News for hackers. Stuff that matters.
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by zkms on Friday June 23, 2017 @02:58PM (#14621781)
This sort of endearing Internet-scale thing reminds me of how NTT changes their reverse DNS's (https://mailman.nanog.org/pipermail/nanog/2016-February/0841...). There's other vanity reverse-DNS tricks that you can see in traceroutes, but this is done with a global-scale IPv4/IPv6 network that actually is carrying a lot of customer traffic. Try "traceroute ntt.net" now, you'll see hops like:

9 ae-19.sayonara-todd.r04.sttlwa01.us.bb.gin.ntt.net (129.250.66.57) 17.225 ms 17.166 ms 17.171 ms

10 ae-5.sayonara-todd.r21.sttlwa01.us.bb.gin.ntt.net (129.250.2.7) 16.257 ms 16.156 ms 16.101 ms

11 ae-3.sayonara-todd.r23.snjsca04.us.bb.gin.ntt.net (129.250.3.124) 33.097 ms 33.125 ms 31.566 ms

12 ae-7.sayonara-todd.r23.dllstx09.us.bb.gin.ntt.net (129.250.4.155) 69.840 ms 69.764 ms 69.763 ms

13 ae-6.sayonara-todd.r10.dllstx09.us.bb.gin.ntt.net (129.250.5.4) 69.634 ms 74.424 ms 72.319 ms

14 ae-0.sayonara-todd.a01.dllstx09.us.bb.gin.ntt.net (129.250.3.244) 74.050 ms 74.046 ms 74.035 ms

or

3 ae-13.sayonara-todd.r05.plalca01.us.bb.gin.ntt.net (2001:418:0:5000::bae) 1.324 ms 1.307 ms 1.205 ms

4 ae-15.sayonara-todd.r02.snjsca04.us.bb.gin.ntt.net (2001:418:0:2000::172) 2.505 ms

5 ae-10.sayonara-todd.r23.snjsca04.us.bb.gin.ntt.net (2001:418:0:2000::cd) 2.091 ms 2.067 ms

6 ae-7.sayonara-todd.r23.dllstx09.us.bb.gin.ntt.net (2001:418:0:2000::1fa) 38.386 ms 39.757 ms 38.312 ms

7 ae-6.sayonara-todd.r10.dllstx09.us.bb.gin.ntt.net (2001:418:0:2000::1c1) 41.586 ms

8 ae-1.sayonara-todd.a02.dllstx09.us.bb.gin.ntt.net (2001:418:0:2000::135) 51.986 ms

Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by job on Friday June 23, 2017 @03:34PM (#14622094)
It might amuse you to know the same NTT people are behind the BGP Nyancat :-)
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by freetime2 on Saturday June 24, 2017 @07:07AM (#14625188)
Is this NTT as in "Nippon Telegraph and Telephone"? It's a surprising and welcome sight to see such shenanigans coming out of a Japanese mega corporation that used to be owned by the government, and now operations in a heavily regulated industry.
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by yusyusyus on Saturday June 24, 2017 @08:46AM (#14625406)
yes! It is probably more accurate to think of NTT as many smaller companies.

These guys are from GIN and are some of the best people I've had the pleasure of working with, both on a personal and professional level.

Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by mcescalante on Friday June 23, 2017 @03:48PM (#14622201)
I am amazed/fascinated by this! I would love to hear more for all the non-experts here about how the BGP Nyancat came to be :)
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by job on Friday June 23, 2017 @03:58PM (#14622267)
The starting point is a BMP file of the Nyan cat which is read into a simple two dimensional array by a small python script. The script looks at the current time and maps that to a column of pixels in the BMP. Each row of pixels in the BMP is represented by one IPv4 /24. If the pixel is "on" a BGP route announcement is generated, if the pixel is "off" the route is withdrawn. Each pixel in the BMP file represents 8 hours of announcing.
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by dsl on Friday June 23, 2017 @06:14PM (#14623175)
I'm curious how you handled the justification for the IP space to pull this off. ;)
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by pas on Friday June 23, 2017 @07:07PM (#14623419)
The prefixes are probably announced in aggregated form anyhow further upstream. The announcements and deannouncements are/were therefore redundant.

At least't that's my hunch. We could check the same monitor though :)

Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by jgg7 on Friday June 23, 2017 @09:31PM (#14623934)
AS15562 appears to be an employee of NTT out of the Netherlands. I can't tell if AS15562 is for personal or work, maybe both: http://bgp.he.net/AS15562

I couldn't care less about the IPv6 prefixes, but the IPv4 ones are all /24s made from 209.24.0.0/16, which is registered to NTT (AS2914). 209.24/16 is publicly announced (and has been for a very long time), and is routed through NTT Amsterdam routers.

I haven't looked at BGPlay to review all the data, but it looks like many of the /24s that make up that /16 were individually announced through AS15562, then later withdrawn, gradually over 4 months, to make said graph. I would hope this would be unused v4 space. That AS announced almost 98% of a /16 (probably 209.24/16): https://stat.ripe.net/AS15562#tabId=routing

Another user voiced their concerns, particularly if it was actively used: https://news.ycombinator.com/item?id=14621859 -- there's no way any of us could know this; NTT would be authoritative, and jwhois -h rwhois.gtt.net.net -p 4321 209.24.0.0/16 doesn't give any clues.

While the antic made me smirk, it doesn't (publicly) "look good" when we're living in a world that lacks (or has greatly limited) v4 space. What this says is: "NTT has a /16 they're fooling around with publicly", even though it (presumably) is harmless.

Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by zkms on Saturday June 24, 2017 @12:32AM (#14624368)
> it doesn't (publicly) "look good" when we're living in a world that lacks (or has greatly limited) v4 space. What this says is: "NTT has a /16 they're fooling around with publicly", even though it (presumably) is harmless.

NTT is one of the larger Tier 1 ISPs. Having some unused IPv4 address space is a good thing when you're such a huge network operator -- it means you can dedicate some globally-routed IPs for testing/prototyping/renumbering and also have some extra IP space for new devices. Given what happens to ISPs that run out of IPs, I am frankly glad NTT has enough free IPs to fool around with nyan cats.

If NTT was dragging its feet on IPv6, then yeah, such a stunt might look awkward, but NTT hasn't -- they've been on the forefront of IPv6 for a while. AFAICT they were the first to offer commercial IPv6 connectivity and their global IP network has been native IPv4/IPv6 since 2004, and anecdotally I see their routers in my IPv6 traceroutes all the time.

Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by viraptor on Saturday June 24, 2017 @05:31AM (#14625011)
> What this says is: "NTT has a /16 they're fooling around with publicly",

While this may be a lot for typical users, it's not huge for a large IT company. You know that HP has 2 /8s, right?

Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by jgg7 on Saturday June 24, 2017 @06:53AM (#14625166)
Yeah, I'm familiar with the original companies that have /8 allocations per IANA. I started using the 'net in 1989.

I'm also aware many of those places have either refused to relinquish space, or have done so but have no more to give back. Quoting Doug Barton, former manager at IANA, July 2015: "... Many orgs did give back space and/or swap allocations. But that well ran dry long ago" (if you need a reference link for that quote, let me know).

A recent example of relinquishing space is 18.0.0.0/8 (previously MIT) as of April 2017, which now has many /16 and /24 segments delegated to companies such as Comcast (ex. 18.10.0.0/16), Amazon (ex. 18.145.0.0/16), and Akamai (ex. 18.255.255.0/24), while many larger portions still reside with MIT (ex. 18.128.0.0/12, 18.0.0.0/9, 18.144.0.0/16).

My point of giving examples: note all the /16s. If you need further examples, refer to IANA's Recovered Address Space document and note the subnet sizes (many are much smaller than a /16): https://www.iana.org/assignments/ipv4-recovered-address-spac...

Every little bit counts.

Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by job on Friday June 23, 2017 @03:53PM (#14622231)
On April 1st 2015 I tried to create new poems by remixing an existing body of work through reverse DNS: https://bandaancha.eu/foros/april-fools-ntt-1717230 - the original was better perhaps ;-)
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by zkms on Friday June 23, 2017 @04:31PM (#14622511)
I like it a lot. There's something quite endearing about seeing human-legible text (beyond city names / interface names) in reverse DNS.
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by loeg on Friday June 23, 2017 @03:33PM (#14622090)
What about those domains says vanity reverse DNS to you? They look like bog standard location-named routers to me.
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by stedaniels on Friday June 23, 2017 @03:40PM (#14622130)
"Sayonara Todd" ... Goodbye Todd
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by loeg on Friday June 23, 2017 @04:14PM (#14622387)
Who is Todd?
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by vertex-four on Saturday June 24, 2017 @06:26AM (#14625111)
Click the mailman link - Todd will be an engineer who left the company.
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by broknbottle on Friday June 23, 2017 @03:42PM (#14622142)
Sayonara Todd
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by tbodt on Friday June 23, 2017 @03:07PM (#14621868)
traceroute bad.horse
Re:After 3072 hours of manipulating BGP, a Nyancat was drawn... by shmageggy on Friday June 23, 2017 @03:21PM (#14621991)
I needed `-m 50` to get it all