nested prefixes in Internet

2016-09-27 Thread Martin T
Hi, let's assume that there is an ISP "A" operating in Europe region who has /19 IPv4 allocation from RIPE. From this /19 they have leased /24 to ISP "B" who is multi-homed. This means that ISP "B" would like to announce this /24 prefix to ISP "A" and also to ISP "C". AFAIK this gives two possibil

Re: nested prefixes in Internet

2016-10-05 Thread Martin T
: >>> >>> >>> >>> Option 3? >>> >>> ISP A announces the /19 and the /24 while ISP B does just the /24 >>> >>>> On 9/27/2016 4:20 AM, Martin T wrote: >>>> Hi, >>>> >>>> let's assume that the

Re: nested prefixes in Internet

2016-10-09 Thread Martin T
eeded. However, I would like to hear from Roy and Mel why do they prefer a third option where ISP A announces the /19 and the /24 while ISP B does just the /24. thanks, Martin On Wed, Oct 5, 2016 at 11:50 PM, Florian Weimer wrote: > * Martin T.: > >> Florian: >> >>> Are the au

Re: nested prefixes in Internet

2016-10-19 Thread Martin T
Hi, I made a drawing of those two best solutions: http://i.imgur.com/7NQVgUH.png As much as I understand, both solutions require no special changes from "ISP C". Only advantage of solution B over solution A, that I can see, is that at the time when link between "ISP C" and "ISP B" is up, the traf

Re: nested prefixes in Internet

2016-10-24 Thread Martin T
Thank you all for the replies! I'll go with the solution where "ISP A" announces both /19 prefix and /24 prefix. Martin On Thu, Oct 20, 2016 at 1:16 AM, Matt Buford wrote: > On Mon, Oct 10, 2016 at 2:44 PM, Baldur Norddahl > wrote: > > >> Is that a real problem? In my experience a /24 is honou

some shallow statistics about finding the name/netname for IP address using RDAP and WHOIS

2018-10-15 Thread Martin T
Hi! For testing a script I generated 1 random IPv4 and global unicast IPv6 addresses. For all those addresses I tried to find the netname/name attribute value from WHOIS servers using the latest version of https://github.com/rfc1036/whois and RDAP servers using the curl. Basically 'whois -H '

association between ASN and company name in ARIN region

2017-03-30 Thread Martin T
Hi, how to associate AS number with company name in ARIN region? For example in a small European country, where I leave, it can be done roughly like that: 1) ISP named "XYZ" and IP transit customer named "KLM Inc." sign an IP transit contract 2) IP transit customer "KLM Inc." tells to ISP that th

Re: association between ASN and company name in ARIN region

2017-04-03 Thread Martin T
Thanks for replies! Who is allowed to change "OrgName" attribute value? Only ARIN? thanks, Martin On Fri, Mar 31, 2017 at 11:59 AM, Florian Weimer wrote: > * Arnold Nipper: > >> On 30.03.2017 17:50, Martin T wrote: >> >>> Is it possible to make a sim

Are specific "route" objects in RIR databases needed?

2014-01-30 Thread Martin T
Hi, for example there is a small company with /22 IPv4 allocation from RIPE in European region. This company is dual-homed and would like to announce 4x /24 prefixes to both ISPs. Both ISP's update their prefix-lists automatically based on records in RIPE database. For example Level3 uses this pra

Re: Are specific "route" objects in RIR databases needed?

2014-01-30 Thread Martin T
then reject; } } PS: this is a theoretical question :) I'm also for keeping the BGP table as short as possible. regards, Martin On Thu, Jan 30, 2014 at 5:13 PM, Tore Anderson wrote: > * Job Snijders > > > On Thu, Jan 30, 2014 at 06:51:59PM +0200, Martin T wrot

RTT of ICMP "TTL exceeded" messages in Level3 network remains the same throughout the network

2014-08-13 Thread Martin T
Hi, if I make a traceroute to a host in San Jose in Level3 network from DigitalOcean server in Amsterdam, then in Level3 network(hop 6 in example below) the RTT remains the same: # traceroute -q 1 -I ZYNGA-INC.edge1.SanJose3.Level3.net traceroute to ZYNGA-INC.edge1.SanJose3.Level3.net (4.53.208.1

determine relationship between the operators based on import and export statements in aut-num object?

2014-11-25 Thread Martin T
Hi, bit weird question, but is it possible to determine relationship(Internet transit, settlement-free peering, etc) between the operators based on import and export statements in aut-num object? Often aut-num objects in RIR database contain the remarks which describe such relationships. However,

Re: determine relationship between the operators based on import and export statements in aut-num object?

2014-12-04 Thread Martin T
tools like RIPEstat BGPlay? thanks, Martin On 11/25/14, William Waites wrote: > On Tue, 25 Nov 2014 17:36:47 +0200, Martin T said: > > > Last but not least, maybe there is altogether a more reliable > > way to understand the relationship between the operators than >

correlation between ingress and egress traffic in case of volume-based DDoS

2015-09-23 Thread Martin T
Hi, volume-based DDoS attacks should often result with following bandwidth graphs: http://s12.postimg.org/gy3eps10t/volume_based_DDo_S_graph.png This is a fabricated bps graph for 100GigE port facing an uplink provider. As seen on the image, outgoing traffic drops at the time when incoming traf

strategies to mitigate DNS amplification attacks in ISP network

2015-12-01 Thread Martin T
Hi, as around 40% of ASNs allow at least partial IPv4 address spoofing in their network(http://spoofer.csail.mit.edu/summary.php) and there are around 30 million open-resolvers(http://openresolverproject.org/) in the Internet, then DNS amplification traffic is daily occasion for ISPs. This in prob

algorithm used by (RIPE region) ISPs to generate automatic BGP prefix filters

2016-02-04 Thread Martin T
Hi, am I correct that ISPs (in RIPE region), who update their BGP prefix filters automatically, ask their IP transit customer or peering partner to provide their "route"/"route6" object(s) or "as-set" object in order to find all the prefixes which they should accept? If the IP transit customer or

Re: common checks performed when passing on an IPv4 PA allocation from one end-customer to another

2016-02-22 Thread Martin T
trouble with those addresses. thanks, Martin On Tue, Apr 28, 2015 at 4:23 PM, Martin T wrote: > Colin, > > this is a good idea, but in this case the network I am interested in > does not have a RIPE Atlas probe. > > > regards, > Martin > > On 4/28/15, Colin Johns

(network)technologies used by NSA for data collection

2015-03-21 Thread Martin T
Hi, I watched "Citizenfour"(imdb.com/title/tt4044364/) documentary and at 41:12 Edward Snowden gives a brief overview of some of the leaked documents to journalists Glenn Greenwald and Ewen MacAskill. At 42:57 Snowden mentions devices which are able to collect data at rate of 1Tbps. This was in 20

Re: (network)technologies used by NSA for data collection

2015-03-22 Thread Martin T
tly from > multiple wavelengths or grey light simultaneously. > > Jason Bothe, Manager of Networking > > Rice University > > > o +1 713 348 5500 > > m +1 713 703 3552 > > ja...@rice.edu > > > On Mar 21, 2015, at 21:05, Martin T wrote: > &g

Re: common checks performed when passing on an IPv4 PA allocation from one end-customer to another

2015-04-28 Thread Martin T
of IP address? If yes, then is there an API to check if an address is allowed to use Google, Facebook, etc services or not? thanks, Martin On 9/17/13, Martin T wrote: > Hi, > > when one end-customer has been using for example /24 IPv4 allocation > for a while and returns this

Re: common checks performed when passing on an IPv4 PA allocation from one end-customer to another

2015-04-28 Thread Martin T
Colin, this is a good idea, but in this case the network I am interested in does not have a RIPE Atlas probe. regards, Martin On 4/28/15, Colin Johnston wrote: > > > >> On 28 Apr 2015, at 10:32, Martin T wrote: >> >> Hi, >> >> as far as I know

disadvantages of peering with own IP transit customers

2015-05-06 Thread Martin T
Hi, what are the disadvantages of peering(announcing own and all customers prefixes) with own IP transit customers? One disadvantage is obviously that amount of traffic on IP transit link is lower and thus customer pays for smaller amount of Mbps. On the other hand, this can be somewhat compensate

most accurate geo-IP source to build country-based access lists

2015-06-08 Thread Martin T
Hi, let's say that I need to build an ACL where I block all the IPv4 traffic from Sweden. I considered following solutions: 1) RIR statistics files(ftp://ftp.ripe.net/ripe/stats/RIR-Statistics-Exchange-Format.txt) accessible for example at ftp://ftp.apnic.net/pub/stats/. However, those files cont

Re: most accurate geo-IP source to build country-based access lists

2015-06-09 Thread Martin T
John, > At a brute force country level it is possible to use the Delegated > ranges lists but that runs into the problem where IP ranges are > subnetted and allocated to other countries. Yeah. In addition, to illustrate the point in my initial post, sometimes inetnum objects contain more than on

Is it possible to roughly estimate network traffic distribution for given ASN?

2015-08-13 Thread Martin T
Hi, there are various tools out there which show the prefix distribution among the peers/uplinks for given ASN. For example https://radar.qrator.net/as/graph#96311 or http://bgp.he.net/AS#_asinfo. As far as I know, those tools build the graphs mainly based on data from route servers. Am I

Re: Is it possible to roughly estimate network traffic distribution for given ASN?

2015-08-14 Thread Martin T
Thanks for confirming this! One last question- am I correct that those graphs referred in my initial e-mail indicate announced prefixes? Only way to have some insight about received prefixes for particular ASN is to check the RIR database aut-num object and hope that this is up-to-date and all the

How ISP's in ARIN region create automatic prefix-filters?

2013-06-12 Thread Martin T
Hi, as I understand, ARIN whois database does not contain "route" objects, which are used for example in RIPE region for automatic BGP prefix filter generation. How does this work in ARIN region? I know that at least some ISP's operating in ARIN region use their own whois databases(for example rr.

Re: How ISP's in ARIN region create automatic prefix-filters?

2013-06-16 Thread Martin T
uldn't most ISP's in RIPE region use radb or their own whois database which mirrors all major IRR databases and thus rr.arin.net among the others? regards, Martin 2013/6/12 Joe Abley > > On 2013-06-12, at 13:38, Martin T wrote: > > > as I understand, ARIN whois databas

common practice for IP address announcement agreement if addresses belong to other ISP

2013-07-23 Thread Martin T
Hi, as probably many of you know, it's possible to create a route object to RIPE database for an address space which is allocated outside the RIPE region using the RIPE-NCC-RPSL-MNT maintainer object. For example an address space is from APNIC or ARIN region and AS is from RIPE region. However, wh

questions regarding prefix hijacking

2013-08-07 Thread Martin T
Hi, as probably many of you know, it's possible to create a "route" object to RIPE database for an address space which is allocated outside the RIPE region using the RIPE-NCC-RPSL-MNT maintainer object. For example an address space is from APNIC or ARIN region and AS is from RIPE region. For examp

Re: questions regarding prefix hijacking

2013-08-07 Thread Martin T
t; I think most of the folks on the list can attest to that. :-) > > - ferg > > > On Wed, Aug 7, 2013 at 1:20 AM, Martin T wrote: > >> Hi, >> >> as probably many of you know, it's possible to create a "route" object >> to RIPE database for an

Re: questions regarding prefix hijacking

2013-08-08 Thread Martin T
Saku, > In most cases upstream does not do any automatic prefix filter generation, > it's maybe somewhat popular in mid-sized european shops but generally not too > common. What do you mean? In most cases upstreams do not filter prefixes at all? > There is active on-going work to secure BGP

common method to count traffic volume on IX

2013-09-17 Thread Martin T
Hi, many Internet exchange points post publicly available graphs which describe aggregated traffic volumes on IX. For example: Netnod: http://www.netnod.se/ix-stats/sums/ AMS-IX: https://www.ams-ix.net/technical/statistics LINX: https://www.linx.net/pubtools/trafficstats.html Is there a common

common checks performed when passing on an IPv4 PA allocation from one end-customer to another

2013-09-17 Thread Martin T
Hi, when one end-customer has been using for example /24 IPv4 allocation for a while and returns this(for example changes an ISP) to LIR, then are there some good practices before handing out this same /24 to a new customer? I guess LIR should: 1) remove all the DNS PTR records, classless of clas

Re: common method to count traffic volume on IX

2013-09-17 Thread Martin T
Thanks for all the replies! Nick, counting traffic on inter-switch links is kind of cheating, isn't it? I mean if "input bytes" and "output bytes" on all the ports facing the IX members are already counted, then counting traffic on links between the switches in fabric will count some of the traf