apops January 2005

apops@apops.net

7 participants
17 discussions

by Randy Bush

the verisign gang gave a good presentation of "Life and Times of J-Root" at the recent nanog meeting' see <http://www.nanog.org/mtg-0410/pdf/kosters.pdf>. on foils 27 to 29, they reported non-trivial routing jitter and therefore suggested "DO NOT RUN anycast with stateful transport." on the other hand, for almost a decade, there have been reports of successfully delivery of stateful services over anycast. so one wonders if their measurement was from an abnormal vantage point, or if there are other interesting things going on. as we are curious and inclined to test conjectures by experiment, scientific method and all that, we devised a small experiment in which we would very much appreciate your participation. we wish to collect data on the stability of which actual anycast root server(s) you contact from many points on or near the net's edges, i.e.. your home, datacenter, .... to do this, peter boothe, of university of oregon, has written a script which queries those roots which are known to be widely anycast every few seconds using dig [options] @<foo>.root-servers.net. hostname.bind chaos txt to record which actual unicast-named server was reached. these probes are recorded in a file that looks like, for example 42.666.7.11 Sat Nov 13 01:29:29 UTC 2004 f UDP pao1e.f.root-servers.org Sat Nov 13 01:29:29 UTC 2004 i UDP s1.lnx Sat Nov 13 01:29:30 UTC 2004 j UDP jns4-kgtld.j.root-servers.net Sat Nov 13 01:29:30 UTC 2004 k UDP k1.linx Sat Nov 13 01:29:30 UTC 2004 m UDP M-d3 Sat Nov 13 01:29:30 UTC 2004 c TCP lax1a.c.root-servers.org Sat Nov 13 01:29:31 UTC 2004 f TCP pao1c.f.root-servers.org Sat Nov 13 01:29:31 UTC 2004 i TCP s1.lnx Sat Nov 13 01:29:31 UTC 2004 j TCP jns1-kgtld.j.root-servers.net Sat Nov 13 01:29:32 UTC 2004 k TCP k1.linx Sat Nov 13 01:29:33 UTC 2004 m TCP M-d3 Sat Nov 13 01:29:35 UTC 2004 c UDP lax1a.c.root-servers.org Sat Nov 13 01:29:35 UTC 2004 f UDP pao1e.f.root-servers.org Sat Nov 13 01:29:35 UTC 2004 i UDP s1.lnx Sat Nov 13 01:29:35 UTC 2004 j UDP jns3-kgtld.j.root-servers.net Sat Nov 13 01:29:36 UTC 2004 k UDP k1.linx Sat Nov 13 01:29:36 UTC 2004 m UDP M-d3 which is mailed off to peter's collector once a day. note that your public ip address is the first thing in the file. this is learned by wget (or telnet to port 80, in case you do not have wget installed) to peter's server at oregon, which responds with the public ip address from which you came. this serves two purposes: o we may want to know from where measurements were taken so we can look at routing data to see why anomalies or normalities occurred. o we are concerned about overloading the root servers against which this experiment is running. therefore, the script will not actually perform the probes unless peter's server responds to the ip address query. this allows peter to throttle or disable the experiment should 10,000 people decide to run it. it might also be used to select probers to concentrate on 'interesting' probe locales in the internet topology. it's just a short shell script, so you should be able to easily feel comfortable that it will not make you vulnerable to anthing other than possible expulsion from the nanog mailing list :-). as it probes only a select list of anycast root servers, and does so every two seconds, this should not place any significant load on the servers or your machine. as our conjecture involves verisign's implication of stateful, e.g., tcp, connections, early reviewers of the experimental setup pushed us to test tcp as well as udp queries. as a tcp query is estimated to have many more packets than a udp query, the current code does one tcp probe every ten udp queries, i.e., around once every 20 seconds. we would really appreciate it if you would run this for a day or three. a tarball with the script and a readme can be found at <http://rip.psg.com/~randy/anycast_gatherer-1.4.tar.gz> [ fyi, my personal bet is that it's usually pretty stable except for sites in strangely unstable routing environments. but i am under my quota of wrong for the week. ] thanks! and many thanks to the early reviewers of the experiment. randy, peter, and friends

17 years, 4 months

Weekly Routing Table Report

by Routing Table Analysis

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 29 Jan, 2005 Analysis Summary ---------------- BGP routing table entries examined: 154984 Prefixes after maximum aggregation: 90381 Unique aggregates announced to Internet: 74096 Total ASes present in the Internet Routing Table: 18880 Origin-only ASes present in the Internet Routing Table: 16393 Origin ASes announcing only one prefix: 7690 Transit ASes present in the Internet Routing Table: 2487 Transit-only ASes present in the Internet Routing Table: 80 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 22 Prefixes from unregistered ASNs in the Routing Table: 6 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 19 Number of addresses announced to Internet: 1370739756 Equivalent to 81 /8s, 179 /16s and 212 /24s Percentage of available address space announced: 37.0 Percentage of allocated address space announced: 58.5 Percentage of available address space allocated: 63.2 Total number of prefixes smaller than registry allocations: 72278 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 30715 Total APNIC prefixes after maximum aggregation: 14875 Prefixes being announced from the APNIC address blocks: 28751 Unique aggregates announced from the APNIC address blocks: 14553 APNIC Region origin ASes present in the Internet Routing Table: 2194 APNIC Region origin ASes announcing only one prefix: 649 APNIC Region transit ASes present in the Internet Routing Table: 326 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 172218240 Equivalent to 10 /8s, 67 /16s and 215 /24s Percentage of available APNIC address space announced: 63.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 86924 Total ARIN prefixes after maximum aggregation: 52224 Prefixes being announced from the ARIN address blocks: 66269 Unique aggregates announced from the ARIN address blocks: 23997 ARIN Region origin ASes present in the Internet Routing Table: 9828 ARIN Region origin ASes announcing only one prefix: 3564 ARIN Region transit ASes present in the Internet Routing Table: 964 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 240024576 Equivalent to 14 /8s, 78 /16s and 124 /24s Percentage of available ARIN address space announced: 71.5 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 29197 Total RIPE prefixes after maximum aggregation: 20200 Prefixes being announced from the RIPE address blocks: 26172 Unique aggregates announced from the RIPE address blocks: 17218 RIPE Region origin ASes present in the Internet Routing Table: 6269 RIPE Region origin ASes announcing only one prefix: 3332 RIPE Region transit ASes present in the Internet Routing Table: 1067 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 22 Number of RIPE addresses announced to Internet: 187084864 Equivalent to 11 /8s, 38 /16s and 176 /24s Percentage of available RIPE address space announced: 65.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6812 Total LACNIC prefixes after maximum aggregation: 2382 Prefixes being announced from the LACNIC address blocks: 6691 Unique aggregates announced from the LACNIC address blocks: 4033 LACNIC Region origin ASes present in the Internet Routing Table: 416 LACNIC Region origin ASes announcing only one prefix: 121 LACNIC Region transit ASes present in the Internet Routing Table: 83 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 16 Number of LACNIC addresses announced to Internet: 17316608 Equivalent to 1 /8s, 8 /16s and 59 /24s Percentage of available LACNIC address space announced: 51.6 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1330 Total AfriNIC prefixes after maximum aggregation: 700 Prefixes being announced from the AfriNIC address blocks: 873 Unique aggregates announced from the AfriNIC address blocks: 692 AfriNIC Region origin ASes present in the Internet Routing Table: 96 AfriNIC Region origin ASes announcing only one prefix: 24 AfriNIC Region transit ASes present in the Internet Routing Table: 13 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2107648 Equivalent to 0 /8s, 32 /16s and 41 /24s Percentage of available AfriNIC address space announced: 12.6 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 886 4624 173 Data Communications Bureau 1221 785 1183 560 Telstra Pty Ltd 4766 582 3414 279 Korea Internet Exchange for " 9583 569 48 11 Satyam Infoway Ltd., 4755 460 178 101 Videsh Sanchar Nigam Ltd. Aut 17676 393 5900 61 XTAGE CORPORATION 9443 362 71 77 Primus Telecommunications 2907 353 1856 326 SINET Japan 9929 350 164 35 China Netcom Corp. 17557 303 22 149 Pakistan Telecom 10036 294 27 270 C&M Communication Co. Ltd. 7545 279 86 67 TPG Internet Pty Ltd 7474 277 296 207 Optus Communications Pty Ltd 2764 273 254 220 connect.com.au pty ltd 703 271 340 212 UUNET 9800 238 383 76 CHINA UNICOM 4808 235 172 129 CHINANET core WAN North 9498 234 81 53 BHARTI BT INTERNET LTD. 4802 231 28 140 Wantree Development 7563 225 48 159 Korea Internet Infrastructure ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1457 6607 976 AT&T WorldNet Services 721 1122 21787 314 DLA Systems Automation Center 701 1063 8335 911 UUNET Technologies, Inc. 1239 926 2880 616 Sprint 6197 838 378 400 BellSouth Network Solutions, 4323 837 672 218 Time Warner Telecom 2386 813 505 601 AT&T Data Communications Serv 18566 766 208 6 Covad Communications 209 664 3404 503 Qwest 7015 596 212 22 AT&T Broadband 3356 591 10867 436 Level 3 Communications, LLC 20115 569 474 303 Charter Communications 3561 560 2370 415 Cable & Wireless USA 852 525 1126 399 Telus Advanced Communications 6478 501 819 96 AT&T Worldnet Services 3602 492 120 94 Sprint Canada, Inc. 27364 460 44 19 Armstrong Cable Services 6198 456 488 200 BellSouth Network Solutions, 7132 452 8395 381 SBC Internet Services 22773 436 1085 19 Cox Communications, Inc. Atla RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 619 2023 511 UUNET - Commercial IP service 3320 291 2992 227 Deutsche Telekom AG 3301 287 1112 275 TeliaNet Sweden 8220 275 466 268 COLT Internet - International 680 253 2041 239 DFN-IP service G-WiN 3246 225 471 220 Song Networks 13083 217 51 8 Mannesmann Datenverarbeitung 8708 210 119 191 Romania Data Systems S.A. 1257 205 708 171 SWIPnet Swedish IP Network 5515 187 842 135 Sonera Solution Autonomous Sy 3215 186 1022 79 France Telecom Transpac 786 176 1794 176 The JANET IP Service 6746 176 47 140 Dynamic Network Technologies, 8866 166 19 23 Bulgarian Telecommunication C 3269 161 1392 71 TELECOM ITALIA 3300 161 165 81 AUCS Communications Services 719 158 322 104 LANLINK autonomous system 5400 141 219 124 BT Ignite European Backbone 25186 140 122 99 France Telecom Transpac's Tra 3303 130 577 125 Swisscom Ltd LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6140 357 140 69 ImpSat 8151 335 489 142 UniNet S.A. de C.V. 16814 234 14 6 NSS, S.A. 11172 212 99 54 Servicios Alestra S.A de C.V 6147 189 102 20 Telefonica Del Peru 11664 158 19 24 Keytech SA 7303 149 68 22 Telecom Argentina Stet-France 6505 133 90 90 Global One Communicaoes Ltda 6503 116 147 81 AVANTEL, S.A. 14117 114 7 5 Telefonica del Sur S.A. 11992 107 9 31 Integrated Systems 11556 97 48 3 Cable-Wireless Panama 13999 89 52 9 Mega Cable S.A. de C.V. 14420 87 6 42 ANDINATEL S.A. 11311 86 8 22 Sinectis S.A. 6535 85 7 23 Chilesat Servicios Empresari 10481 83 32 7 Prima S.A. 4270 81 18 9 Red de Interconexion Universi 5639 81 8 8 Telecommunications Services o 15311 78 25 37 Telefonica Empresas AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 268 636 226 The Internet Solution 5536 113 16 4 Internet Egypt Network 2018 102 297 98 Tertiary Education Network 20928 84 16 2 Noor Advanced Technologies AS 2905 77 272 70 The Internetworking Company o 24835 56 34 6 RAYA Telecom - Egypt 8452 46 20 5 TEDATA 6713 34 38 9 Itissalat Al-MAGHRIB 9129 33 3 2 UUNET Kenya 12455 28 7 4 Jambonet Autonomous system 5713 27 141 24 Telkom SA Ltd 8524 23 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 21280 18 2 3 Swift Global Kenya Ltd.Is an 15706 15 4 2 Sudatel Internet Exchange Aut 21491 15 1 3 UTL On-line is RF broadband I 8346 14 7 14 SONATEL-AS Autonomous System 15808 13 1 2 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 721 1122 808 DLA Systems Automation Center 18566 766 760 Covad Communications 4134 886 713 Data Communications Bureau 4323 837 619 Time Warner Telecom 7015 596 574 AT&T Broadband 9583 569 558 Satyam Infoway Ltd., 27364 460 441 Armstrong Cable Services 6197 838 438 BellSouth Network Solutions, 22773 436 417 Cox Communications, Inc. Atla 5668 431 414 Century Telephone 6478 501 405 AT&T Worldnet Services 3602 492 398 Sprint Canada, Inc. 4755 460 359 Videsh Sanchar Nigam Ltd. Aut 22909 423 358 Comcast Cable Corporation 6467 366 335 E.Spire Communications, Inc. 17676 393 332 XTAGE CORPORATION 9929 350 315 China Netcom Corp. 1239 926 310 Sprint 4766 582 303 Korea Internet Exchange for " 13609 335 300 Choice One Communications Inc List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64826 PRIVATE 64.200.250.0/23 7911 Williams Communicati 64513 PRIVATE 149.117.96.0/24 577 Bell Advanced Commun 26422 UNALLOCATED 196.46.184.0/22 3741 The Internet Solutio 65002 PRIVATE 208.179.184.0/24 11509 The Pajo Group 65529 PRIVATE 216.21.199.0/24 14697 VDot.Net 65529 PRIVATE 216.152.237.0/24 14697 VDot.Net Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.212.0.0/16 1668 GNN Hosting Service 172.213.0.0/16 1668 GNN Hosting Service 172.214.0.0/16 1668 GNN Hosting Service 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:7 /11:14 /12:61 /13:143 /14:314 /15:574 /16:8279 /17:2384 /18:4070 /19:10046 /20:10613 /21:8393 /22:11673 /23:12907 /24:84525 /25:296 /26:266 /27:128 /28:63 /29:33 /30:127 /31:0 /32:46 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 751 766 Covad Communications 6197 683 838 BellSouth Network Solutions, 7018 621 1457 AT&T WorldNet Services 2386 586 813 AT&T Data Communications Serv 7015 564 596 AT&T Broadband 27364 445 460 Armstrong Cable Services 4766 398 582 Korea Internet Exchange for " 9583 398 569 Satyam Infoway Ltd., 702 377 619 UUNET - Commercial IP service 5668 371 431 Century Telephone 1239 367 926 Sprint 6198 328 456 BellSouth Network Solutions, 10036 294 294 C&M Communication Co. Ltd. 13609 292 335 Choice One Communications Inc 4323 282 837 Time Warner Telecom 6517 281 303 Yipes Communications, Inc. 6467 277 366 E.Spire Communications, Inc. 9929 275 350 China Netcom Corp. 701 263 1063 UUNET Technologies, Inc. 11456 263 308 Carolina Online, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:9 12:1487 13:1 15:6 16:2 17:3 18:4 20:4 24:1006 32:68 33:3 38:90 40:55 44:3 47:2 52:3 55:2 56:3 57:22 59:2 60:12 61:632 62:511 63:1836 64:2561 65:2098 66:2587 67:484 68:495 69:892 70:54 71:2 72:47 80:557 81:501 82:362 83:232 84:101 85:81 128:126 129:167 130:89 131:194 132:37 134:144 135:30 136:208 137:76 138:181 139:47 140:191 141:102 142:139 143:121 144:248 145:45 146:281 147:97 148:262 149:161 150:94 151:62 152:111 153:71 154:2 155:136 156:70 157:75 158:149 159:163 160:67 161:61 162:413 163:84 164:212 165:157 166:127 167:223 168:382 169:131 170:316 171:8 192:5646 193:3072 194:2252 195:1574 196:602 198:3850 199:3229 200:3941 201:43 202:5205 203:5887 204:3596 205:2009 206:2315 207:2648 208:2104 209:3060 210:1555 211:767 212:1146 213:1270 214:239 215:31 216:3703 217:1088 218:187 219:125 220:341 221:79 222:77 End of report

17 years, 5 months

The Cidr Report

by cidr-report＠potaroo.net

This report has been generated at Fri Jan 28 21:49:25 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 21-01-05 150315 103500 22-01-05 151119 103502 23-01-05 150437 103475 24-01-05 150434 103516 25-01-05 150622 103724 26-01-05 150792 103854 27-01-05 150792 103116 28-01-05 150969 103172 AS Summary 18774 Number of ASes in routing system 7698 Number of ASes announcing only one prefix 1435 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 90486528 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 28Jan05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 151027 103215 47812 31.7% All ASes AS18566 766 7 759 99.1% CVAD Covad Communications AS4134 839 206 633 75.4% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 833 224 609 73.1% TWTC Time Warner Telecom AS721 1118 573 545 48.7% DNIC DoD Network Information Center AS7015 596 77 519 87.1% CCCH-3 Comcast Cable Communications Holdings, Inc AS7018 1435 973 462 32.2% ATTW AT&T WorldNet Services AS22773 436 19 417 95.6% CXA Cox Communications Inc. AS27364 460 46 414 90.0% ARMC Armstrong Cable Services AS6197 834 448 386 46.3% BNS-14 BellSouth Network Solutions, Inc AS6478 501 118 383 76.4% ATTW AT&T WorldNet Services AS3602 513 148 365 71.2% SPCA Sprint Canada Inc. AS22909 423 74 349 82.5% CMCS Comcast Cable Communications, Inc. AS1239 923 615 308 33.4% SPRN Sprint AS9929 340 35 305 89.7% CNCNET-CN China Netcom Corp. AS4766 568 279 289 50.9% KIXS-AS-KR Korea Telecom AS17676 391 103 288 73.7% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS14654 263 7 256 97.3% WAYPOR-3 Wayport AS9443 366 121 245 66.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS6140 378 141 237 62.7% IMPSA ImpSat AS4355 300 64 236 78.7% ERSD EARTHLINK, INC AS9583 576 343 233 40.5% SIFY-AS-IN Sify Limited AS25844 244 16 228 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS6198 447 225 222 49.7% BNS-14 BellSouth Network Solutions, Inc AS15270 245 32 213 86.9% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. AS2386 812 609 203 25.0% ADCS-1 AT&T Data Communications Services AS23126 210 18 192 91.4% KTEL KMC Telecom, Inc. AS5668 426 241 185 43.4% CIH-12 CenturyTel Internet Holdings, Inc. AS19632 191 8 183 95.8% Metropolis Intercom AS6517 301 119 182 60.5% YIPS Yipes Communications, Inc. AS9498 235 54 181 77.0% BBIL-AP BHARTI BT INTERNET LTD. Total 15970 5943 10027 62.8% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS11814 IGST Information Gateway Services - Toronto 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.200.100.0/24 AS7018 ATTW AT&T WorldNet Services 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 201.239.0.0/16 AS22047 VTR BANDA ANCHA S.A. 202.72.240.0/20 AS24320 RAILCOM Mongolian Railway Commercial Center Railcom 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of BAYANTEL 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.29.168.0/21 AS10248 IPI Internet Partners, Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

17 years, 5 months

IANA IPv4 allocations and bogon update: 124/8, 125/8 and 126/8

by Rob Thomas

-----BEGIN PGP SIGNED MESSAGE----- Hi, team. [ Apologies to those of you who receive this note in multiple forums. ] The numerous Team Cymru bogon projects have been updated as of 27 JAN 2005 to reflect the following IANA allocation made on 27 JAN 2005: 124/8 Jan 05 APNIC (whois.apnic.net) 125/8 Jan 05 APNIC (whois.apnic.net) 126/8 Jan 05 APNIC (whois.apnic.net) IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-template.htm> Secure JUNOS BGP Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-bgp-template.htm> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix-Filter- Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter- loose.htm> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter- strict.htm> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> RIPE NCC fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#ripe> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Bogus ASN monitoring - <http://www.cymru.com/BGP/asnbogusrep.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thanks, Rob. - -- Rob Thomas http://www.cymru.com Shaving with Occam's razor since 1999. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQfl/WlkX3QAo5sgJAQF9bQP9Fr8ME4sMVC27ANxUfgDjbG7SLnI2vnQK FMNkdXSoLdNSulPtcwKu9x6uMxDfQtN1s7Ks2LMC2x8aA/aAMJSgY9zaawmuy6Gv iElHI0mHsRY90YbYVS1o6nXP/RtFFK4GdOgw99LjkAjgm/tEdGrbt6dzaHkCTrAa bbvDFteCeH4= =PPS8 -----END PGP SIGNATURE-----

17 years, 5 months

New IANA IPv4 allocation for APNIC (124/8, 125/8, 126/8)

by Doug Barton

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, This is to inform you that the IANA has allocated the following three (3) IPv4 /8 blocks to APNIC: 124/8 APNIC 125/8 APNIC 126/8 APNIC For a full list of IANA IPv4 allocations please see: <http://www.iana.org/assignments/ipv4-address-space> - -- Doug Barton General Manager, The Internet Assigned Numbers Authority -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFB+UfKwtDPyTesBYwRAiFLAJwPunYfqYEZzru+Zhpo3Tzf0kF75QCgoN14 OXCHaZBmTrtvRdSRjxt9VZQ= =KaeV -----END PGP SIGNATURE-----

17 years, 5 months

Cisco Security Advisory: Cisco IOS Misformed BGP Packet Causes Reload

by Cisco Systems Product Security Incident Response Team

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Misformed BGP Packet Causes Reload Revision 1.0 For Public Release 2005 January 26 1600 UTC (GMT) - ----------------------------------------------------------------------- Contents ======== Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures - ----------------------------------------------------------------------- Summary ======= A Cisco device running IOS? and enabled for the Border Gateway Protocol (BGP) is vulnerable to a Denial of Service (DoS) attack from a malformed BGP packet. Only devices with the command bgp log-neighbor-changes configured are vulnerable. The BGP protocol is not enabled by default, and must be configured in order to accept traffic from an explicitly defined peer. Unless the malicious traffic appears to be sourced from a configured, trusted peer, it would be difficult to inject a malformed packet. Cisco has made free software available to address this problem. This issue is tracked by CERT/CC VU#689326. This advisory will be posted at http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml. Affected Products ================= Vulnerable Products +------------------ This vulnerability is present in any unfixed version of Cisco IOS, from the beginning of support for the BGP protocol, including versions 9.x, 10.x, 11.x and 12.x. This issue affects all Cisco devices configured for BGP routing and running the bgp log-neighbor-changes command, which is on by default starting with releases 12.0(22)S, 12.0(11)ST, 12.1(10) E, 12.1(10) and later software. A router which is running the BGP process will have both a line in the configuration defining the AS number and the command bgp log-neighbor-changes, which can be seen by issuing the command show running-config: router bgp <AS number> bgp log-neighbor-changes To determine the software running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS ?." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output. The following example identifies a Cisco product running IOS release 12.0(3) with an installed image name of C2500-IS-L: Cisco Internetwork Operating System Software IOS (TM) 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE The release train label is "12.0." The next example shows a product running IOS release 12.0(2a)T1 with an image name of C2600-JS-MZ: Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1) Additional information about Cisco IOS release naming can be found at: http://www.cisco.com/warp/public/620/1.html. Products Confirmed Not Vulnerable +-------------------------------- Products confirmed not to be vulnerable include devices that do not run Cisco IOS, such as the Cisco Guard, products that cannot participate in BGP or products that cannot be configured for BGP. No other Cisco products are currently known to be affected by this vulnerability. Details ======= The Border Gateway Protocol (BGP) is a routing protocol defined by RFC 1771, and designed to manage IP routing in large networks. An affected Cisco device running a vulnerable version of Cisco IOS software with the BGP protocol enabled will reload if a malformed BGP packet is already queued on the interface when a BGP neighbor change is logged. The device is not vulnerable unless the command 'bgp log-neighbor-changes' is configured. Malformed packets may not come from malicious sources; a valid peering device such as another BGP speaking router which produces the specific malformed packet in error may trigger this behavior. BGP runs over the Transport Control Protocol (TCP), a reliable transport protocol which requires a valid three way handshake before any further messages will be accepted. The Cisco IOS implementation of BGP requires the explicit definition of a neighbor before a connection can be established, and traffic must appear to come from that neighbor. These implementation details make it very difficult to maliciously send a BGP packet to a Cisco IOS device from an unauthorized source. This bug may also be triggered by other means which are not considered remotely exploitable. The use of the commands 'show ip bgp neighbors' or 'debug ip bgp <neighbor> updates' can cause a router to reload if a router has previously queued a malformed packet. If there are no queued malformed packets, issuing these commands will have no harmful side effects. A Cisco device receiving an invalid BGP packet will reset and may take several minutes to become fully functional. This vulnerability may be exploited repeatedly resulting in an extended DoS attack. This issue is documented in bug ID CSCee67450. Impact ====== Successful exploitation of this vulnerability results in a reload of the device. Repeated exploitation could result in a sustained DoS attack. Software Versions and Fixes =========================== When considering software upgrades, please also consult http://www.cisco.com/en/US/products/products_security_advisories_listing.ht… and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") for assistance. +----------------------------------------+ | Major | Availability of Repaired | | Release | Releases* | |------------+---------------------------| | Affected | | Maintenance | | 12.0-Based | Rebuild | Release | | Release | | | |------------+-------------+-------------| | 12.0 | 12.0(28b) | | |------------+-------------+-------------| | 12.0DA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.0DB | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.0DC | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | 12.0(26)S5 | | | |-------------+-------------| | | 12.0(27)S4 | | |12.0S |-------------+-------------| | | 12.0(28)S1 | | | |-------------+-------------| | | | 12.0(29)S | |------------+-------------+-------------| | 12.0SC | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.0SP | 12.0S or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.0ST | 12.0(26)S5 | | | | or later | | |------------+-------------+-------------| | 12.0SX | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.0SY | 12.0(26)S5 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.0SZ | 12.0(26)S5 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.0T | 12.1 or | | | | later | | |------------+-------------+-------------| | | | 12.0(28)W5 | | 12.0W5 | | (31) | | | | | |------------+-------------+-------------| | 12.0WC | Not Vulnerable, no | | | support for BGP | |------------+-------------+-------------| | 12.0WT | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.0WX | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.0XA | Migrate to | | | | 12.1 latest | | |------------+-------------+-------------| | | Migrate to | | | 12.0XB | 12.1 or | | | | later | | |------------+-------------+-------------| | 12.0XC | Migrate to | | | | 12.1 latest | | |------------+-------------+-------------| | 12.0XD | Migrate to | | | | 12.1 latest | | |------------+-------------+-------------| | | Migrate to | | | 12.0XE | 12.1E | | | | latest | | |------------+-------------+-------------| | 12.0XF | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.0XG | Migrate to | | | | 12.1 latest | | |------------+-------------+-------------| | | Migrate to | | | 12.0XH | 12.1 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.0XI | 12.1 or | | | | later | | |------------+-------------+-------------| | 12.0XJ | Migrate to | | | | 12.1 latest | | |------------+-------------+-------------| | 12.0XK | Migrate to | | | | 12.2 latest | | |------------+-------------+-------------| | 12.0XL | Migrate to | | | | 12.2 latest | | |------------+-------------+-------------| | | Migrate to | | | 12.0XM | 12.1 or | | | | later | | |------------+-------------+-------------| | 12.0XN | Migrate to | | | | 12.1 latest | | |------------+-------------+-------------| | 12.0XP | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.0XQ | 12.1 or | | | | later | | |------------+-------------+-------------| | 12.0XR | Migrate to | | | | 12.2 latest | | |------------+-------------+-------------| | | Migrate to | | | 12.0XS | 12.1E | | | | latest | | |------------+-------------+-------------| | 12.0XT | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.0XU | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.0XV | 12.1 or | | | | later | | |------------+-------------+-------------| | Affected | | Maintenance | | 12.1-Based | Rebuild | Release | | Release | | | |------------+-------------+-------------| | 12.1 | | 12.1(26) | |------------+-------------+-------------| | 12.1AA | Migrate to | | | | 12.2 latest | | |------------+-------------+-------------| | 12.1AX | 12.1(14)AX3 | | |------------+-------------+-------------| | | Migrate to | | | 12.1AY | 12.1(22)EA2 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.1AZ | 12.1(22)EA2 | | | | or later | | |------------+-------------+-------------| | 12.1DA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.1DB | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.1DC | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | 12.1(22)E3 | | | |-------------+-------------| | 12.1E | 12.1(23)E2 | | | |-------------+-------------| | | | 12.1(26)E | |------------+-------------+-------------| | 12.1EA | 12.1(22)EA2 | | |------------+-------------+-------------| | 12.1EC | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.1EO | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.1EV | 12.2S | | | | latest | | |------------+-------------+-------------| | | Migrate to | | | 12.1EW | 12.2(18)EW2 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.1EX | 12.1E | | | | latest | | |------------+-------------+-------------| | | Migrate to | | | 12.1EY | 12.1E | | | | latest | | |------------+-------------+-------------| | | Migrate to | | | 12.1T | 12.2 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XA | 12.2 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XB | 12.2 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XC | 12.2 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XD | 12.2 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XE | 12.1E | | | | latest | | |------------+-------------+-------------| | | Migrate to | | | 12.1XF | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XG | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XH | 12.2 or | | | | later | | |------------+-------------+-------------| | 12.1XI | Migrate to | | | | 12.2 latest | | |------------+-------------+-------------| | | Migrate to | | | 12.1XJ | 12.3 or | | | | later | | |------------+-------------+-------------| | | MMigrate to | | | 12.1XL | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XM | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XP | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XQ | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XR | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XT | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1XU | 12.3 or | | | | later | | |------------+-------------+-------------| | 12.1XV | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.1YA | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1YB | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1YC | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1YD | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1YE | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1YF | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1YH | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.1YI | 12.2(2)YC | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.1YJ | 12.1(22)EA2 | | | | or later | | |------------+-------------+-------------| | Affected | Rebuild | Maintenance | | 12.2-Based | | Release | |------------+-------------+-------------| | 12.2 | | 12.2(27) | |------------+-------------+-------------| | | Migrate to | | | 12.2B | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | 12.2BC | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.2BW | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | | 12.3(7)XI3 | | | 12.2BX | -- | | | | Available 2 | | | | /15/05 | | |------------+-------------+-------------| | | Migrate to | | | 12.2BY | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | | 12.3(7)XI3 | | | 12.2BZ | -- | | | | Available 2 | | | | /15/05 | | |------------+-------------+-------------| | 12.2CZ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2DA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.2DD | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2DX | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | 12.2(18)EW2 | | |12.2EW |-------------+-------------| | | | 12.2(25)EW | |------------+-------------+-------------| | | | | |12.2JK |12.2(15)JK2 |-------------| | | | | |------------+-------------+-------------| | | Migrate to | | | 12.2MB | 12.2(25)SW | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2MC | 12.3(11)T | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2MX | 12.3(8)T5 | | | | or later | | |------------+-------------+-------------| | 12.2S | | 12.2(25)S | |------------+-------------+-------------| | 12.2SE | 12.2(20)SE3 | | |------------+-------------+-------------| | 12.2SU | 12.2(14)SU2 | | |------------+-------------+-------------| | 12.2SW | Migrate to | | | | 12.2(25)SW | | |------------+-------------+-------------| | | Migrate to | | | 12.2SX | 12.2(17d) | | | | SXB5 | | |------------+-------------+-------------| | | Migrate to | | | 12.2SXA | 12.2(17d) | | | | SXB5 | | |------------+-------------+-------------| | 12.2SXB | 12.2(17d) | | | | SXB5 | | |------------+-------------+-------------| | 12.2SXD | 12.2(18) | | | | SXD2 | | |------------+-------------+-------------| | | Migrate to | | | 12.2SY | 12.2(17d) | | | | SXB5 | | |------------+-------------+-------------| | | Migrate to | | | 12.2SZ | 12.2(25)S | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2T | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XA | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XB | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XC | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XD | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XE | 12.3 or | | | | later | | |------------+-------------+-------------| | 12.2XF | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.2XG | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XH | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XI | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XJ | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XK | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XL | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XM | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XN | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XQ | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XS | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XT | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XU | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XW | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2XZ | 12.3 or | | | | later | | |------------+-------------+-------------| | 12.2YA | 12.2(4)YA8 | | |------------+-------------+-------------| | | Migrate to | | | 12.2YB | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YC | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YE | 12.2S or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YF | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YG | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YH | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YJ | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YK | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YL | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YM | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YN | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YO | 12.2(17d) | | | | SXB5 | | |------------+-------------+-------------| | | Migrate to | | | 12.2YP | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YQ | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YR | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YS | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YT | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YU | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YV | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YW | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YX | 12.2(14)SU2 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YY | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2YZ | 12.2(25)S | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZA | 12.2(25)S | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZB | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZC | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZD | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZE | 12.3 or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZF | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZG | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZH | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZI | 12.2(25)S | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZJ | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZK | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZL | 12.3(7)T7 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZN | 12.3T or | | | | later | | |------------+-------------+-------------| | | Migrate to | | | 12.2ZO | 12.3 or | | | | later | | |------------+-------------+-------------| | 12.2ZP | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | Affected | Rebuild | Maintenance | | 12.3-Based | | Release | |------------+-------------+-------------| | | 12.3(9c) | | | |-------------+-------------| | 12.3 | 12.3(10a) | | | |-------------+-------------| | | | 12.3(12) | |------------+-------------+-------------| | 12.3B | 12.3(5a)B3 | | |------------+-------------+-------------| | | Migrate to | | | 12.3BW | 12.3(7)T7 | | | | or later | | |------------+-------------+-------------| | | 12.3(4)T11 | | | |-------------+-------------| | | 12.3(7)T7 | | |12.3T |-------------+-------------| | | 12.3(8)T5 | | | |-------------+-------------| | | | 12.3(11)T | |------------+-------------+-------------| | | Migrate to | | | 12.3XA | 12.3(7)T7 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.3XB | 12.3(8)T5 | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.3XC | 12.3(8)T5 | | | | or later | | |------------+-------------+-------------| | 12.3XD | 12.3(4)XD4 | | |------------+-------------+-------------| | 12.3XE | 12.3(2)XE1 | | |------------+-------------+-------------| | | Migrate to | | | 12.3XF | 12.3(11)T | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.3XG | 12.3(11)T | | | | or later | | |------------+-------------+-------------| | | Migrate to | | | 12.3XH | 12.3(11)T | | | | or later | | |------------+-------------+-------------| | | 12.3(7)XI3 | | | 12.3XI | - Available | | | | 2/15/05 | | |------------+-------------+-------------| | 12.3XJ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.3XK | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.3XL | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.3XN | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | 12.3(4)XQ1 | | | | Release | | | 12.3XQ | date not | | | | yet | | | | determined | | |------------+-------------+-------------| | 12.3XR | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.3XS | 12.3(7)XS2 | | |------------+-------------+-------------| | 12.3XU | 12.3(8)XU4 | | |------------+-------------+-------------| | | Migrate to | | | 12.3XV | 12.3(11)T | | | | or later | | |------------+-------------+-------------| | 12.3XX | 12.3(8)XX1 | | |------------+-------------+-------------| | 12.3YA | 12.3(8)YA1 | | |------------+-------------+-------------| | 12.3YC | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.3YD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Migrate to | | | 12.3YE | 12.3(4)T11 | | | | or later | | |------------+-------------+-------------| | 12.3YF | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.3YH | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.3YJ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.3YL | Vulnerable; | | | | contact TAC | | +----------------------------------------+ Obtaining Fixed Software ======================== Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com/public/sw-center/sw-ios.shtml. Customers using Third-party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Workarounds =========== The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. * Remove the configuration command bgp log-neighbor-changes. This feature is used to monitor BGP peer status and its removal may reduce network monitoring capabilities. More information on this command is available here: http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/ipr… The use of networking best practices techniques can greatly reduce the probability of a network infrastructure attack. Best practices that may reduce risk in this case include: BGP MD5 +------ Under normal circumstances, due to inherent security factors in the TCP protocol, such as sequence number checks, it is difficult, but possible to forge an appropriate packet to exploit this problem. Configuring your Cisco IOS device for BGP MD5 authentication greatly increases the work necessary to forge a valid packet from a remote peer. This will not protect your peering session if a valid BGP peer generates an invalid packet. This can be configured as shown in the following example: router(config)# router bgp router(config-router)# neighbor <IP_address> password <enter_your_secret_here> It is necessary to configure the same shared MD5 secret on both peers and at the same time. Failure to do so will break the existing BGP session and the new session will not get established until the exact same secret is configured on both devices. For a detailed discussion on how to configure BGP, refer to the following document: http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_configurati… Once the secret is configured, it is prudent to change it periodically. The exact period must fit within your company security policy but it should not be longer than a few months. When changing the secret, again it must be done at the same time on both devices. Failure to do so will break your existing BGP session. The exception is if your Cisco IOS software release contains the integrated CSCdx23494 ( registered customers only) fix on both sides of the connection. With this fix, the BGP session will not be terminated when the MD5 secret is changed only on one side. The BGP updates, however, will not be processed until either the same secret is configured on both devices or the secret is removed from both devices. Infrastructure Access Control Lists (iACLs) +------------------------------------------ Although it is often difficult to block traffic transiting your network, it is possible to identify traffic that should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as providing some added protection for this specific vulnerability. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/public/707/iacl.html Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was discovered by Cisco during internal testing. Status of This Notice: FINAL ============================ THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.netsys.com * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +----------------------------------------+ | Revision | | Initial | | 1.0 | 2005-January-26 | public | | | | release. | +----------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. - ----------------------------------------------------------------------- All contents are Copyright ? 1992-2005 Cisco Systems, Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQA/AwUBQffNRHsxqM8ytrWQEQK1VwCggGx6J9it3NcBBhbBcI61672Rn2kAoNOz NOf8b9Cf9/dC3zLRA0tJOCzP =K/W6 -----END PGP SIGNATURE-----

17 years, 5 months

Cisco Security Advisory: Crafted Packet Causes Reload on Cisco Routers

by Cisco Systems Product Security Incident Response Team

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Crafted Packet Causes Reload on Cisco Routers Revision 1.0 For Public Release 2005 January 26 1600 (GMT) - -------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures - -------------------------------------------------------------------------- Summary ======= Cisco Routers running Internetwork Operating System (IOS) that supports Multi Protocol Label Switching (MPLS) are vulnerable to a Denial of Service (DoS) attack on MPLS disabled interfaces. A system that supports MPLS is vulnerable even if that system is not configured for MPLS. The vulnerability is only present in Cisco IOS release trains based on 12.1T, 12.2, 12.2T, 12.3 and 12.3T. Releases based on 12.1 mainline, 12.1E and all releases prior to 12.1 are not vulnerable. Cisco has made free software available to address this vulnerability. There are workarounds available to mitigate the effects. This issue is tracked by CERT/CC VU#583638. This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20050126-les.shtml. Affected Products ================= Vulnerable Products Only the following products running a vulnerable version of IOS that support MPLS are affected. * 2600 and 2800 series routers * 3600, 3700 and 3800 series routers * 4500 and 4700 series routers * 5300, 5350 and 5400 series Access Servers Products that are not listed above are not affected. MPLS is not supported in IP and IP Plus feature sets. Therefore, products running an IOS version with an IP or IP Plus feature set are not vulnerable. An attack can only be launched at systems that are not configured for MPLS Traffic Engineering and on the interfaces where MPLS is not enabled. MPLS enabled interfaces can be determined by the show mpls interfaces command. An unaffacted system where MPLS is not supported will give an output similar to the following. Router#show mpls interfaces ^ % Invalid input detected at '^' marker. Router# MPLS can be enabled in different ways on a router. In the below output, a router is shown that has MPLS enabled for IP on interface Ethernet0/0. Router#show mpls interfaces Interface IP Tunnel Operational Ethernet0/0 Yes (tdp) No Yes Router# When MPLS for IP is enabled on an interface, the router is immune to the attacks coming from that interface but vulnerable to the attacks coming from other interfaces. Enabling MPLS for IP on all interfaces of the router will make the router immune to attacks coming from any interface. An interface that has MPLS for IP enabled will have mpls ip or tag-switching ip command in the interface configuration. MPLS Traffic Engineering (TE) provides a better protection against this vulnerability. If MPLS TE is enabled globally, the router will be immune to the attacks coming from any interface. A router that has MPLS TE enabled will have mpls traffic-eng tunnels command in the show running-config output. Products Confirmed Not Vulnerable * Products that are not running Cisco IOS are not vulnerable. * Products running Cisco IOS versions 12.0 and earlier and 12.1 mainline are not vulnerable. * Products that are not mentioned in the Affected Products section are not vulnerable (including but not limited to Cisco 7200, 7500, 12000 series and Catalyst systems). No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= Multi Protocol Label Switching (MPLS) is a vendor-independent protocol that integrates layer-2 (as defined in the Open System Interconnection Reference Model) information into layer-3. More information on MPLS can be found at http: //www.cisco.com/warp/public/732/Tech/mpls. A vulnerability exists in the processing of an MPLS packet that is received on an interface where MPLS is disabled. A router that is configured for MPLS Traffic Engineering is immune to attacks coming from any interface. A Cisco device receiving a crafted packet on an MPLS disabled interface will reset and may take several minutes to become fully functional. This vulnerability may be exploited repeatedly resulting in an extended DoS attack. This issue is documented in bugs ID CSCeb56909 ( registered customers only) and CSCec86420 ( registered customers only) . Such crafted packets can only be sent from the local network segment. Impact ====== Successful exploitation of this vulnerability could result in a reload of the device. Repeated exploitation could result in a sustained DoS attack. Software Versions and Fixes +---------------------------------------------+ | Major Release | Availability of Repaired | | | Releases | |-----------------+---------------------------| | Affected | | | | | 12.1-Based | Rebuild | Maintenance | | | Release | | | | |-----------------+------------------------+--| | 12.1DB | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.1DC | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.1T | Migrate to 12.2 or | | | | later | | |-----------------+------------------------+--| | 12.1XG | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XI | Migrate to 12.2 or | | | | later | | |-----------------+------------------------+--| | 12.1XJ | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XL | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XM | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XP | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XQ | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XR | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XT | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XU | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1XV | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1YA | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1YB | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1YC | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1YD | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1YE | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1YF | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1YH | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.1YI | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | Affected | | | | | 12.2-Based | Rebuild | Maintenance | | | Release | | | | |-----------------+----------+-------------+--| | | 12.2 | | | | | (10g) | | | | |----------+-------------+--| | | 12.2 | | | | | (13e) | | | | |----------+-------------+--| | | 12.2 | | | | | (16f) | | | | |----------+-------------+--| | 12.2 | 12.2 | | | | | (17d) | | | | |----------+-------------+--| | | 12.2 | | | | | (19b) | | | | |----------+-------------+--| | | 12.2 | | | | | (21a) | | | | |----------+-------------+--| | | | 12.2(23) | | |-----------------+------------------------+--| | | 12.2(2)B through 12.2 | | | | (4)B7, Migrate to 12.3 | | | | or later | | |12.2B |------------------------+--| | | 12.2(4)B8 and forward, | | | | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2BC | 12.2(15) | | | | | BC2 | | | |-----------------+------------------------+--| | 12.2BW | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2BX | Migrate to 12.3(7)XI1 | | | | or later | | |-----------------+------------------------+--| | 12.BY | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2BZ | Migrate to 12.3(7)XI1 | | | | or later | | |-----------------+------------------------+--| | 12.2CX | Migrate to 12.2(15)BC2 | | |-----------------+------------------------+--| | 12.2CY | Migrate to 12.2(15)BC2 | | |-----------------+------------------------+--| | 12.2CZ | 12.2(15)CZ | | |-----------------+------------------------+--| | 12.2DA | 12.2(12) | | | | | DA6 | | | |-----------------+------------------------+--| | 12.2DD | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2DX | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2EW | | 12.2(18)EW | | |-----------------+----------+-------------+--| | 12.2EWA | | 12.2(20)EWA | | |-----------------+----------+-------------+--| | 12.2JA | | 12.2(15)JA | | |-----------------+----------+-------------+--| | 12.2JK | | 12.2(15)JK | | |-----------------+------------------------+--| | 12.2MB | Migrate to 12.2(19)SW | | |-----------------+------------------------+--| | 12.2MC | Migrate to 12.3(11)T | | |-----------------+------------------------+--| | 12.2MX | Migrate to 12.3(8)T or | | | | later | | |-----------------+------------------------+--| | | 12.2(14) | | | | 12.2S | S10 | | | | |----------+-------------+--| | | | 12.2(18)S | | |-----------------+----------+-------------+--| | 12.2SU | | 12.2(14)SU | | |-----------------+----------+-------------+--| | 12.2SW | | 12.2(19)SW | | |-----------------+------------------------+--| | 12.2SX | Migrate to 12.2(17d) | | | | SXB or later | | |-----------------+------------------------+--| | 12.2SXA | Migrate to 12.2(17d) | | | | SXB or later | | |-----------------+------------------------+--| | 12.2SXB | | 12.2(17d) | | | | | SXB | | |-----------------+----------+-------------+--| | 12.2SXD | | 12.2(18)SXD | | |-----------------+------------------------+--| | 12.2SY | Migrate to 12.2(17d) | | | | SXB or later | | |-----------------+------------------------+--| | 12.2SZ | Migrate to 12.2(20)S4 | | |-----------------+------------------------+--| | 12.2T | 12.2(13) | | | | | T14 | | | |-----------------+------------------------+--| | 12.2XA | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XB | 12.2(2) | | | | | XB18 | | | |-----------------+------------------------+--| | 12.2XC | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2XD | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XE | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XF | Migrate to 12.2(15)BC2 | | |-----------------+------------------------+--| | 12.2XG | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XH | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XI | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XJ | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XK | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XL | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XM | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XN | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XQ | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XR | | 12.2(15)XR | | |-----------------+------------------------+--| | 12.2XS | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XT | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XU | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XV | No plan. | | |-----------------+------------------------+--| | 12.2XW | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2XZ | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2YA | 12.2(4) | | | | | YA8 | | | |-----------------+------------------------+--| | 12.2YB | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2YC | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2YD | Migrate to 12.3(8)T or | | | | later | | |-----------------+------------------------+--| | 12.2YE | Migrate to 12.2(18)S | | | | or later | | |-----------------+------------------------+--| | 12.2YF | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2YG | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2YH | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2YJ | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2YL | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2YM | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2YN | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2YO | Migrate to 12.2(17d) | | | | SXB or later | | |-----------------+------------------------+--| | 12.2YQ | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2YR | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2YS | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2YU | Migrate to 12.3(2)T or | | | | later | | |-----------------+------------------------+--| | 12.2YV | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2YW | Migrate to 12.3(2)T or | | | | later | | |-----------------+------------------------+--| | 12.2YX | Migrate to 12.2(14)SU | | |-----------------+------------------------+--| | 12.2YZ | Migrate to 12.2(20)S4 | | |-----------------+------------------------+--| | 12.2ZB | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2ZC | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2ZD | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2ZE | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2ZF | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2ZG | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2ZH | Migrate to 12.3(4)T or | | | | later | | |-----------------+------------------------+--| | 12.2ZI | Migrate to 12.2(18)S | | | | or later | | |-----------------+------------------------+--| | 12.2ZJ | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2ZL | Migrate to 12.3(7)T or | | | | later | | |-----------------+------------------------+--| | 12.2ZN | Migrate to 12.3T or | | | | later | | |-----------------+------------------------+--| | 12.2ZO | Migrate to 12.3 or | | | | later | | |-----------------+------------------------+--| | 12.2ZP | No plan. | | |-----------------+------------------------+--| | Affected | | | | | 12.3-Based | Rebuild | Maintenance | | | Release | | | | |-----------------+----------+-------------+--| | | 12.3(3f) | | | |12.3 |----------+-------------+--| | | | 12.3(5) | | |-----------------+----------+-------------+--| | 12.3B | | 12.3(5a)B4 | | |-----------------+----------+-------------+--| | 12.3BC | | 12.3(9a)BC | | |-----------------+------------------------+--| | 12.3BW | Migrate to 12.3(5a)B | | | | or later | | |-----------------+------------------------+--| | | 12.3(2) | | | | | T5 | | | | |----------+-------------+--| | 12.3T | 12.3(4) | | | | | T7 | | | | |----------+-------------+--| | | | 12.3(7)T | | |-----------------+------------------------+--| | 12.3XA | Migrate to 12.3(7)T or | | | | later | | |-----------------+------------------------+--| | 12.3XB | Migrate to 12.3(8)T or | | | | later | | |-----------------+------------------------+--| | | Migrate to 12.3(2)XC3 | | | 12.3XC | - Availablility date | | | | TBD | | |-----------------+------------------------+--| | 12.3XD | 12.3(4)XD | | |-----------------+------------------------+--| | 12.3XE | 12.3(2)XE1 | | |-----------------+------------------------+--| | 12.3XF | 12.3(2)XF | | |-----------------+------------------------+--| | 12.3XG | 12.3(4) | | | | | XG1 | | | |-----------------+------------------------+--| | 12.3XH | 12.3(4)XH | | |-----------------+------------------------+--| | 12.3XI | 12.3(7)XI | | |-----------------+------------------------+--| | 12.3XJ | 12.3(7)XJ | | |-----------------+------------------------+--| | 12.3XK | 12.3(4) | | | | | XK1 | | | |-----------------+------------------------+--| | 12.3XL | 12.3(7)XL | | |-----------------+------------------------+--| | 12.3XM | 12.3(7)XM | | |-----------------+------------------------+--| | 12.3XN | 12.3(4)XN | | |-----------------+------------------------+--| | 12.3XQ | 12.3(4)XQ | | |-----------------+------------------------+--| | 12.3XR | 12.3(7)XR | | |-----------------+------------------------+--| | 12.3XS | 12.3(7)XS | | |-----------------+------------------------+--| | 12.3XT | 12.3(2)XT | | |-----------------+------------------------+--| | 12.3XU | 12.3(8)XU | | |-----------------+------------------------+--| | 12.3XW | 12.3(8)XW | | |-----------------+------------------------+--| | 12.3XX | 12.3(8)XX | | |-----------------+------------------------+--| | 12.3XY | 12.3(8)XY | | |-----------------+------------------------+--| | 12.3YA | 12.3(8)YA | | |-----------------+------------------------+--| | 12.3YD | 12.3(8)YD | | |-----------------+------------------------+--| | 12.3YE | 12.3(4)YE | | |-----------------+------------------------+--| | 12.3YF | 12.3(11)YF | | |-----------------+------------------------+--| | 12.3YG | 12.3(8)YG | | |-----------------+------------------------+--| | 12.3YH | 12.3(8)YH | | +---------------------------------------------+ When considering software upgrades, please also consult http://www.cisco.com/en /US/products/products_security_advisories_listing.html and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) for assistance. Obtaining Fixed Software ======================== Customers with Service Contracts Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http:// www.cisco.com. Customers using Third-party Support Organizations Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers without Service Contracts Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public /sw-center/sw-usingswc.shtml. Workarounds =========== The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. Warning: Using this workaround may affect the operation of your network and might cause problems. Therefore it is strongly recommended that you do a code upgrade if you are affected. It is not recommended that you use the workaround as a long term solution. Enabling MPLS Traffic Engineering (MPLS TE) globally can be used as a workaround to mitigate this vulnerability. Since MPLS requires Cisco Express Forwarding (CEF) in order to work, CEF needs to be enabled first in order to enable MPLS TE. CEF and MPLS TE can be enabled by the following commands. Router(config)# ip cef Router(config)# mpls traffic-eng tunnels Having MPLS TE enabled will make the router immune to the attacks coming from any interface. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Status of This Notice: FINAL ============================ THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20050126-les.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.netsys.com * comp.dcom.sys.cisco(a)newsgate.cisco.com * Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------------+ | Revision | 2005-January-26 | Initial public | | 1.0 | | release. | +---------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.… . This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go /psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFB97UdezGozzK2tZARAnvpAJ97oXI2aUhYUDe5HIFSa5N/wHJrmQCg7rhz BS4EvADfUI5e0X6zvvleZ60= =wmKc -----END PGP SIGNATURE-----

17 years, 5 months

Cisco Security Advisory: Multiple Crafted IPv6 Packets Cause Reload

by Cisco Systems Product Security Incident Response Team

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Crafted IPv6 Packets Cause Reload Revision 1.0 For Public Release 2005 January 26 1600 UTC (GMT) - -------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures - -------------------------------------------------------------------------- Summary ======= Cisco Internetwork Operating System (IOS) Software is vulnerable to a Denial of Service (DoS) attack from crafted IPv6 packets when the device has been configured to process IPv6 traffic. This vulnerability requires multiple crafted packets to be sent to the device which may result in a reload upon successful exploitation. Cisco has made free software available to address this vulnerability. There are workarounds available to mitigate the effects. This issue is tracked by CERT/CC VU#472582 This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20050126-ipv6.shtml. Affected Products ================= Vulnerable Products Only the Cisco devices running IOS and configured for IPv6 are affected. A router will display all IPv6 enabled interfaces with the show ipv6 interface command. An empty output or an error message will be displayed if IPv6 is disabled or unsupported on the system. In this case the system is not vulnerable. Sample output of show ipv6 interface command is shown below for a system configured for IPv6. Router#show ipv6 interface Serial1/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::A8BB:CCFF:FE00:D200 Global unicast address(es): 2001:1:33::3, subnet is 2001:1:33::/64 [TENTATIVE] Joined group address(es): FF02::1 FF02::1:FF00:3 FF02::1:FF00:D200 MTU is 1500 bytes ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds Router# A router that has IPv6 enabled on a physical or logical interface is vulnerable to this issue even if ipv6 unicast-routing is globally disabled. The show ipv6 interface command can be used to determine whether IPv6 is enabled on any interface. Products Confirmed Not Vulnerable * Products that are not running Cisco IOS are not affected. * Products running any version of Cisco IOS that do not have IPv6 configured interfaces are not vulnerable. No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= IPv6 is the "Internet Protocol Version 6", designed by the Internet Engineering Task Force (IETF) to replace the current version Internet Protocol, IP Version 4 (IPv4). A vulnerability exists in the processing of IPv6 packets that can be exploited to cause the reload of a system. Crafted packets received on logical interfaces (that is, tunnels including 6to4 tunnels) as well as physical interfaces can trigger this vulnerability. Multiple crafted IPv6 packets need to be sent to exploit this vulnerability. Such crafted packets can be sent remotely. This issue is documented in Cisco bug ID CSCed40933 ( registered customers only) . Impact ====== Successful exploitation of this vulnerability results in a reload of the device. Repeated exploitation could result in a sustained DoS attack. Software Versions and Fixes =========================== +-----------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+----------------------------------------| | Affected | | | | | | 12.0-Based | Rebuild | Interim | Maintenance | | | Release | | | | | |------------+-------------+---------+-------------+--| | | 12.0(23)S | | | | | | and before | | | | | | are not | | | | | | vulnerable. | | | | | |-------------+---------+-------------+--| | | 12.0(24)S6 | | | | |12.0S |-------------+---------+-------------+--| | | 12.0(25)S3 | | | | | |-------------+---------+-------------+--| | | 12.0(26)S2 | | | | | |-------------+---------+-------------+--| | | 12.0(27)S1 | | | | | |-------------+---------+-------------+--| | | | | 12.0(28)S | | |------------+-------------+---------+-------------+--| | 12.0SX | 12.0(25)SX8 | | | | |------------+-------------------------------------+--| | 12.0SZ | 12.0(27)SZ | | |------------+-------------------------------------+--| | Affected | | | | | | 12.2-Based | Rebuild | Interim | Maintenance | | | Release | | | | | |------------+-------------------------------------+--| | | 12.2(2)B - 12.2(4)B7 Migrate to | | | | 12.2(13)T14 or later | | |12.2B |-------------------------------------+--| | | 12.2(4)B8 AND FWD Migrate to 12.3 | | | | (7)T or later | | |------------+-------------------------------------+--| | 12.2BC | Migrate to 12.3(9a)BC | | |------------+-------------------------------------+--| | 12.2BX | Migrate to 12.3(7)XI1 | | |------------+-------------------------------------+--| | 12.2BZ | Migrate to 12.3(7)XI1 | | |------------+-------------------------------------+--| | 12.2CX | No plan. | | |------------+-------------------------------------+--| | 12.2CZ | No plan. | | |------------+-------------------------------------+--| | 12.2EW | 12.2(18)EW1 | | |------------+-------------------------------------+--| | 12.2EWA | | | 12.2(20)EWA | | |------------+-------------+---------+-------------+--| | 12.2JK | 12.2(15)JK2 | | | | |------------+-------------------------------------+--| | 12.2MC | Migrate to 12.3(11)T | | |------------+-------------------------------------+--| | | 12.2(14)S9 | | | | | |-------------+---------+-------------+--| | | 12.2(18)S5 | | | | | |-------------+---------+-------------+--| | 12.2S | 12.2(20)S3 | | | | | |-------------+---------+-------------+--| | | 12.2(22)S1 | | | | | |-------------+---------+-------------+--| | | | | 12.2(25)S | | |------------+-------------------------------------+--| | 12.2SE | 12.2(25)SE | | |------------+-------------------------------------+--| | 12.2SU | 12.2(14)SU1 | | | | |------------+-------------------------------------+--| | 12.2SV | 12.2(23)SV | | |------------+-------------------------------------+--| | 12.2SW | 12.2(23)SW | | |------------+-------------------------------------+--| | 12.2SX | Migrate to 12.2(17d)SXB2 or later | | |------------+-------------------------------------+--| | 12.2SXA | Migrate to 12.2(17d)SXB1 or later | | |------------+-------------------------------------+--| | 12.2SXB | 12.2(17d) | | | | | | SXB1 | | | | |------------+-------------+---------+-------------+--| | 12.2SXD | | | 12.2(18)SXD | | |------------+-------------------------------------+--| | 12.2SY | Migrate to 12.2(17d)SXB2 or later | | |------------+-------------------------------------+--| | 12.2SZ | Migrate to 12.2(20)S4 | | |------------+-------------------------------------+--| | | 12.2(13)T14 | | | | |12.2T |-------------+---------+-------------+--| | | 12.2(15)T12 | | | | |------------+-------------------------------------+--| | 12.2YT | Migrate to 12.2(15)T13 or later | | |------------+-------------------------------------+--| | 12.2YU | Migrate to 12.3(4)T6 or later | | |------------+-------------------------------------+--| | 12.2YV | Migrate to 12.3(4)T6 or later | | |------------+-------------------------------------+--| | 12.2YZ | Migrate to 12.2(20)S4 or later | | |------------+-------------------------------------+--| | 12.2ZC | Migrate to 12.3T or later | | |------------+-------------------------------------+--| | 12.2ZD | Migrate to 12.3 or later | | |------------+-------------------------------------+--| | 12.2ZE | Migrate to 12.3 or later | | |------------+-------------------------------------+--| | 12.2ZF | Migrate to 12.3(4)T6 or later | | |------------+-------------------------------------+--| | 12.2ZG | Migrate to 12.3(4)T6 or later | | |------------+-------------------------------------+--| | 12.2ZH | Migrate to 12.3(4)T6 or later | | |------------+-------------------------------------+--| | 12.2ZI | Migrate to 12.2(18)S or later | | |------------+-------------------------------------+--| | 12.2ZJ | Migrate to 12.3 or later | | |------------+-------------------------------------+--| | 12.2ZL | Migrate to 12.3(7)T or later | | |------------+-------------------------------------+--| | 12.2ZN | Migrate to 12.3(2)T6 or later | | |------------+-------------------------------------+--| | 12.2ZO | Migrate to 12.2(15)T12 or later | | |------------+-------------------------------------+--| | 12.2ZP | Migrate to 12.3(8)XY or later | | |------------+-------------------------------------+--| | Affected | | | | | | 12.3-Based | Rebuild | Interim | Maintenance | | | Release | | | | | |------------+-------------+---------+-------------+--| | | 12.3(3f) | | | | | |-------------+---------+-------------+--| | | 12.3(5c) | | | | |12.3 |-------------+---------+-------------+--| | | 12.3(6a) | | | | | |-------------+---------+-------------+--| | | | | 12.3(9) | | |------------+-------------+---------+-------------+--| | 12.3BC | | | 12.3(9a)BC | | |------------+-------------+---------+-------------+--| | 12.3B | 12.3(5a)B2 | | | | |------------+-------------------------------------+--| | 12.3BW | Migrate to 12.3(5a)B2 or later | | |------------+-------------------------------------+--| | 12.3JA | | | 12.3(2)JA | | |------------+-------------+---------+-------------+--| | | 12.3(2)T6 | | | | | |-------------+---------+-------------+--| | 12.3T | 12.3(4)T6 | | | | | |-------------+---------+-------------+--| | | | | 12.3(7)T | | |------------+-------------------------------------+--| | 12.3XA | Migrate to 12.3(7)T or later | | |------------+-------------------------------------+--| | 12.3XB | Migrate to 12.3(8)T or later | | |------------+-------------------------------------+--| | 12.3XC | Migrate 12.3(2)XC3 or later | | |------------+-------------------------------------+--| | 12.3XD | 12.3(4)XD4 | | | | |------------+-------------------------------------+--| | 12.3XE | 12.3(2)XE1 | | |------------+-------------------------------------+--| | 12.3XF | Migrate to 12.3(11)T or later | | |------------+-------------------------------------+--| | 12.3XG | 12.3(4)XG2 | | | | |------------+-------------------------------------+--| | 12.3XH | Migrate to 12.3(11)T or later | | |------------+-------------------------------------+--| | 12.3XI | | | 12.3(7)XI | | |------------+-------------------------------------+--| | 12.3XJ | 12.3(7)XJ | | |------------+-------------------------------------+--| | 12.3XK | 12.3(4)XK1 | | | | |------------+-------------+---------+-------------+--| | 12.3XL | | | 12.3(7)XL | | |------------+-------------+---------+-------------+--| | 12.3XM | | | 12.3(7)XM | | |------------+-------------------------------------+--| | 12.3XN | Migrate to 12.3(14)T or later | | |------------+-------------------------------------+--| | 12.3XQ | 12.3(4)XQ | | |------------+-------------------------------------+--| | 12.3XR | | | 12.3(7)XR | | |------------+-------------------------------------+--| | 12.3XS | 12.3(7)XS | | |------------+-------------------------------------+--| | 12.3XT | 12.3(2)XT | | |------------+-------------------------------------+--| | 12.3XU | 12.3(8)XU | | |------------+-------------------------------------+--| | 12.3XX | | | 12.3(8)XX | | |------------+-------------+---------+-------------+--| | 12.3XW | | | 12.3(8)XW | | |------------+-------------+---------+-------------+--| | 12.3XY | | | 12.3(8)XY | | |------------+-------------+---------+-------------+--| | 12.3XZ | | | 12.3(2)XZ | | |------------+-------------+---------+-------------+--| | 12.3YA | | | 12.3(8)YA | | |------------+-------------+---------+-------------+--| | 12.3YD | | | 12.3(8)YD | | |------------+-------------+---------+-------------+--| | 12.3YE | | | 12.3(4)YE | | |------------+-------------+---------+-------------+--| | 12.3YF | | | 12.3(11)YF | | |------------+-------------+---------+-------------+--| | 12.3YG | | | 12.3(8)YG | | |------------+-------------+---------+-------------+--| | 12.3YH | | | 12.3(8)YH | | +-----------------------------------------------------+ When considering software upgrades, please also consult http://www.cisco.com/en /US/products/products_security_advisories_listing.html and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) for assistance. Obtaining Fixed Software ======================== Customers with Service Contracts Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http:// www.cisco.com. Customers using Third-party Support Organizations Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers without Service Contracts Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public /sw-center/sw-usingswc.shtml. Workarounds =========== The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure access control lists (ACLs) are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists", available at http://www.cisco.com/warp/public/707/iacl.html, presents guidelines and recommended deployment techniques for infrastructure protection ACLs. Exceptions would include any devices which have a legitimate reason to access your infrastructure (for example, BGP peers, DNS servers, and so on). All other traffic must be able to traverse your network without terminating on any of your devices. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Status of This Notice: FINAL ============================ THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory will be posted on Cisco's worldwide website at http:// www.cisco.com/warp/public/707/cisco-sa-20050126-ipv6.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.netsys.com * comp.dcom.sys.cisco(a)newsgate.cisco.com * Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------------+ | Revision | 2005-January-26 | Initial public | | 1.0 | | release. | +---------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.… . This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go /psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFB97ElezGozzK2tZARAnf7AKCaIOMqvct4DE93oqAztxQJCT2KcgCg127I LHNvmFV/3Dga2ijk5r5XuP8= =HD3z -----END PGP SIGNATURE-----

17 years, 5 months

Weekly Routing Table Report

by Routing Table Analysis

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 22 Jan, 2005 Analysis Summary ---------------- BGP routing table entries examined: 155157 Prefixes after maximum aggregation: 90262 Unique aggregates announced to Internet: 74120 Total ASes present in the Internet Routing Table: 18844 Origin-only ASes present in the Internet Routing Table: 16362 Origin ASes announcing only one prefix: 7675 Transit ASes present in the Internet Routing Table: 2482 Transit-only ASes present in the Internet Routing Table: 78 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 19 Prefixes from unregistered ASNs in the Routing Table: 5 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 16 Number of addresses announced to Internet: 1368386088 Equivalent to 81 /8s, 143 /16s and 234 /24s Percentage of available address space announced: 36.9 Percentage of allocated address space announced: 59.7 Percentage of available address space allocated: 61.9 Total number of prefixes smaller than registry allocations: 72674 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 30684 Total APNIC prefixes after maximum aggregation: 14870 Prefixes being announced from the APNIC address blocks: 28712 Unique aggregates announced from the APNIC address blocks: 14618 APNIC Region origin ASes present in the Internet Routing Table: 2188 APNIC Region origin ASes announcing only one prefix: 647 APNIC Region transit ASes present in the Internet Routing Table: 325 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 171804544 Equivalent to 10 /8s, 61 /16s and 135 /24s Percentage of available APNIC address space announced: 78.4 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 87123 Total ARIN prefixes after maximum aggregation: 52178 Prefixes being announced from the ARIN address blocks: 65773 Unique aggregates announced from the ARIN address blocks: 24084 ARIN Region origin ASes present in the Internet Routing Table: 9824 ARIN Region origin ASes announcing only one prefix: 3546 ARIN Region transit ASes present in the Internet Routing Table: 970 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 239481856 Equivalent to 14 /8s, 70 /16s and 52 /24s Percentage of available ARIN address space announced: 71.4 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 29208 Total RIPE prefixes after maximum aggregation: 20133 Prefixes being announced from the RIPE address blocks: 26177 Unique aggregates announced from the RIPE address blocks: 17156 RIPE Region origin ASes present in the Internet Routing Table: 6248 RIPE Region origin ASes announcing only one prefix: 3338 RIPE Region transit ASes present in the Internet Routing Table: 1060 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 19 Number of RIPE addresses announced to Internet: 185679936 Equivalent to 11 /8s, 17 /16s and 64 /24s Percentage of available RIPE address space announced: 65.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6814 Total LACNIC prefixes after maximum aggregation: 2381 Prefixes being announced from the LACNIC address blocks: 6683 Unique aggregates announced from the LACNIC address blocks: 3987 LACNIC Region origin ASes present in the Internet Routing Table: 413 LACNIC Region origin ASes announcing only one prefix: 120 LACNIC Region transit ASes present in the Internet Routing Table: 80 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 16 Number of LACNIC addresses announced to Internet: 17302016 Equivalent to 1 /8s, 8 /16s and 2 /24s Percentage of available LACNIC address space announced: 51.6 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1323 Total AfriNIC prefixes after maximum aggregation: 700 Prefixes being announced from the AfriNIC address blocks: 866 Unique aggregates announced from the AfriNIC address blocks: 684 AfriNIC Region origin ASes present in the Internet Routing Table: 95 AfriNIC Region origin ASes announcing only one prefix: 24 AfriNIC Region transit ASes present in the Internet Routing Table: 13 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2102016 Equivalent to 0 /8s, 32 /16s and 19 /24s Percentage of available AfriNIC address space announced: 12.5 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 881 4596 171 Data Communications Bureau 1221 787 1184 562 Telstra Pty Ltd 4766 576 3415 278 Korea Internet Exchange for " 9583 573 48 11 Satyam Infoway Ltd., 4755 454 177 95 Videsh Sanchar Nigam Ltd. Aut 17676 393 5900 61 XTAGE CORPORATION 9443 362 71 77 Primus Telecommunications 2907 354 1856 327 SINET Japan 9929 345 164 35 China Netcom Corp. 703 325 344 255 UUNET 17557 304 22 149 Pakistan Telecom 10036 294 27 270 C&M Communication Co. Ltd. 7545 278 86 67 TPG Internet Pty Ltd 2764 276 255 223 connect.com.au pty ltd 7474 273 268 203 Optus Communications Pty Ltd 9800 238 383 76 CHINA UNICOM 4808 234 172 128 CHINANET core WAN North 9498 232 81 52 BHARTI BT INTERNET LTD. 4802 230 28 139 Wantree Development 7563 226 48 158 Korea Internet Infrastructure ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1441 6602 971 AT&T WorldNet Services 721 1103 21739 309 DLA Systems Automation Center 701 1060 8331 910 UUNET Technologies, Inc. 1239 920 2879 613 Sprint 2386 849 523 601 AT&T Data Communications Serv 6197 834 378 391 BellSouth Network Solutions, 4323 827 671 224 Time Warner Telecom 18566 765 208 6 Covad Communications 209 674 3438 509 Qwest 3356 597 10867 441 Level 3 Communications, LLC 20115 566 470 302 Charter Communications 3561 549 2370 416 Cable & Wireless USA 852 526 1126 400 Telus Advanced Communications 6478 486 818 100 AT&T Worldnet Services 27364 460 44 19 Armstrong Cable Services 6198 450 388 200 BellSouth Network Solutions, 7132 450 8379 379 SBC Internet Services 22773 431 1085 19 Cox Communications, Inc. Atla 5668 429 87 17 Century Telephone 22909 418 915 65 Comcast Cable Corporation RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 620 2022 512 UUNET - Commercial IP service 3320 294 2992 228 Deutsche Telekom AG 3301 287 1112 275 TeliaNet Sweden 8220 279 466 267 COLT Internet - International 21502 276 40 3 NUMERICABLE is a cabled netwo 680 253 2041 239 DFN-IP service G-WiN 3246 226 487 221 Song Networks 13083 217 51 8 Mannesmann Datenverarbeitung 8708 207 119 188 Romania Data Systems S.A. 1257 205 708 171 SWIPnet Swedish IP Network 5515 191 842 138 Sonera Solution Autonomous Sy 3215 186 1022 79 France Telecom Transpac 786 176 1794 176 The JANET IP Service 6746 174 47 139 Dynamic Network Technologies, 8866 165 19 22 Bulgarian Telecommunication C 3269 159 1360 70 TELECOM ITALIA 719 158 322 104 LANLINK autonomous system 3300 158 165 80 AUCS Communications Services 25186 142 138 100 France Telecom Transpac's Tra 5400 137 217 121 BT Ignite European Backbone LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6140 356 140 69 ImpSat 8151 335 489 142 UniNet S.A. de C.V. 16814 234 14 6 NSS, S.A. 11172 217 99 54 Servicios Alestra S.A de C.V 6147 189 102 20 Telefonica Del Peru 11664 159 19 24 Keytech SA 7303 149 68 22 Telecom Argentina Stet-France 6505 136 90 92 Global One Communicaoes Ltda 6503 125 147 83 AVANTEL, S.A. 14117 114 7 5 Telefonica del Sur S.A. 11992 106 9 31 Integrated Systems 11556 97 48 3 Cable-Wireless Panama 13999 89 52 9 Mega Cable S.A. de C.V. 11311 86 8 22 Sinectis S.A. 6535 85 7 23 Chilesat Servicios Empresari 14420 85 6 40 ANDINATEL S.A. 10481 82 32 7 Prima S.A. 4270 80 18 9 Red de Interconexion Universi 5639 79 8 8 Telecommunications Services o 15311 78 25 37 Telefonica Empresas AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 268 636 226 The Internet Solution 5536 113 16 4 Internet Egypt Network 2018 102 297 98 Tertiary Education Network 2905 77 272 70 The Internetworking Company o 20928 77 16 2 Noor Advanced Technologies AS 24835 55 34 7 RAYA Telecom - Egypt 8452 47 20 5 TEDATA 6713 34 38 9 Itissalat Al-MAGHRIB 9129 33 3 2 UUNET Kenya 12455 28 7 4 Jambonet Autonomous system 5713 27 141 24 Telkom SA Ltd 8524 23 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 21280 18 2 3 Swift Global Kenya Ltd.Is an 8346 15 7 14 SONATEL-AS Autonomous System 15706 15 4 2 Sudatel Internet Exchange Aut 21491 15 1 3 UTL On-line is RF broadband I 15808 13 1 2 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 721 1103 794 DLA Systems Automation Center 18566 765 759 Covad Communications 4134 881 710 Data Communications Bureau 4323 827 603 Time Warner Telecom 9583 573 562 Satyam Infoway Ltd., 6197 834 443 BellSouth Network Solutions, 27364 460 441 Armstrong Cable Services 22773 431 412 Cox Communications, Inc. Atla 5668 429 412 Century Telephone 6478 486 386 AT&T Worldnet Services 4755 454 359 Videsh Sanchar Nigam Ltd. Aut 22909 418 353 Comcast Cable Corporation 6467 372 341 E.Spire Communications, Inc. 17676 393 332 XTAGE CORPORATION 1580 334 318 ANOSCEUR 9929 345 310 China Netcom Corp. 1239 920 307 Sprint 13609 334 299 Choice One Communications Inc 4766 576 298 Korea Internet Exchange for " 6140 356 287 ImpSat List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64826 PRIVATE 64.200.250.0/23 7911 Williams Communicati 26422 UNALLOCATED 196.46.184.0/22 3741 The Internet Solutio 65002 PRIVATE 208.179.184.0/24 11509 The Pajo Group 65529 PRIVATE 216.21.199.0/24 14697 VDot.Net 65529 PRIVATE 216.152.237.0/24 14697 VDot.Net Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:7 /11:15 /12:60 /13:143 /14:314 /15:575 /16:8256 /17:2381 /18:4070 /19:9997 /20:10520 /21:8305 /22:11560 /23:12891 /24:84836 /25:443 /26:366 /27:127 /28:62 /29:35 /30:127 /31:0 /32:45 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 750 765 Covad Communications 6197 680 834 BellSouth Network Solutions, 2386 622 849 AT&T Data Communications Serv 7018 610 1441 AT&T WorldNet Services 27364 445 460 Armstrong Cable Services 9583 400 573 Satyam Infoway Ltd., 4766 393 576 Korea Internet Exchange for " 702 379 620 UUNET - Commercial IP service 5668 370 429 Century Telephone 1239 366 920 Sprint 6198 327 450 BellSouth Network Solutions, 1580 320 334 ANOSCEUR 10036 294 294 C&M Communication Co. Ltd. 13609 291 334 Choice One Communications Inc 6467 283 372 E.Spire Communications, Inc. 6517 283 306 Yipes Communications, Inc. 4323 278 827 Time Warner Telecom 21502 273 276 NUMERICABLE is a cabled netwo 9929 270 345 China Netcom Corp. 701 265 1060 UUNET Technologies, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:9 12:1479 13:1 15:6 16:2 17:3 18:4 20:4 24:832 32:69 33:3 38:90 40:55 44:3 47:2 52:3 55:2 56:3 57:23 59:2 60:12 61:672 62:516 63:1852 64:2549 65:2085 66:2544 67:485 68:492 69:877 70:54 71:2 72:41 80:547 81:665 82:397 83:229 84:89 85:79 128:121 129:167 130:89 131:193 132:36 134:202 135:30 136:419 137:78 138:162 139:40 140:301 141:102 142:136 143:120 144:250 145:45 146:281 147:201 148:264 149:130 150:93 151:62 152:113 153:71 154:2 155:136 156:70 157:75 158:149 159:162 160:65 161:59 162:410 163:84 164:213 165:155 166:128 167:224 168:375 169:131 170:323 171:8 192:5651 193:3048 194:2235 195:1564 196:598 198:3826 199:3298 200:3941 201:44 202:5159 203:5930 204:3579 205:2067 206:2270 207:2621 208:2110 209:3062 210:1544 211:734 212:1149 213:1268 214:237 215:31 216:3725 217:1076 218:187 219:131 220:338 221:79 222:73 End of report

17 years, 5 months

The Cidr Report

by cidr-report＠potaroo.net

This report has been generated at Fri Jan 21 21:44:23 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 14-01-05 149708 103062 15-01-05 149634 103087 16-01-05 149549 103118 17-01-05 149515 103257 18-01-05 149701 103146 19-01-05 149753 103186 20-01-05 149979 103368 21-01-05 150315 103512 AS Summary 18735 Number of ASes in routing system 7671 Number of ASes announcing only one prefix 1430 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 90147072 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 21Jan05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 151111 103498 47613 31.5% All ASes AS18566 765 7 758 99.1% CVAD Covad Communications AS4134 834 200 634 76.0% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 825 232 593 71.9% TWTC Time Warner Telecom AS721 1100 595 505 45.9% DNIC DoD Network Information Center AS27364 460 34 426 92.6% ARMC Armstrong Cable Services AS22773 429 19 410 95.6% CXA Cox Communications Inc. AS6197 829 452 377 45.5% BNS-14 BellSouth Network Solutions, Inc AS7018 1430 1085 345 24.1% ATTW AT&T WorldNet Services AS6478 486 146 340 70.0% ATTW AT&T WorldNet Services AS9929 342 35 307 89.8% CNCNET-CN China Netcom Corp. AS1239 919 613 306 33.3% SPRN Sprint AS17676 391 89 302 77.2% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS22909 418 125 293 70.1% CMCS Comcast Cable Communications, Inc. AS4766 560 278 282 50.4% KIXS-AS-KR Korea Telecom AS21502 276 3 273 98.9% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS14654 263 7 256 97.3% WAYPOR-3 Wayport AS9443 366 121 245 66.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS6140 377 134 243 64.5% IMPSA ImpSat AS4355 300 64 236 78.7% ERSD EARTHLINK, INC AS9583 572 340 232 40.6% SIFY-AS-IN Sify Limited AS25844 242 16 226 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS2386 848 626 222 26.2% ADCS-1 AT&T Data Communications Services AS6198 446 224 222 49.8% BNS-14 BellSouth Network Solutions, Inc AS15270 245 32 213 86.9% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. AS3602 302 106 196 64.9% SPCA Sprint Canada Inc. AS5668 429 235 194 45.2% CIH-12 CenturyTel Internet Holdings, Inc. AS1580 197 13 184 93.4% DNIC DoD Network Information Center AS6517 304 121 183 60.2% YIPS Yipes Communications, Inc. AS19632 191 9 182 95.3% Metropolis Intercom AS9498 234 54 180 76.9% BBIL-AP BHARTI BT INTERNET LTD. Total 15380 6015 9365 60.9% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.200.100.0/24 AS7018 ATTW AT&T WorldNet Services 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 201.239.0.0/16 AS22047 VTR BANDA ANCHA S.A. 202.72.240.0/20 AS24320 RAILCOM Mongolian Railway Commercial Center Railcom 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of BAYANTEL 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.29.168.0/21 AS10248 IPI Internet Partners, Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

17 years, 5 months

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

apops January 2005