/24s run amuck... again

Fri Jul 19 05:15:55 UTC 2002

With all the recent talk about filtering, I figured now was a good time
to update my list of evil /24 announcers... There are currently over 63k
/24s out of 113k total unfiltered announcements (over 55%).

http://www.e-gerbil.net/ras/projects/ipaddr/amuck-071902.txt

This scan is done from the point of view of Williams (AS7911) transit, a 
fairly "average" unfiltered view of around 113k routes. It's not perfect, 
but it's pretty easy to go down the list and verify which ones are really 
poluting the internet.

The reason these don't get picked up on other peoples "cidr scans" is 
that they have "gaps", so they are not perfectly cidr-able. The reasons 
for these announcements vary, including obvious incompetence and 
cable/dsl companies without a "backbone" connecting their various POPs 
announcing a /24 for each location to a single transit provider.

If I had more free time I would extend this analysis past /24s, but since 
they're such a huge amount of polution it's a good place to start. If 
someone wanted to do an analysis of routes from a common block with 
identical attributes, I suspect they would find it a bigger cause of net 
polution than multihomers punching holes.

For quick complaining, the top 10 offenders are:

ASN    Name                                Reg'd Netblock   Prefixes
---    ----                                --------------   --------
6595   DoD Dependents Schools - Europe     204.218.0.0/15   236
22927  TELEFONICA DE ARGENTINA             168.226.0.0/16   167
7029   Alltel Information Services         166.102.0.0/16   128
7303   Telecom Argentina Stet-France       200.43.0.0/16    127
14654  Wayport                             64.134.0.0/16    113
16473  Bell South                          198.146.0.0/16   111
11492  Cable One                           24.116.0.0/16    108
18687  MPower Communications               208.57.0.0/16    98
7132   Southwestern Bell                   207.193.0.0/16   89
1580   Army HQ, 5th Signal Command         144.170.0.0/16   88

-- 
Richard A Steenbergen <ras at e-gerbil.net>       http://www.e-gerbil.net/ras
PGP Key ID: 0x138EA177  (67 29 D7 BC E8 18 3E DA  B2 46 B3 D8 14 36 FE B6)