- routing-wg - mailman.ripe.net

Re: [routing-wg] 2019-08 Review Phase (RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space)
by JORDI PALET MARTINEZ 04 Mar '20

04 Mar '20

Hi Job, I don't think I'm the one that should calculate that. However, if we have an alternative proposal with the SLURM file, it can be calculated (approximately) as part of the analysis impact that will be needed as well, right? May be anyone from the community that already has done that job and integrated the SLURM in their routers, can provide an estimate cost, and then multiply it for the number of all the RIRs members? I believe (I may be wrong) that the AS0 is much cheaper to implement by RIPE NCC even if it is several thousand euros, than the number of worldwide folks that will need to use the SLURM in addition to RPKI (for non-AS0). Regards, Jordi @jordipalet El 3/3/20 19:23, "Job Snijders" <job(a)sobornost.net> escribió: Hi Jordi, On Tue, Mar 3, 2020, at 19:20, JORDI PALET MARTINEZ via routing-wg wrote: > I understand that, but I think it may be easy to get an idea, not exact cost. > > The reason why this is needed is because one of the arguments against > this proposal is about the cost. > > This can't be judged as a valid objection for reaching consensus if we > don't have that cost (approximate). Can you provide us with an estimate of the cost to the collective community if this proposal is *not* implemented as RPKI ROAs but just as SLURM file instead? Kind regards, Job ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

8 20

2019-08 Review Phase (RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space)
by Petrit Hasani 03 Mar '20

03 Mar '20

Dear colleagues, Policy proposal 2019-08, "RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space", is now in the Review Phase. The goal of the proposal is to ask the RIPE NCC to create ROAs with origin AS0 for all unallocated and unassigned address space under its control. The proposal has been updated following the last round of discussion. Version 2 of the proposal includes a specification for the RIPE NCC to create all AS0 ROAs under a specific Trust Anchor. The RIPE NCC has prepared an impact analysis on this latest proposal version to support the community’s discussion. You can find the proposal and impact analysis at: https://www.ripe.net/participate/policies/proposals/2019-08 https://www.ripe.net/participate/policies/proposals/2019-08#impact-analysis And the draft documents at: https://www.ripe.net/participate/policies/proposals/2019-08/draft As per the RIPE Policy Development Process (PDP), the purpose of this four week Review Phase is to continue discussion of the proposal, taking the impact analysis into consideration, and to review the full draft RIPE Policy Document. At the end of the Review Phase, the Working Group (WG) Chairs will determine whether the WG has reached rough consensus. It is therefore important to provide your opinion, even if it is simply a restatement of your input from the previous phase. We encourage you to read the proposal, impact analysis and draft document and send any comments to <routing-wg(a)ripe.net> before 20 March 2020. Kind regards, -- Petrit Hasani Policy Officer RIPE NCC

16 32

RPKI Outage Post-Mortem
by Nathalie Trenaman 02 Mar '20

02 Mar '20

Dear colleagues, From Saturday 22 February at 08:24 (CET), any newly created, modified, or deleted ROAs (176 in total) could not be added to our publication server due to a disk problem. From that moment on, all the data was stored on the database, but the publication did not happen. The disk did not report any problems and, therefore, no engineer was alerted of this incident. Due to the disk problem, starting from Sunday 23 February at 09:10 (CET), our CRL expired and our repository could not be properly updated. This was reported to us on Monday 24 February at 11:44 (CET). Immediately, our engineers fixed the disk problem, however, since the CRL expired, all underlying objects also expired. Depending on the Relying Party software an operator used, this abnormal behaviour appeared differently. Initially, our engineers tried to do a full re-population of the RPKI repository, but unfortunately, this did not update the CRL in the validation tree. At 15:03 (CET), we performed a full CA key-roll, which was completed at 21:02 (CET) and resolved the problem. At 19:58 (CET), all objects in the backlog were published. We apologise for any inconvenience this may have caused and we are taking all the necessary steps to ensure this incident does not appear again in the future. Kind regards, Nathalie Trenaman Routing Security Programme Manager RIPE NCC

6 10

Looking for recommendations
by Nathalie Trenaman 17 Feb '20

17 Feb '20

Dear colleagues, As presented at the last Routing WG meeting at RIPE 79, the RIPE NCC is planning on carrying out an extensive technical and procedural audit on RPKI throughout this year. We are currently looking for an organisation that can help us with this exercise. Particularly, we are looking for an organisation that is familiar with the RPKI audit frameworks and ,ideally, has extensive knowledge on BGP routing and cryptography. We are planning on starting the consultation in two weeks and are looking forward to your recommendations. Kind regards, Nathalie Trenaman Routing Security Programme Manager RIPE NCC

1 0

Re: [routing-wg] routing-wg Digest, Vol 102, Issue 3
by Tony Barber 10 Feb '20

10 Feb '20

An agreed community value to signify test invalid prefixes would help. Maybe a ripe doc (399 or 706) could be updated? Maybe a discussion point for next meeting. Tony > On 10 Feb 2020, at 11:00, routing-wg-request(a)ripe.net wrote: > > Send routing-wg mailing list submissions to > routing-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/routing-wg > or, via email, send a message with subject or body 'help' to > routing-wg-request(a)ripe.net > > You can reach the person managing the list at > routing-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of routing-wg digest..." > > > Today's Topics: > > 1. RPKI: Forthnet drops invalids (Tassos Chatzithomaoglou) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 10 Feb 2020 12:25:08 +0200 > From: Tassos Chatzithomaoglou <achatz(a)forthnet.gr> > To: RIPE Routing Working Group <routing-wg(a)ripe.net> > Subject: [routing-wg] RPKI: Forthnet drops invalids > Message-ID: <ddadc504-6f58-dd44-09ba-49afcd2072fd(a)forthnet.gr> > Content-Type: text/plain; charset="utf-8" > > Hi to everyone, > > I would like to inform you that it's been almost one month since > Forthnet started dropping invalid prefixes on all peering/transit links, > either national or international. It's important to note that during > this month we haven't received any complaints. > > Having monitored the invalid prefixes for more than a year and > experimenting with routing them across different links, we decided that > it was time to move to the next phase and start dropping prefixes that > are declared as invalid in the RPKI ecosystem. > > Two were the main reasons that helped us take the drop decision: a) > during the last year our volume of invalid prefixes traffic decreased > from ~1% of total traffic to less than 0,2%, b) we updated our prefix > validation policy by including a whitelist (until we evaluate SLURM) in > order to bypass issues quickly if/when they arise. > > Note #1: in the context of the above actions we have noticed that > invalid prefixes used for testing purposes have recently begun to grow > (each large provider creates one?). This may lead to incorrect > conclusions in the future (at least in terms of prefixes, since i don't > expect traffic from those). Maybe these invalid prefixes should have > some extra "attributes" in order to be recognized more easily while > troubleshooting. > > Note #2: In order to increase adoption of a similar policy, maybe MANRS > should be updated to promote dropping invalids. If i'm not mistaken, > their current action is about creating ROAs only. > > -- > Tassos > >

4 3

RPKI: Forthnet drops invalids
by Tassos Chatzithomaoglou 10 Feb '20

10 Feb '20

Hi to everyone, I would like to inform you that it's been almost one month since Forthnet started dropping invalid prefixes on all peering/transit links, either national or international. It's important to note that during this month we haven't received any complaints. Having monitored the invalid prefixes for more than a year and experimenting with routing them across different links, we decided that it was time to move to the next phase and start dropping prefixes that are declared as invalid in the RPKI ecosystem. Two were the main reasons that helped us take the drop decision: a) during the last year our volume of invalid prefixes traffic decreased from ~1% of total traffic to less than 0,2%, b) we updated our prefix validation policy by including a whitelist (until we evaluate SLURM) in order to bypass issues quickly if/when they arise. Note #1: in the context of the above actions we have noticed that invalid prefixes used for testing purposes have recently begun to grow (each large provider creates one?). This may lead to incorrect conclusions in the future (at least in terms of prefixes, since i don't expect traffic from those). Maybe these invalid prefixes should have some extra "attributes" in order to be recognized more easily while troubleshooting. Note #2: In order to increase adoption of a similar policy, maybe MANRS should be updated to promote dropping invalids. If i'm not mistaken, their current action is about creating ROAs only. -- Tassos

2 2

Weekly Routing Table Report
by cscora＠apnic.net 07 Feb '20

07 Feb '20

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 08 Feb, 2020 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 794073 Prefixes after maximum aggregation (per Origin AS): 302321 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 388517 Total ASes present in the Internet Routing Table: 66960 Prefixes per ASN: 11.86 Origin-only ASes present in the Internet Routing Table: 57545 Origin ASes announcing only one prefix: 24189 Transit ASes present in the Internet Routing Table: 9415 Transit-only ASes present in the Internet Routing Table: 284 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 34 Max AS path prepend of ASN ( 16327) 25 Prefixes from unregistered ASNs in the Routing Table: 1271 Number of instances of unregistered ASNs: 1276 Number of 32-bit ASNs allocated by the RIRs: 30466 Number of 32-bit ASNs visible in the Routing Table: 25070 Prefixes from 32-bit ASNs in the Routing Table: 114954 Number of bogon 32-bit ASNs visible in the Routing Table: 25 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 1135 Number of addresses announced to Internet: 2853015424 Equivalent to 170 /8s, 13 /16s and 143 /24s Percentage of available address space announced: 77.1 Percentage of allocated address space announced: 77.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.4 Total number of prefixes smaller than registry allocations: 266654 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 210581 Total APNIC prefixes after maximum aggregation: 61335 APNIC Deaggregation factor: 3.43 Prefixes being announced from the APNIC address blocks: 203953 Unique aggregates announced from the APNIC address blocks: 84920 APNIC Region origin ASes present in the Internet Routing Table: 10336 APNIC Prefixes per ASN: 19.73 APNIC Region origin ASes announcing only one prefix: 2851 APNIC Region transit ASes present in the Internet Routing Table: 1544 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 26 Number of APNIC region 32-bit ASNs visible in the Routing Table: 5389 Number of APNIC addresses announced to Internet: 768260864 Equivalent to 45 /8s, 202 /16s and 187 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-141625 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 233275 Total ARIN prefixes after maximum aggregation: 107407 ARIN Deaggregation factor: 2.17 Prefixes being announced from the ARIN address blocks: 231228 Unique aggregates announced from the ARIN address blocks: 116855 ARIN Region origin ASes present in the Internet Routing Table: 18391 ARIN Prefixes per ASN: 12.57 ARIN Region origin ASes announcing only one prefix: 6756 ARIN Region transit ASes present in the Internet Routing Table: 1900 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3161 Number of ARIN addresses announced to Internet: 1078447104 Equivalent to 64 /8s, 71 /16s and 204 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 224258 Total RIPE prefixes after maximum aggregation: 104482 RIPE Deaggregation factor: 2.15 Prefixes being announced from the RIPE address blocks: 221082 Unique aggregates announced from the RIPE address blocks: 130501 RIPE Region origin ASes present in the Internet Routing Table: 26801 RIPE Prefixes per ASN: 8.25 RIPE Region origin ASes announcing only one prefix: 11706 RIPE Region transit ASes present in the Internet Routing Table: 3789 Average RIPE Region AS path length visible: 4.5 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 8898 Number of RIPE addresses announced to Internet: 723789952 Equivalent to 43 /8s, 36 /16s and 40 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 103390 Total LACNIC prefixes after maximum aggregation: 23822 LACNIC Deaggregation factor: 4.34 Prefixes being announced from the LACNIC address blocks: 104554 Unique aggregates announced from the LACNIC address blocks: 45410 LACNIC Region origin ASes present in the Internet Routing Table: 9401 LACNIC Prefixes per ASN: 11.12 LACNIC Region origin ASes announcing only one prefix: 2394 LACNIC Region transit ASes present in the Internet Routing Table: 1774 Average LACNIC Region AS path length visible: 5.3 Max LACNIC Region AS path length visible: 31 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 6973 Number of LACNIC addresses announced to Internet: 174266624 Equivalent to 10 /8s, 99 /16s and 25 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 21297 Total AfriNIC prefixes after maximum aggregation: 4473 AfriNIC Deaggregation factor: 4.76 Prefixes being announced from the AfriNIC address blocks: 32121 Unique aggregates announced from the AfriNIC address blocks: 9828 AfriNIC Region origin ASes present in the Internet Routing Table: 1360 AfriNIC Prefixes per ASN: 23.62 AfriNIC Region origin ASes announcing only one prefix: 482 AfriNIC Region transit ASes present in the Internet Routing Table: 265 Average AfriNIC Region AS path length visible: 5.0 Max AfriNIC Region AS path length visible: 23 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 649 Number of AfriNIC addresses announced to Internet: 107504384 Equivalent to 6 /8s, 104 /16s and 99 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 5270 655 608 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4622 4192 73 ERX-CERNET-BKB China Education and Rese 7552 3320 1331 24 VIETEL-AS-AP Viettel Group, VN 45899 3125 1790 109 VNPT-AS-VN VNPT Corp, VN 7713 2700 815 493 TELKOMNET-AS-AP PT Telekomunikasi Indon 9808 2613 9043 62 CMNET-GD Guangdong Mobile Communication 4766 2252 11101 562 KIXS-AS-KR Korea Telecom, KR 9498 2230 433 215 BBIL-AP BHARTI Airtel Ltd., IN 4755 2136 441 194 TATACOMM-AS TATA Communications formerl 9394 2092 4898 24 CTTNET China TieTong Telecommunications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7155 4047 280 27 VIASAT-SP-BACKBONE, US 11492 3928 260 647 CABLEONE, US 16509 3812 7748 1683 AMAZON-02, US 22773 3523 2971 151 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3367 1324 94 SHAW, CA 16625 2966 1555 2130 AKAMAI-AS, US 209 2344 5075 531 CENTURYLINK-US-LEGACY-QWEST, US 30036 2297 359 94 MEDIACOM-ENTERPRISE-BUSINESS, US 20115 2139 2784 519 CHARTER-20115, US 18566 2057 405 103 MEGAPATH5-, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5876 1623 131 UNI2-AS, ES 39891 3776 203 20 ALJAWWALSTC-AS, SA 31334 3436 484 13 KABELDEUTSCHLAND-AS, DE 8551 3086 379 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2834 452 1955 AKAMAI-ASN1, US 12389 2418 2244 700 ROSTELECOM-AS, RU 34984 2067 348 557 TELLCOM-AS, TR 9009 2043 213 1089 M247, GB 9121 1919 1691 18 TTNET, TR 13188 1604 100 47 TRIOLAN, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6210 3295 599 Uninet S.A. de C.V., MX 10620 3360 534 464 Telmex Colombia S.A., CO 11830 2682 369 63 Instituto Costarricense de Electricidad 6503 1669 323 392 Axtel, S.A.B. de C.V., MX 7303 1485 1030 267 Telecom Argentina S.A., AR 28573 1279 2223 224 CLARO S.A., BR 13999 1194 506 290 Mega Cable, S.A. de C.V., MX 3816 1122 562 135 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1109 379 39 Telefonica del Peru S.A.A., PE 11172 954 112 69 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1097 566 24 RAYA-AS, EG 24863 1092 393 22 LINKdotNET-AS, EG 36992 1040 1535 73 ETISALAT-MISR, EG 36903 876 452 97 MT-MPLS, MA 6713 606 1863 34 IAM-AS, MA 29571 559 68 12 ORANGE-COTE-IVOIRE, CI 37342 474 32 1 MOVITEL, MZ 36935 383 522 40 Vodafone-, EG 23889 370 231 15 MauritiusTelecom, MU 15399 362 45 10 WANANCHI-, KE Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6210 3295 599 Uninet S.A. de C.V., MX 12479 5876 1623 131 UNI2-AS, ES 7545 5270 655 608 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4622 4192 73 ERX-CERNET-BKB China Education and Rese 7155 4047 280 27 VIASAT-SP-BACKBONE, US 11492 3928 260 647 CABLEONE, US 16509 3812 7748 1683 AMAZON-02, US 39891 3776 203 20 ALJAWWALSTC-AS, SA 22773 3523 2971 151 ASN-CXA-ALL-CCI-22773-RDC, US 31334 3436 484 13 KABELDEUTSCHLAND-AS, DE Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 5876 5745 UNI2-AS, ES 7545 5270 4662 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4622 4549 ERX-CERNET-BKB China Education and Research Net 7155 4047 4020 VIASAT-SP-BACKBONE, US 39891 3776 3756 ALJAWWALSTC-AS, SA 31334 3436 3423 KABELDEUTSCHLAND-AS, DE 22773 3523 3372 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3320 3296 VIETEL-AS-AP Viettel Group, VN 11492 3928 3281 CABLEONE, US 6327 3367 3273 SHAW, CA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 17076 UNALLOCATED 8.12.244.0/24 3356 LEVEL3, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 174 COGENT-174, US 62485 UNALLOCATED 8.23.229.0/24 3356 LEVEL3, US 32985 UNALLOCATED 8.28.31.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 27205 UNALLOCATED 8.38.16.0/21 6461 ZAYO-6461, US 27205 UNALLOCATED 8.38.16.0/22 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 27205 UNALLOCATED 8.38.20.0/22 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 14109 UNALLOCATED 8.38.252.0/24 3356 LEVEL3, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.136.224.0/24 Origin: 15206 UNASSIGNED Transit: 174 COGENT-174, US 23.137.192.0/24 Origin: 31798 CANAD-86-31798, CA Transit: 174 COGENT-174, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:10 /9:11 /10:38 /11:98 /12:286 /13:579 /14:1157 /15:1916 /16:13397 /17:8170 /18:13861 /19:25777 /20:40506 /21:47565 /22:98322 /23:80905 /24:460141 /25:1334 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4847 5876 UNI2-AS, ES 31334 3281 3436 KABELDEUTSCHLAND-AS, DE 6327 3154 3367 SHAW, CA 7155 3139 4047 VIASAT-SP-BACKBONE, US 11492 3064 3928 CABLEONE, US 39891 2946 3776 ALJAWWALSTC-AS, SA 22773 2740 3523 ASN-CXA-ALL-CCI-22773-RDC, US 8551 2546 3086 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 30036 2046 2297 MEDIACOM-ENTERPRISE-BUSINESS, US 11830 2030 2682 Instituto Costarricense de Electricidad y Telec Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1499 2:1144 3:30 4:19 5:3257 6:48 8:1377 9:1 12:1786 13:481 14:2230 15:75 16:9 17:285 18:79 20:58 23:3291 24:2642 25:4 27:2492 31:2867 32:101 35:40 36:930 37:3230 38:1838 39:315 40:132 41:3253 42:872 43:2128 44:191 45:13153 46:3649 47:275 49:1400 50:1568 51:87 52:1112 54:272 55:680 56:6 57:48 58:1886 59:1119 60:683 61:2210 62:2158 63:1946 64:5065 65:2318 66:4845 67:2849 68:1233 69:3819 70:1433 71:671 72:2772 74:2626 75:1439 76:674 77:2547 78:1976 79:2356 80:1855 81:1578 82:1176 83:1123 84:1234 85:2492 86:554 87:1713 88:1080 89:2713 90:310 91:7546 92:1474 93:2435 94:2596 95:3713 96:1014 97:337 98:964 99:966 100:86 101:1092 102:803 103:23095 104:3600 105:402 106:824 107:1903 108:708 109:3615 110:1772 111:1938 112:1561 113:1389 114:1490 115:1842 116:1794 117:2039 118:2125 119:1716 120:840 121:1034 122:2353 123:1888 124:1551 125:2023 128:1387 129:913 130:610 131:1814 132:784 133:300 134:1223 135:275 136:599 137:884 138:2165 139:985 140:594 141:880 142:870 143:1163 144:945 145:292 146:1477 147:1003 148:2061 149:1108 150:809 151:1277 152:1478 153:371 154:4695 155:900 156:3278 157:1075 158:727 159:1939 160:1729 161:1012 162:3017 163:772 164:1409 165:1231 166:542 167:1472 168:3516 169:495 170:4244 171:743 172:1863 173:2364 174:1033 175:1011 176:2607 177:4148 178:2902 179:1490 180:2183 181:2366 182:2838 183:1120 184:2393 185:16040 186:3789 187:2552 188:3642 189:2086 190:8206 191:1502 192:10245 193:7315 194:5995 195:4288 196:3279 197:1869 198:6117 199:5930 200:7136 201:5121 202:10420 203:10238 204:4550 205:3067 206:3253 207:3270 208:4004 209:4371 210:4005 211:1989 212:3240 213:3017 214:1164 215:53 216:5925 217:2341 218:893 219:605 220:1980 221:919 222:1002 223:1407 End of report

1 0

new tool: rpki-ov-checker
by Job Snijders 06 Feb '20

06 Feb '20

I wrote a simple tool to figure out what kind of invalid a rpki invalid is, this can aid people in understanding the impact of "invalid == reject" routing policies. Only "invalid_unreachable" routes present an operational issue in my opinion, IP addresses covered by "notfound" or "valid" less specific routes will still be reachable. You pass it a file name (or via stdin) with one prefix and origin ASN per line (white space separated) representing your full BGP RIB, and then you can grep specific for the task at hand to extract the info you need: $ rpki-ov-checker full_rib | fgrep -f customer_prefixes | grep invalid | sort -R | head invalid_covered_by_notfound 123.101.0.0/21 4809 covering route: 123.101.0.0/16 4134 invalid_covered_by_valid 46.3.74.0/24 134121 covering route: 46.3.0.0/16 207636 invalid_unreachable 83.231.209.0/24 3949 invalid_unreachable 124.30.247.0/24 9583 invalid_covered_by_valid 125.21.232.0/24 9730 covering route: 125.21.0.0/16 9498 invalid_unreachable 120.29.92.0/24 17639 invalid_unreachable 31.40.164.0/24 200872 invalid_covered_by_notfound 45.12.139.0/24 40676 covering route: 45.12.136.0/22 35913 invalid_covered_by_valid 122.160.178.0/24 24560 covering route: 122.160.0.0/16 24560 invalid_covered_by_valid 61.90.251.0/24 21734 covering route: 61.90.192.0/18 7470 NTT is using this to figure out who we need to help fix their ROA or correct their BGP announcements. Get the goods at https://github.com/job/rpki-ov-checker Enjoy! Kind regards, Job

2 2

The Great AFRINIC Heist -- The Enablers
by Ronald F. Guilmette 30 Jan '20

30 Jan '20

As the primary investigator pursuing this case, I have invested more than a little effort into continuing to track what has been going on as AFRINIC attempts to remediate the effects of these thefts. I would like now to provide you all with some insight into the current situation and status relating to the affected stolen AFRINIC blocks and the multiple parties in your own region who are continuing, at present, to provide routing to the various bits and pieces of the stolen AFRINIC IPv4 space. My hope, of course, is that you will all join with me in trying to persuade these networks to cease all routing to all of the stolen AFRINIC address space. A full list of all of the stolen AFRINIC blocks that are still of ongoing concern at the present moment is available here: https://pastebin.com/raw/71zNNriB Note that many of the blocks listed at the link above have already been "reclaimed" as far as the AFRINIC WHOIS records are concerned. But because routing remains almost entirely decoupled from RIR WHOIS data bases, much of this "reclaimed" space is still being routed as I write this. The only difference is that now the space is being routed as bogons, rather than as "legitimately" allocated space. A summary of all of the current routing for all of the stolen AFRINIC IPv4 address space that is still of concern (including routing for recently reclaimed address space that AFRINIC will eventually be returning to its free pool) is provided below. This list is sorted by the number of constituent stolen /24 blocks being routed by each listed network, thus showing the most major offenders at the top. A few footnotes concerning specific ASNs in this list follow below the listing. I urge everyone on this mailing list to share this data as widely as possible in and among the global networking community. In all cases noted below, the networks in question are unambiguously routing IP blocks that were obtained, in the first instance, via thefts perpetrated by one or more AFRINIC insiders and then resold on the black market in secretive deals. In many and perhaps most cases listed below, the relevant networks appear to have been more than happy to accept some cash in exchange for their services, while not looking all that carefully at the purported (but fradulent) "LOA" documents that they were given in order to persuade them to announce routes to stolen IP space. (Repeated use of blatantly fradulent documents has been one of the consistant features of this entire ongoing criminal enterprise.) I would also like to request the assistance of every person on this mailing list in the task of informing all of the networks that are mentioned in the list below, and that are within your own geographic region, that they are each currently announcing routes to stolen IP space. Of course, it is my hope that you will also encourage them, in no uncertain terms, to stop doing this immediately, if not sooner. As you can see below, this Internet crime spree is a globe-spanning and ongoing disaster. There is no way that I can get all of this mess cleaned up on my own. I am therefore relying on all people of honesty and good will, in all regions, to assist me in getting the word to the networks mentioned below, and telling them, very directly, that they are each facilitating a colossal fraud that affects the whole of the global Internet community. (I know for a fact that there is ongoing criminal activity which is being perpetrated from at least some of this provably stolen IP address space, so it is in the self interest of every honest netizen to get this all turned off and shut down.) All routing data is derived from current data published by RIPEstat. ====================================================================== 3719 0 ?? UNROUTED IP SPACE 629 132165 PK Connect Communication 512 18013 HK Asline Limited 504 19969 US Joe's Datacenter, LLC 500 62355 CO Network Dedicated SAS 423 202425 SC IP Volume inc 286 58895 PK Ebone Network (PVT.) Limited 250 136525 PK Wancom (Pvt) Ltd. 192 18530 US Isomedia, Inc. 186 9009 GB M247 Ltd 134 262287 BR Maxihost LTDA 132 204655 NL Novogara LTD 79 132116 IN Ani Network Pvt Ltd 75 136384 PK Optix Pakistan (Pvt.) Limited 68 132422 HK Hong Kong Business Telecom Limited 60 137443 HK Anchnet Asia Limited 48 63956 AU Colocation Australia Pty Ltd 26 132335 IN LeapSwitch Networks Pvt Ltd 21 131284 AF Etisalat Afghan 20 139043 PK WellNetworks (Private) Limited 19 43092 JP OSOA Corporation., LTD 17 36351 US SoftLayer Technologies Inc. 16 56611 NL REBA Communications BV 16 199267 IL Netstyle A. Ltd 16 23679 ID Media Antar Nusa PT. 14 137085 IN Nixi 10 63018 US Dedicated.com 9 136782 JP Pingtan Hotline Co., Limited 8 45671 AU Servers Australia Pty. Ltd 8 57717 NL FiberXpress BV 7 49335 RU LLC "Server v arendy" 7 134451 SG NewMedia Express Pte Ltd 6 49367 IT Seflow S.N.C. Di Marco Brame' & C. 6 26754 ?? {{unknown organization}} 5 198504 AE Star Satellite Communications Company - PJSC 5 198381 AE Star Satellite Communications Company - PJSC 4 38001 SG NewMedia Express Pte Ltd 4 263812 AR TL Group SRL ( IPXON Networks ) 4 30827 GB Extraordinary Managed Services Ltd 4 42831 GB UK Dedicated Servers Limited 4 37200 NG SimbaNET Nigeria Limited 4 133495 PK Vision telecom Private limited 4 198394 AE Star Satellite Communications Company - PJSC 2 44066 DE First Colo GmbH 2 198247 AE Star Satellite Communications Company - PJSC 2 133933 PK NetSat Private Limited 2 328096 UG truIT Uganda Limited 2 38713 PK Satcomm (Pvt.) Ltd. 2 31122 IE Digiweb ltd 2 46562 US Total Server Solutions L.L.C. 2 13737 US Riverfront Internet Systems LLC 2 11990 US Unlimited Net, LLC 2 20860 GB Iomart Cloud Services Limited 2 45382 KR Ehostict 2 17216 US Dc74 Llc 2 16637 ZA Mtn Sa 2 53999 CA Priority Colo Inc 1 23470 US ReliableSite.Net LLC 1 35074 NG Cobranet Limited 1 19832 ZA Link Data Group 1 43945 IL Netstyle A. Ltd 1 134917 IN Ragsaa Communication pvt. ltd. 1 203833 DE First Colo GmbH ====================================================================== The actual current route announcements corresponding to all of the above are listed in the table given here, which is sorted by ASN: https://pastebin.com/raw/XQyJ8EK2 Footnotes: [1] AS62355 gives all indications of being a false front fradulent network, possibly one that was set up by one or more of the black market dealers involved in this case. There is no actual web site associated with its contact domain (networkdedicated.com) at present, the alleged contact phone number in the associated AS WHOIS record was non-working when I tried it, and the street address given for this entity in Bogotá, Columbia, is one that Google maps cannot locate. Traceroutes to the one and only IPv4 block that is being routed by this AS and that is actually registed to the company itself (185.39.8.0/22 -- issued by RIPE NCC) do not terminate in Columbia, South America, as one would expect based on the WHOIS, but rather such traceroutes dead-end somwhere on the network of core-backbone.com (Core-Backbone GmbH, Germany) in the general vicinity of Amsterdam, Netherlands. Please note also that AS62355 appears to be a "leaf" ASN which is connected to the Internet only via AS202425, IP Volume, Ltd. -- Seyhelles. (See below.) https://bgp.he.net/AS62355 [2] The networks of AS202425 (IP volume, Inc. - Seychelles), AS204655 (Novogara, Ltd. - Netherlands), AS56611 (REBA Communications BV - Netherlands), and AS57717 (FiberXpress BV - Netherlands), are all believed by me to be onwed and controled by a certain pair of Dutch gentlemen named Mr. Ferdinand Reinier Van Eeden and Mr. Bartholomeus Johannes ("Bap") Karreman, both of whom I have previously posted about to the NANOG mailing list. For more information on these characters, please google for "Ecatel" and/or "Quasi Networks". Both of those are, I believe, demonstratably the predecessors of what is nowadays being called "IP volume, Inc." [3] AS199267 (Netstyle A. Ltd. - Israel) and AS43945 (Netstyle A. Ltd. - Israel) belongs to the Israeli gentleman featured in Jan Vermeulen's detailed December 4th report on this whole AFRINIC caper. This is the specific fellow who has been going around passing out fradulent LOAs of such shockingly low quality that one wonders why he even bothers. (But I guess they work well enough in the case of many cash-starved networks hungry fo new customers.) [4] AS26754 was formerly an AFRINIC-assigned ASN which was assigned to the entirely fictitious business entity called "ITC'. That entity appears to have just been an imaginary concoction of Mr. Ernest Byaruhanga, formerly a senior employee of AFRINIC (and now the target of an ongoing crimininal investigation) and/or other AFRINIC insiders who worked with or along side Mr. Byaruhanga to criminally strip assets from AFRINIC and its legacy block holders. The registration for this AS number has now been withdrawn by AFRINIC, thus rendering the ASN itself a bogon. [5] AS19832 ("Link Data Group") is yet another fiction that was manufactured out of (nearly) whole cloth, either by Mr. Byaruhanga and/or by other AFRINIC insiders who were working with him. It is not immediately clear why this ASN is still registered, let alone why its route announcements are still being accepted or propagated anywhere.

1 0

ORG-DTL20-RIPE
by Ronald F. Guilmette 29 Jan '20

29 Jan '20

46.3.0.0/16 46.232.0.0/17 80.243.128.0/20 149.126.192.0/18 https://bgp.he.net/AS55933#_prefixes https://bgp.he.net/AS207636#_prefixes

1 0