, RO 12389 2939 2295 885 ROSTELECOM-AS, RU 34984 2334 357 579 TELLCOM-AS, TR 212238 1775 130 1318 CDNEXT, GB 13188 1606 100 30 TRIOLAN, UA 8452 1579 1852 14 TE-AS TE-AS, EG 8551 1470 368 35 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11531 3243 501 UNINET, MX 10620 3546 494 937 Telmex Colombia S.A., CO 13999 2548 534 363 Mega Cable, S.A. de C.V., MX 11830 2007 369 64 Instituto Costarricense de Electricidad y 28573 1339 2310 261 Claro NXT Telecomunicacoes Ltda, BR 3816 1319 778 194 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6503 1150 374 163 Axtel, S.A.B. de C.V., MX 11664 1148 278 33 Techtel LMDS Comunicaciones Interactivas 6147 1106 369 22 Telefonica del Peru S.A.A., PE 22884 1061 97 373 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1625 593 29 RAYA-AS, EG 24863 1615 389 16 LINKdotNET-AS, EG 36992 1414 1519 283 ETISALAT-MISR, EG 29571 1343 85 61 ORANGE-COTE-IVOIRE, CI 36903 1249 554 96 MT-MPLS, MA 36935 991 523 47 Vodafone-, EG 20011 808 155 353 INTERNET-SOLUTIONS, ZA 37069 557 1100 11 MOBINIL, EG 6713 556 1861 35 IAM-AS, MA 36914 528 82 3 KENET-AS, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11531 3243 501 UNINET, MX 16509 10880 11907 3789 AMAZON-02, US 9808 10066 8751 76 CHINAMOBILE-CN China Mobile Communication 12479 7652 1708 141 UNI2-AS, ES 7545 5959 840 657 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4951 4192 74 ERX-CERNET-BKB China Education and Resear 39891 4668 282 60 ALJAWWALSTC-AS, SA 11492 4660 310 547 CABLEONE, US 18403 4481 347 23 FPT-AS-AP FPT Telecom Company, VN 174 4467 8765 869 COGENT-174, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 10066 9990 CHINAMOBILE-CN China Mobile Communications Grou 12479 7652 7511 UNI2-AS, ES 16509 10880 7091 AMAZON-02, US 7545 5959 5302 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4951 4877 ERX-CERNET-BKB China Education and Research Net 39891 4668 4608 ALJAWWALSTC-AS, SA 18403 4481 4458 FPT-AS-AP FPT Telecom Company, VN 11492 4660 4113 CABLEONE, US 7155 4166 4078 VIASAT-SP-BACKBONE, US 7552 3981 3956 VIETEL-AS-AP Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-D 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.38.73.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 6939 HURRICANE, US 23.137.192.0/24 Origin: 31798 DATACITY, CA 23.137.192.0/24 Transit: 21949 BEANFIELD, CA 23.139.40.0/23 Origin: 945 8964, TW 23.139.40.0/23 Transit: 7018 ATT-INTERNET4, US 23.139.40.0/24 Origin: 202736 WISDOM, SG 23.139.40.0/24 Transit: 984 OWS, US 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:16 /10:36 /11:91 /12:296 /13:578 /14:1172 /15:2061 /16:13227 /17:8304 /18:13772 /19:24622 /20:44889 /21:52302 /22:112226 /23:100283 /24:589210 /25:734 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6712 7652 UNI2-AS, ES 8151 5714 11531 UNINET, MX 11492 3555 4660 CABLEONE, US 39891 3428 4668 ALJAWWALSTC-AS, SA 6327 3398 3603 SHAW, CA 7155 3110 4166 VIASAT-SP-BACKBONE, US 22773 2546 3414 ASN-CXA-ALL-CCI-22773-RDC, US 16509 2214 10880 AMAZON-02, US 10620 2175 3546 Telmex Colombia S.A., CO 30036 2174 2513 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2293 2:1533 3:501 4:8 5:4460 6:168 7:6 8:1512 9:1 11:172 12:1426 13:369 14:2467 15:329 16:264 17:357 18:894 20:410 21:4 22:188 23:6883 24:2646 25:2 27:2599 29:19 31:2810 32:47 34:66 35:141 36:2365 37:4546 38:8687 39:919 40:150 41:4125 42:2149 43:2444 44:333 45:17568 46:4661 47:299 49:2024 50:1877 51:581 52:1578 54:318 55:954 56:8 57:222 58:2253 59:1264 60:1132 61:2683 62:2784 63:1857 64:5403 65:2267 66:4652 67:2990 68:1335 69:4011 70:1132 71:567 72:2860 74:2787 75:1628 76:633 77:2577 78:1867 79:1650 80:2206 81:2026 82:1738 83:1381 84:1755 85:3085 86:1006 87:2405 88:1263 89:4343 90:669 91:8241 92:2602 93:2798 94:3791 95:4299 96:1261 97:316 98:1069 99:739 100:74 101:1170 102:3424 103:32321 104:4454 105:707 106:985 107:2384 108:1171 109:4011 110:2181 111:3330 112:2032 113:1783 114:1924 115:2113 116:1988 117:2716 118:2878 119:1985 120:1896 121:1414 122:2707 123:2151 124:1632 125:2859 126:64 128:1407 129:944 130:1247 131:1834 132:810 133:444 134:1514 135:312 136:1215 137:1118 138:2848 139:1524 140:1456 141:1438 142:1770 143:1577 144:1027 145:386 146:2093 147:2049 148:2534 149:2837 150:1063 151:1380 152:2113 153:499 154:7038 155:1467 156:2592 157:1823 158:1200 159:2452 160:3183 161:1730 162:3573 163:1754 164:1930 165:2137 166:1299 167:1840 168:4073 169:781 170:4921 171:1029 172:3890 173:3110 174:904 175:1256 176:3468 177:4693 178:3588 179:2204 180:2491 181:3871 182:3322 183:2056 184:2255 185:21126 186:5036 187:4216 188:4254 189:4054 190:9630 191:1533 192:11070 193:9260 194:7592 195:5411 196:3244 197:3375 198:6028 199:8161 200:8157 201:6328 202:10539 203:10388 204:4579 205:3693 206:4635 207:3692 208:4204 209:5169 210:4775 211:2614 212:4483 213:3638 214:1063 215:48 216:6604 217:2989 218:1388 219:557 220:2066 221:1049 222:862 223:2269 End of report

1 0

Microsoft contact (Safe Links / Defender for Office 365)
by Romain 11 Oct '24

11 Oct '24

Hi all, If there is anyone from Microsoft here, that could help getting a legitimate link to stop being blocked by Safe Links / Microsoft Defender for Office 365... All reports method I can find on Internet require to be a customer of this solution, and I'm not. Thank you. Best regards, Romain

1 0

Secure Your Spot in the Upcoming Workshops at N92 + More
by Nanog News 10 Oct '24

10 Oct '24

*** NANOG 92 Programming Spotlight* ------------------------------------------------------------ *Secure Your Spot in the Upcoming Workshops at N92* *EVPN Workshop *- Tues., Oct. 22 at 2:30 pm - EVPN Layer 2 & Layer 3 Data Center—Overview, Configure and Validate EVPN using Container Lab. Two experts from Nokia will lead participants through the learning experience. Limited to onsite attendees; sign up here. ( https://nanog.org/events/nanog-92/workshop-evpn/) *ROA Workshop* - Tues., Oct. 22 at 11 am - Create ROAs Today and Secure your Resources with ARIN’s RPKI Services. This workshop is an opportunity to start working on building ROAs for your businesses with the trusted help of ARIN experts. *VIEW AGENDA *- https://nanog.org/events/nanog-92/agenda/ *** Can't Make it to N92? Virtual Registration is Open!* ------------------------------------------------------------ *Stay Updated on the Latest in Internet Infrastructure from Your Laptop* Virtual Registration Rate: $100. *MORE INFO* - https://nanog.org/events/nanog-92/register/ *** NANOG Hackathon 92 Will Kick Off Friday!* ------------------------------------------------------------ *Still Time to Register - Don't Miss Out!* *Important Dates:* 11, Oct. - Intro/Infrastructure Tutorial/Team Formation 21 - 22, Oct. - Competition *Theme:* Put your sleuthing skills to the test! The Hackathon will focus on Problem-Solving/Troubleshooting competitions. *LEARN MORE *- https://nanog.org/events/nanog-92-hackathon/ *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

Spoofer Report for NANOG for Sep 2024
by CAIDA Spoofer Project 08 Oct '24

08 Oct '24

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Sep 2024: ASN Name Fixed-By 1403 EBOX 2024-09-24 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Sep 2024: ASN Name First-Spoofed Last-Spoofed 40676 AS40676 2016-08-29 2024-09-29 27364 ACS-INTERNET 2016-09-27 2024-09-25 12083 WOW-INTERNET 2016-11-09 2024-09-29 701 UUNET 2017-06-14 2024-09-01 2152 CSUNET-NW 2017-11-08 2024-09-25 33363 BHN-33363 2018-11-29 2024-09-07 21804 ACCESS-SK 2019-06-09 2024-09-30 12183 TALKIE-COMMUNICATIONS 2022-12-10 2024-09-28 3701 NERONET 2023-04-18 2024-09-28 400282 2023-04-27 2024-09-27 393577 SCCNET 2023-05-03 2024-09-29 202400 2023-05-08 2024-09-30 61461 Airtek Solutions C.A. 2023-05-13 2024-09-25 20119 ARROW 2023-10-19 2024-09-25 394684 WISPERNET 2024-01-17 2024-09-28 394195 CLEARNETWORX 2024-03-22 2024-09-30 20326 TERASWITCH 2024-04-15 2024-09-09 214961 2024-05-14 2024-09-13 393530 TLU 2024-05-22 2024-09-26 19935 CRRS 2024-05-29 2024-09-29 57308 Rossvyazinform 2024-08-10 2024-09-29 3801 MISNET 2024-09-09 2024-09-27 40959 HOSTMASTER 2024-09-16 2024-09-16 30475 WEHOSTWEBSITES-COM 2024-09-30 2024-09-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

6461 Zayo Lurkers
by TJ Trout 07 Oct '24

07 Oct '24

We are experiencing an issue on our Zayo ports where you are not propagating announcements daily at 120-130 utc Validated on 4 customer ports in 2 US states. Email me for more info. Thank you,

2 2

WSJ: China-Linked Hackers Breach U.S. ISPs in New "Salt Typhoon" attack
by Sean Donelan 05 Oct '24

05 Oct '24

Wall Street Journal out with an 'exclusive' article. This is apparently different than the other *-Typhoon groups (or whatever your favorite threat intelligence provider calls then). I don't know why the *-Typhoon groups would limit their intrusions to only U.S. ISPs. Broadband ISPs in other countries may have similar issues. China-Linked Hackers Breach U.S. Internet Providers in New ‘Salt Typhoon’ Cyberattack https://www.wsj.com/politics/national-security/china-cyberattack-internet-p… Hackers linked to the Chinese government have broken into a handful of U.S. internet-service providers in recent months in pursuit of sensitive information, according to people familiar with the matter. The hacking campaign, called Salt Typhoon by investigators, hasn’t previously been publicly disclosed and is the latest in a series of incursions that U.S. investigators have linked to China in recent years. The intrusion is a sign of the stealthy success Beijing’s massive digital army of cyberspies has had breaking into valuable computer networks in the U.S. and around the globe. In Salt Typhoon, the actors linked to China burrowed into America’s broadband networks. In this type of intrusion, bad actors aim to establish a foothold within the infrastructure of cable and broadband providers that would allow them to access data stored by telecommunications companies or launch a damaging cyberattack.

2 1

db9f to usb-c serial
by Randy Bush 05 Oct '24

05 Oct '24

i know this is geeky, and not telling anyone else how thry should run their network. but i gotta try. :) so i have this nice (i.e. small and simple) ftdi usb-c to rj45m blue router craft/console cable. i also have a db9f to rj45m cable, also robin's egg blue. i i also have an old and clunky keyspan to usb-a; old, clunky, usb-a. i want the equivalent usb-c ftdi (mac compat) to db9f *server* serial console cable. 1-2m. integrated, slick, and sexy. magenta preferred, of course :) know any nice ones? randy

12 18