BGP Update Report

[cidr-report]

BGP Update Report
Interval: 20-Dec-12 -to- 27-Dec-12 (7 days)
Observation Point: BGP Peering with AS131072

TOP 20 Unstable Origin AS
Rank ASNUpds %  Upds/PfxAS-Name
 1 - AS840236701  2.6%  55.5 -- CORBINA-AS OJSC "Vimpelcom"
 2 - AS390936562  2.6%4570.2 -- QWEST-AS-3908 - Qwest 
Communications Company, LLC
 3 - AS982929062  2.1%  34.3 -- BSNL-NIB National Internet 
Backbone
 4 - AS29256   24976  1.8%1085.9 -- INT-PDN-STE-AS Syrian 
Telecommunications Establishment
 5 - AS701 22541  1.6% 727.1 -- UUNET - MCI Communications 
Services, Inc. d/b/a Verizon Business
 6 - AS419816386  1.2%1365.5 -- RADIXNET - RadixNet, Inc.
 7 - AS163716301  1.2% 494.0 -- DNIC-AS-01637 - Headquarters, 
USAISC
 8 - AS755214557  1.1%  15.4 -- VIETEL-AS-AP Vietel Corporation
 9 - AS453810240  0.7%  22.5 -- ERX-CERNET-BKB China Education 
and Research Network Center
10 - AS9198 8248  0.6%  24.0 -- KAZTELECOM-AS JSC Kazakhtelecom
11 - AS296147576  0.6% 315.7 -- GHANATEL-AS
12 - AS452717556  0.6%  34.0 -- ICLNET-AS-AP 5th Floor, Windsor 
Building, Off: CST Road
13 - AS7029 7548  0.5%   6.9 -- WINDSTREAM - Windstream 
Communications Inc
14 - AS381427288  0.5% 455.5 -- UNAIR-AS-ID Universitas 
Airlangga
15 - AS481597270  0.5%  22.9 -- TIC-AS Telecommunication 
Infrastructure Company
16 - AS507106912  0.5%  47.0 -- EARTHLINK-AS EarthLink Ltd. 
Communications&Internet Services
17 - AS2033 6551  0.5%6551.0 -- PANIX - Panix Network 
Information Center
18 - AS240576313  0.5%6313.0 -- AIGL-AS-AP PT. AIA FINANCIAL, 
Insurance company, Indonesia
19 - AS9756 6046  0.4% 403.1 -- CHEONANVITSSEN-AS-KR Cheonan 
Broadcast Corporation
20 - AS2708 6000  0.4%  85.7 -- Universidad de Guanajuato


TOP 20 Unstable Origin AS (Updates per announced prefix)
Rank ASNUpds %  Upds/PfxAS-Name
 1 - AS2033 6551  0.5%6551.0 -- PANIX - Panix Network 
Information Center
 2 - AS240576313  0.5%6313.0 -- AIGL-AS-AP PT. AIA FINANCIAL, 
Insurance company, Indonesia
 3 - AS374304818  0.3%4818.0 -- vdctelecom
 4 - AS390936562  2.6%4570.2 -- QWEST-AS-3908 - Qwest 
Communications Company, LLC
 5 - AS194064202  0.3%4202.0 -- TWRS-MA - Towerstream I, Inc.
 6 - AS9950 4150  0.3%4150.0 -- PUBNETPLUS2-AS-KR DACOM
 7 - AS427054120  0.3%4120.0 -- TALIA Talia provides VSAT 
network and hosting services worldwide.
 8 - AS331584022  0.3%4022.0 -- DATA-SERVICES-INC - Data 
Services Incorporated
 9 - AS579183437  0.2%3437.0 -- ACOD-AS ACOD CJSC
10 - AS6174 5644  0.4%2822.0 -- SPRINTLINK8 - Sprint
11 - AS6629 2494  0.2%2494.0 -- NOAA-AS - NOAA
12 - AS6197 2349  0.2%2349.0 -- BATI-ATL - BellSouth Network 
Solutions, Inc
13 - AS255271993  0.1%1993.0 -- CARTELSISTEM-AS Cartel-Sistem 
SRL, Moldova, Chisinau
14 - AS172933852  0.3%1926.0 -- VTXC - VTX Communications
15 - AS409311695  0.1%1695.0 -- MOBITV - MobiTV, Inc
16 - AS146804951  0.4%1650.3 -- REALE-6 - Auction.com
17 - AS419816386  1.2%1365.5 -- RADIXNET - RadixNet, Inc.
18 - AS4826 1298  0.1%1298.0 -- VOCUS-BACKBONE-AS Vocus Connect 
International Backbone
19 - AS365292496  0.2%1248.0 -- AXXA-RACKCO - Rackco.com
20 - AS29256   24976  1.8%1085.9 -- INT-PDN-STE-AS Syrian 
Telecommunications Establishment


TOP 20 Unstable Prefixes
Rank Prefix Upds % Origin AS -- AS Name
 1 - 151.118.255.0/24  12165  0.8%   AS3909  -- QWEST-AS-3908 - Qwest 
Communications Company, LLC
 2 - 151.118.254.0/24  12165  0.8%   AS3909  -- QWEST-AS-3908 - Qwest 
Communications Company, LLC
 3 - 151.118.18.0/24   12146  0.8%   AS3909  -- QWEST-AS-3908 - Qwest 
Communications Company, LLC
 4 - 209.48.168.0/246551  0.4%   AS2033  -- PANIX - Panix Network 
Information Center
 5 - 202.14.255.0/246313  0.4%   AS24057 -- AIGL-AS-AP PT. AIA FINANCIAL, 
Insurance company, Indonesia
 6 - 41.77.184.0/22 4818  0.3%   AS37430 -- vdctelecom
 7 - 194.63.9.0/24  4477  0.3%   AS1273  -- CW Cable and Wireless Worldwide 
plc
 8 - 69.38.178.0/24 4202  0.3%   AS19406 -- TWRS-MA - Towerstream I, Inc.
 9 - 12.139.133.0/244175  0.3%   AS14680 -- REALE-6 - Auction.com
10 - 58.184.229.0/244150  0.3%   AS9950  -- PUBNETPLUS2-AS-KR DACOM
11 - 80.251.10.0/24 4120  0.3%   AS42705 -- TALIA Talia provides VSAT 
network and hosting services worldwide.
12 - 12.183.21.0/24 4022  0.3%   AS33158 -- DATA-SERVICES-INC - Data 
Services Incorporated
13 - 91.236.24.0/24 3437  0.2%   A

The Cidr Report

[cidr-report]

This report has been generated at Fri Dec 28 21:13:08 2012 AEST.
The report analyses the BGP Routing Table of AS2.0 router
and generates a report on aggregation potential within the table.

Check http://www.cidr-report.org for a current version of this report.

Recent Table History
Date  PrefixesCIDR Agg
21-12-12440351  252593
22-12-12440781  252719
23-12-12440763  252676
24-12-12440659  252626
25-12-12440728  252757
26-12-12440799  252807
27-12-12440865  252753
28-12-12440905  252699


AS Summary
 43060  Number of ASes in routing system
 17939  Number of ASes announcing only one prefix
  3467  Largest number of prefixes announced by an AS
AS7029 : WINDSTREAM - Windstream Communications Inc
  115553760  Largest address span announced by an AS (/32s)
AS4134 : CHINANET-BACKBONE No.31,Jin-rong Street


Aggregation Summary
The algorithm used in this report proposes aggregation only
when there is a precise match using the AS path, so as 
to preserve traffic transit policies. Aggregation is also
proposed across non-advertised address space ('holes').

 --- 28Dec12 ---
ASnumNetsNow NetsAggr  NetGain   % Gain   Description

Table 440989   252735   18825442.7%   All ASes

AS6389  3118  136 298295.6%   BELLSOUTH-NET-BLK -
   BellSouth.net Inc.
AS28573 2263   71 219296.9%   NET Servicos de Comunicao S.A.
AS17974 2485  448 203782.0%   TELKOMNET-AS2-AP PT
   Telekomunikasi Indonesia
AS4766  2946  931 201568.4%   KIXS-AS-KR Korea Telecom
AS7029  3467 1609 185853.6%   WINDSTREAM - Windstream
   Communications Inc
AS22773 1948  183 176590.6%   ASN-CXA-ALL-CCI-22773-RDC -
   Cox Communications Inc.
AS18566 2081  423 165879.7%   COVAD - Covad Communications
   Co.
AS10620 2270  652 161871.3%   Telmex Colombia S.A.
AS7303  1674  397 127776.3%   Telecom Argentina S.A.
AS4323  1602  403 119974.8%   TWTC - tw telecom holdings,
   inc.
AS4755  1657  552 110566.7%   TATACOMM-AS TATA
   Communications formerly VSNL
   is Leading ISP
AS2118  1052   53  99995.0%   RELCOM-AS OOO "NPO Relcom"
AS7552  1147  163  98485.8%   VIETEL-AS-AP Vietel
   Corporation
AS7545  1821  950  87147.8%   TPG-INTERNET-AP TPG Internet
   Pty Ltd
AS8151  1552  700  85254.9%   Uninet S.A. de C.V.
AS18101 1016  170  84683.3%   RELIANCE-COMMUNICATIONS-IN
   Reliance Communications
   Ltd.DAKC MUMBAI
AS1785  1940 1156  78440.4%   AS-PAETEC-NET - PaeTec
   Communications, Inc.
AS4808  1124  352  77268.7%   CHINA169-BJ CNCGROUP IP
   network China169 Beijing
   Province Network
AS13977  852  118  73486.2%   CTELCO - FAIRPOINT
   COMMUNICATIONS, INC.
AS18881  740   35  70595.3%   Global Village Telecom
AS855717   54  66392.5%   CANET-ASN-4 - Bell Aliant
   Regional Communications, Inc.
AS9808   682   32  65095.3%   CMNET-GD Guangdong Mobile
   Communication Co.Ltd.
AS17676  712   92  62087.1%   GIGAINFRA Softbank BB Corp.
AS3356  1116  504  61254.8%   LEVEL3 Level 3 Communications
AS3549  1038  439  59957.7%   GBLX Global Crossing Ltd.
AS22561 1040  443  59757.4%   DIGITAL-TELEPORT - Digital
   Teleport Inc.
AS19262  999  404  59559.6%   VZGNI-TRANSIT - Verizon Online
   LLC
AS24560 1031  444  58756.9%   AIRTELBROADBAND-AS-AP Bharti
   Airtel Ltd., Telemedia
   Services
AS22047  579   22  55796.2%   VTR BANDA ANCHA S.A.
AS4804   633   96  53784.8%   MPX-AS Microplex PTY LTD

Total  45302120323327073.4%   Top 30 

Weekly Routing Table Report

[Routing Analysis Role Account]

This is an automated weekly mailing describing the state of the Internet
Routing Table as seen from APNIC's router in Japan.

The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG,
TRNOG, CaribNOG and the RIPE Routing Working Group.

Daily listings are sent to bgp-st...@lists.apnic.net

For historical data, please see http://thyme.rand.apnic.net.

If you have any comments please contact Philip Smith .

Routing Table Report   04:00 +10GMT Sat 29 Dec, 2012

Report Website: http://thyme.rand.apnic.net
Detailed Analysis:  http://thyme.rand.apnic.net/current/

Analysis Summary


BGP routing table entries examined:  438252
Prefixes after maximum aggregation:  181041
Deaggregation factor:  2.42
Unique aggregates announced to Internet: 215672
Total ASes present in the Internet Routing Table: 42943
Prefixes per ASN: 10.21
Origin-only ASes present in the Internet Routing Table:   33998
Origin ASes announcing only one prefix:   15900
Transit ASes present in the Internet Routing Table:5694
Transit-only ASes present in the Internet Routing Table:137
Average AS path length visible in the Internet Routing Table:   4.5
Max AS path length visible:  31
Max AS path prepend of ASN ( 28730)  25
Prefixes from unregistered ASNs in the Routing Table:   373
Unregistered ASNs in the Routing Table: 132
Number of 32-bit ASNs allocated by the RIRs:   3609
Number of 32-bit ASNs visible in the Routing Table:3251
Prefixes from 32-bit ASNs in the Routing Table:8795
Special use prefixes present in the Routing Table:   15
Prefixes being announced from unallocated address space:173
Number of addresses announced to Internet:   2620507916
Equivalent to 156 /8s, 49 /16s and 199 /24s
Percentage of available address space announced:   70.8
Percentage of allocated address space announced:   70.8
Percentage of available address space allocated:  100.0
Percentage of address space in use by end-sites:   94.1
Total number of prefixes smaller than registry allocations:  154887

APNIC Region Analysis Summary
-

Prefixes being announced by APNIC Region ASes:   105461
Total APNIC prefixes after maximum aggregation:   32809
APNIC Deaggregation factor:3.21
Prefixes being announced from the APNIC address blocks:  106390
Unique aggregates announced from the APNIC address blocks:43557
APNIC Region origin ASes present in the Internet Routing Table:4810
APNIC Prefixes per ASN:   22.12
APNIC Region origin ASes announcing only one prefix:   1248
APNIC Region transit ASes present in the Internet Routing Table:798
Average APNIC Region AS path length visible:4.6
Max APNIC Region AS path length visible: 23
Number of APNIC region 32-bit ASNs visible in the Routing Table:393
Number of APNIC addresses announced to Internet:  716761856
Equivalent to 42 /8s, 184 /16s and 235 /24s
Percentage of available APNIC address space announced: 83.8

APNIC AS Blocks4608-4864, 7467-7722, 9216-10239, 17408-18431
(pre-ERX allocations)  23552-24575, 37888-38911, 45056-46079, 55296-56319,
   58368-59391, 131072-133119
APNIC Address Blocks 1/8,  14/8,  27/8,  36/8,  39/8,  42/8,  43/8,
49/8,  58/8,  59/8,  60/8,  61/8, 101/8, 103/8,
   106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8,
   116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8,
   123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8,
   163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8,
   203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8,
   222/8, 223/8,

ARIN Region Analysis Summary


Prefixes being announced by ARIN Region ASes:155868
Total ARIN prefixes after maximum aggregation:78374
ARIN Deaggregation factor: 1.99
Prefixes being announced from the ARIN address blocks:   156536
Unique aggregates announced from the ARIN address blocks: 70647
ARIN Region origin ASes present in the Internet Routing Table:15348
ARIN Prefixes per ASN:10.20
ARIN Region origin ASes announcing only 

Re: looking glass for Level 3

[N. Max Pierson]

Same here. http://lg.level3.net has been down for over a week for me. I
know someone in operations I can open a ticket with.

On Fri, Dec 28, 2012 at 5:18 AM, Cameron Daniel wrote:

> I've had issues getting to it for a week or so. Their NOC was unresponsive
> when queried.
>
>
> On 2012-12-28 8:23 pm, Peter Ehiwe wrote:
>
>> I normally use the 3rd one you mentioned but they seem to be down at the
>> moment.
>>
>> Rgds Peter,
>> Sent from my Asus  Transformer Pad
>> On Dec 28, 2012 1:51 AM, "Tassos Chatzithomaoglou" <
>> ach...@forthnetgroup.gr>
>> wrote:
>>
>>  Anyone have any looking glass for Level 3?
>>>
>>> The following seem not to be working
>>>
>>> http://www.level3.com/**LookingGlass/
>>> http://lg.level3.net/bgp/bgp.**cgi 
>>> http://lookingglass.level3.**net/ 
>>>
>>> --
>>> Tassos
>>>
>>>
>>>
>>>
>
>

Re: looking glass for Level 3

[Cameron Daniel]

I've had issues getting to it for a week or so. Their NOC was 
unresponsive when queried.


On 2012-12-28 8:23 pm, Peter Ehiwe wrote:
I normally use the 3rd one you mentioned but they seem to be down at 
the

moment.

Rgds Peter,
Sent from my Asus  Transformer Pad
On Dec 28, 2012 1:51 AM, "Tassos Chatzithomaoglou" 


wrote:


Anyone have any looking glass for Level 3?

The following seem not to be working

http://www.level3.com/LookingGlass/
http://lg.level3.net/bgp/bgp.cgi
http://lookingglass.level3.net/

--
Tassos

State of the RING 2012

[Job Snijders]

Hi,

Here is the yearly update regarding the NLNOG RING project, this year's update
includes some links to tools that might be of interest to the broader community.

More information about the RING can be found here: https://ring.nlnog.net/

Kind regards,

Job



 State of the NLNOG RING 2012

A yearly newsletter about the best debugging project ever

Edition 2, 28 Dec 2012


Contents


1. Introduction: growth
2. New services
4. Into the future!
5. Testimonials & conference exposure
6. Closing notes


1. Introduction: growth


Today, 28th of december 2012, the RING turns 2 years old!
The project's origins can be traced back to the following
line on IRC (translated): 

[28 Dec 2010/10:26 CET - #NLNOG]
"hey, maybe we should create a #nlnog test platform"

And now here we are, 2 years later: 188 machines provided by
165 organisations in 39 countries. Compared to 2011 we have
more than doubled in size!

From our usage statistics we gather that 65% of organisations
actively makes use of the RING through SSH. 

Other statistics gathered from our code repositories: 

-  commits were made (doubled since last year!)
- Most code commits happened, again, on Tuesdays
- Lines of code: 20267 insertions(+), 5774 deletions(-)

We could not have sustained this level of growth without the
continuing support of our infrastructure sponsors and the 2012
fundraiser contributors:

XS4ALL, Amazon Web Services, Leaseweb, Atrato IP Networks,
Gossamer Threads, BIT, PCextreme, SoftLayer, Snijders IT,
Solido Hosting, Duocast, A2B Internet, Nedzone, Tetaneutral,
LCHost, Previder, Triple IT and eBay Classifieds Group.

A full overview of all supporters can be found here:

https://ring.nlnog.net/patrons/


2. New services


AMP (Active Measurement Project):
-

One of the biggest changes this year was moving from a
distributed master/slave smokeping setup to something
much better: AMP. The AMP software performs measurements
from every RING node to every other RING node, and reports
the results to central collectors which in turn feed a
web interface. 

AMP as a tool offers us insight in end-to-end MTU, jitter,
latency, packetloss and historic traceroutes both for
IPv4 and IPv6 between all RING nodes. 

URL: http://amp.ring.nlnog.net/

BGP Looking glass:
--

Due to popular request we set up a BGP looking glass,
which currently receives full IPv4 and IPv6 tables from
35+ participants. The LG uses the BIRD BGP daemon with a
web interface written by one of the RING participants!

We currently are exploring if we can use the collected data
for a monitoring and alerting system to help participants
gain insight in prefix visibility and, for instance hijack
events. Stay tuned!

URL: http://lg.ring.nlnog.net/

IRR/RPLS services:
--

Although the IRR system and RPSL have been around for a
long time, there still is a lot of room for improvement
in terms of performance, ease of use and standardised
methods and tools. 

We believe that the RING community can make a difference
in the popularity of proper filtering. One of the first
things we offer (in beta) is a web service to expand
RPSL object such as AS-SET, AUTNUM and RS-SETs and expose
the data in JSON. 

URL: http://irr.ring.nlnog.net/


3. Into the future!


In 2013 we will continue to automate as many aspects of the RING
as possible. But more importantly, the RING has to become the
best swiss army knife a network engineer can imagine so we will
focus on usability, more advanced tools and security.

We are making a lot of progress towards publication of all kinds
of RING related information in an easy accessible database, we
imagine this will accelerate the development of a new generation
of tools!

We also started talks with other debugging projects such as
RIPE Atlas to explore if cooperation and exchange of information
can further such projects.

As the RING is a community effort, we can only become more
valuable to our members by help from the community. We need you
for new creative ideas, high quality code, and of course more
RING nodes. If you can help out in our efforts, don't hesitate
to contact us!


4. Testimonials & Exposure

Re: looking glass for Level 3

[John Kemp]

Session is up on telnet:route-views.routeviews.org
username rviews

John Kemp (k...@routeviews.org)

On 12/28/2012 2:23 AM, Peter Ehiwe wrote:
> I normally use the 3rd one you mentioned but they seem to be down at the
> moment.
>
> Rgds Peter,
> Sent from my Asus  Transformer Pad
> On Dec 28, 2012 1:51 AM, "Tassos Chatzithomaoglou" 
> wrote:
>
>> Anyone have any looking glass for Level 3?
>>
>> The following seem not to be working
>>
>> http://www.level3.com/LookingGlass/
>> http://lg.level3.net/bgp/bgp.cgi
>> http://lookingglass.level3.net/
>>
>> --
>> Tassos
>>
>>
>>

Re: looking glass for Level 3

[Peter Ehiwe]

I normally use the 3rd one you mentioned but they seem to be down at the
moment.

Rgds Peter,
Sent from my Asus  Transformer Pad
On Dec 28, 2012 1:51 AM, "Tassos Chatzithomaoglou" 
wrote:

> Anyone have any looking glass for Level 3?
>
> The following seem not to be working
>
> http://www.level3.com/LookingGlass/
> http://lg.level3.net/bgp/bgp.cgi
> http://lookingglass.level3.net/
>
> --
> Tassos
>
>
>

Level3/GC: IMMEDIATE: Trace request on TCP SYN attack traffic towards 217.149.58.35

[Kauto Huopio]

Greetings,

(my work hat @ CERT-FI on, work email kauto.huo...@ficora.fi)

Several Finnish media sites (www.yle.fi, www.mtv3.fi, www.hs.fi etc)
have been attacked since Dec 25th.

Current target is www.ampparit.com (217.149.58.35).  ISP reports
traffic originating from Level3 transit. Traffic is > 2 Mpps TCP SYN.

I'd like to request immediate trace support - we suspect this is a
very small source
footprint DOS. All observations to c...@ficora.fi, cc: to me at work
address above.

-- 
Kauto Huopio - ka...@huopio.fi