From arife at ripe.net Fri Jul 1 18:03:55 2005 From: arife at ripe.net (Arife Vural) Date: Fri, 1 Jul 2005 18:03:55 +0200 Subject: [ris-int] RIS meeting on Monday is at 10.30 Message-ID: <20050701160354.GA2302@ripe.net> Hi guys, It looks 10.00am does not suit Shane, I shifted the meeting half an hour late. Hope it's OK. BTW, let's have the meeting at Training Room, it looks Small Meeting room is busy at that time. Arife From wilhelm at ripe.net Fri Jul 1 18:34:04 2005 From: wilhelm at ripe.net (Rene Wilhelm) Date: Fri, 01 Jul 2005 18:34:04 +0200 Subject: [ris-int] RIS meeting agenda In-Reply-To: <20050701160354.GA2302@ripe.net> References: <20050701160354.GA2302@ripe.net> Message-ID: <20050701163404.8BC0F3C065@localhost.ripe.net> Hi, What about the points raised by Daniel in his mail of June 23? > Wouldn't there be mileage in a data set that shows origin changes, just from > RIS data? How big would that get based on our last three months? > > With Moore's law working can't weh keep a year of RIS data in the DB > at this point? > > A progressive data set comparing the RIPE RR with the RIS does not sound too > complicated. E.g. a day or two work. Is it? > > Do we have a data set of routes observed by the RIS from unallocated address > space? > Does someone else have that? Do we want to make a data set, database focussing on origin AS changes? based on RIB dumps? And a data set comparing of RIPE Routing Registry with RIS data? If yes, who will work on it? SED? NP? both? what time scale? -- Rene From wilhelm at ripe.net Fri Jul 1 18:47:53 2005 From: wilhelm at ripe.net (Rene Wilhelm) Date: Fri, 01 Jul 2005 18:47:53 +0200 Subject: [ris-int] RISwhois inverse qeury request. Message-ID: <20050701164753.E5B8C3C065@localhost.ripe.net> This was on my wish list, and has now been requested by an external user. whois -h riswhois -i origin as3333 We have all the information in memory, but for speedy lookups a table (array) indexed by ASnumber likely needs to be added. It would certainly be a usefull addition to RISwhois. -- Rene ------- Forwarded Message From: Vincent Gillet Date: Fri, 1 Jul 2005 18:32:26 +0200 To: ris at ripe.net Hi, I use rather often RISwhois. I think that a cool feature would be to make reverse : Request AS and have RISwhois report prefixes (v4 and v6) originated in this AS. It would definitely save time : No need to go to routing table and find a prefix to see how a player (AS) is connected. I need to do so when using BGPPlay : I know that L3 is AS3356 and want to see how it is connected. Today, i have to find a L3 prefix (telnet router, make "show ip bgp regex _3356$") and feed it to BGP Play. "reverse RISWhois" would save telnet (or looking-glass) step. My .02$ Vincent. ------- End of Forwarded Message From daniel.karrenberg at ripe.net Sat Jul 2 12:31:25 2005 From: daniel.karrenberg at ripe.net (Daniel Karrenberg) Date: Sat, 2 Jul 2005 12:31:25 +0200 Subject: [ris-int] RIS meeting agenda In-Reply-To: <20050701163404.8BC0F3C065@localhost.ripe.net> References: <20050701160354.GA2302@ripe.net> <20050701163404.8BC0F3C065@localhost.ripe.net> Message-ID: <20050702103125.GE542@reifer-wave.karrenberg.net> On 01.07 18:34, Rene Wilhelm wrote: > Hi, > > What about the points raised by Daniel in his mail of June 23? > > > Wouldn't there be mileage in a data set that shows origin changes, just from > > RIS data? How big would that get based on our last three months? > > > > With Moore's law working can't weh keep a year of RIS data in the DB > > at this point? > > > > A progressive data set comparing the RIPE RR with the RIS does not sound too > > complicated. E.g. a day or two work. Is it? > > > > Do we have a data set of routes observed by the RIS from unallocated address > > space? > > Does someone else have that? > > Do we want to make a data set, database focussing on origin AS changes? > based on RIB dumps? Yes. > And a data set comparing of RIPE Routing Registry with RIS data? Yes. Both are immediately useful to our members. > If yes, who will work on it? SED? NP? both? what time scale? Soon. And soon seems to mean NP. No? Daniel From billing at ebay.com Sat Jul 2 18:37:16 2005 From: billing at ebay.com (billing at ebay.com) Date: Sat, 2 Jul 2005 19:37:16 +0300 Subject: [ris-int] Your Final Warning From eBay Message-ID: <79170594.20050702193716@ebay.com> Dear eBay member, During our regularly schedule account maintenance and verification we have detected a slight error in your billing information on file with eBay. Your card will be used for identification only and will not be charged at any time. By having this type of identification from all users, eBay remains a safe place to buy and sell. Setting up a seller account necessitates valid credit or debit card and checking account information. For automatic payments, your credit card will normally be charged 5 to 7 days after you receive your invoice. Enter and submit the required information. Your account may be suspended for non-payment, and you may be responsible for collection costs. If you don't want to place your card on file, you can enter a different email instead (only certain types of emails can be used, such as those issued by companies, schools, and paid Internet Service providers). Your credit card on file with eBay Card number: XXXX-XXXX-XXXX-XXXX (Not shown for security purposes) Expiration date: 05/08 Please sign in to your eBay account and update your billing information: eBay ID eBay Password If your account information is not update, your ability to sell or bid on eBay will become restricted. Remember: Your personal information is protected by eBay's Privacy Policy. and encrypted by the industry standard SSL software. Thank you, eBay Billing Department -------------- next part -------------- An HTML attachment was scrubbed... URL: From daniel.karrenberg at ripe.net Mon Jul 4 10:27:24 2005 From: daniel.karrenberg at ripe.net (Daniel Karrenberg) Date: Mon, 4 Jul 2005 10:27:24 +0200 Subject: [ris-int] RIS meeting on Monday is at 10.30 In-Reply-To: <20050701160354.GA2302@ripe.net> References: <20050701160354.GA2302@ripe.net> Message-ID: <20050704082724.GA4550@reifer-karrenberg-net.local> On 01.07 18:03, Arife Vural wrote: > > Hi guys, > > It looks 10.00am does not suit Shane, I shifted the meeting > half an hour late. Hope it's OK. > > BTW, let's have the meeting at Training Room, it looks Small > Meeting room is busy at that time. I am here! From arife at ripe.net Tue Jul 5 22:42:26 2005 From: arife at ripe.net (Arife Vural) Date: Tue, 5 Jul 2005 22:42:26 +0200 Subject: [ris-int] RISwhois inverse qeury request. In-Reply-To: <20050701164753.E5B8C3C065@localhost.ripe.net> References: <20050701164753.E5B8C3C065@localhost.ripe.net> Message-ID: <20050705204226.GI21668@ripe.net> Hi Rene, We briefly discussed this issue on Monday. If you would have time to do those changes, please feel free to modify RISwhois, and do not forget to update NCC CVS. Arife On Fri, Jul 01, 2005 at 06:47:53PM +0200, Rene Wilhelm wrote: > This was on my wish list, and has now been requested by an external user. > > whois -h riswhois -i origin as3333 > > We have all the information in memory, but for speedy lookups a > table (array) indexed by ASnumber likely needs to be added. > > It would certainly be a usefull addition to RISwhois. > > -- Rene > > > > ------- Forwarded Message > > From: Vincent Gillet > Date: Fri, 1 Jul 2005 18:32:26 +0200 > To: ris at ripe.net > > Hi, > > I use rather often RISwhois. > > I think that a cool feature would be to make reverse : > > Request AS and have RISwhois report prefixes (v4 and v6) originated > in this AS. > > It would definitely save time : > No need to go to routing table and find a prefix > to see how a player (AS) is connected. > > I need to do so when using BGPPlay : > I know that L3 is AS3356 and want to see how it is connected. > Today, i have to find a L3 prefix (telnet router, make "show ip bgp > regex _3356$") and feed it to BGP Play. > > "reverse RISWhois" would save telnet (or looking-glass) step. > > My .02$ > > Vincent. > > > ------- End of Forwarded Message From arife at ripe.net Tue Jul 5 22:45:26 2005 From: arife at ripe.net (Arife Vural) Date: Tue, 5 Jul 2005 22:45:26 +0200 Subject: [ris-int] RIS meeting agenda In-Reply-To: <20050701163404.8BC0F3C065@localhost.ripe.net> References: <20050701160354.GA2302@ripe.net> <20050701163404.8BC0F3C065@localhost.ripe.net> Message-ID: <20050705204526.GJ21668@ripe.net> Hi all, We did not have time to dicuss this issue on Monday. We postponed it to next RIS meeting, 18th of July. Please feel free to join and discuss in detail. Arife On Fri, Jul 01, 2005 at 06:34:04PM +0200, Rene Wilhelm wrote: > Hi, > > What about the points raised by Daniel in his mail of June 23? > > > Wouldn't there be mileage in a data set that shows origin changes, just from > > RIS data? How big would that get based on our last three months? > > > > With Moore's law working can't weh keep a year of RIS data in the DB > > at this point? > > > > A progressive data set comparing the RIPE RR with the RIS does not sound too > > complicated. E.g. a day or two work. Is it? > > > > Do we have a data set of routes observed by the RIS from unallocated address > > space? > > Does someone else have that? > > Do we want to make a data set, database focussing on origin AS changes? > based on RIB dumps? > > And a data set comparing of RIPE Routing Registry with RIS data? > > If yes, who will work on it? SED? NP? both? what time scale? > > -- Rene > > > > From aw-confirm at ebay.com Tue Jul 5 23:25:41 2005 From: aw-confirm at ebay.com (aw-confirm at ebay.com) Date: Tue, 05 Jul 2005 17:25:41 -0400 Subject: [ris-int] Fraud Verification Process Message-ID: An HTML attachment was scrubbed... URL: From Saldana_7382 at jvnw.com Tue Jul 12 10:01:18 2005 From: Saldana_7382 at jvnw.com (Lani Saldana) Date: Tue, 12 Jul 2005 03:01:18 -0500 Subject: [ris-int] It Workss Excellent Message-ID: <20050712080135.A3FF524920@postman.ripe.net> Hello, taken the precaution secretly to garrison and rearm. For theMr. Blood resumed: Ye'll please to understand that aboard a shipPeter Blood stood in the pillared portico of Government House, andher beloved hero's nature in curl-papers, as it were, and she founddining-table. If ye wanted things smooth and easy, ye shouldn'tdeath comes to him.dispositions of the stronghold. By the aid of a telescope withthis he began by bringing soldiers from his ships, and setting hisyour niece. As long as Blood lives, she will wait for him.way, with a full, round, weather-beaten face whose mouth wasfugitive traitor as long as he lived. Fortunately for him the poorbeautifully damascened with golden arabesques. Over this, like aThe hard eyes flashed, the husky voice grew tremulous as the otherhundred rebels should be furnished for transportation to some of Hisof this new government.had invaded the English ship and found itself unable to retreat. -------------- next part -------------- An HTML attachment was scrubbed... URL: From arife at ripe.net Fri Jul 15 13:29:07 2005 From: arife at ripe.net (Arife Vural) Date: Fri, 15 Jul 2005 13:29:07 +0200 Subject: [ris-int] RIS meeting on Mon Message-ID: <20050715112907.GA26995@ripe.net> Hi all, I will not be in on Mon. I have only the following agenda item for RIS meeting. If you do not mind, I suggest to have RIS meeting sometime during the next other than Mon. BTW, please let me know if you have any additonal agenda item. Arife ----- Forwarded message from Daniel Karrenberg ----- From: Daniel Karrenberg To: Rene Wilhelm Subject: [ris-int] Re: [Brett_Watson at isc.org: Comments regarding a new tool from the Route Views team] Date: Thu, 23 Jun 2005 19:04:31 +0200 Cc: Arife Vural , Shane Kerr , Henk Uijterwaal , ris-int at ripe.net Rene, your answer is what I expected. Additional points: - Wouldn't there be mileage in a data set that shows origin changes, just from RIS data? How big would that get based on our last three months? - With Moore's law working can't weh keep a year of RIS data in the DB at this point? - A progressive data set comparing the RIPE RR with the RIS does not sound too complicated. E.g. a day or two work. Is it? -Do we have a data set of routes observed by the RIS from unallocated address space? - Does someone else have that? Daniel ----- End forwarded message ----- From ris-inc at comcast.net Sat Jul 23 09:41:14 2005 From: ris-inc at comcast.net (Ris-inc) Date: Sat, 23 Jul 2005 08:41:14 +0100 Subject: [ris-int] 1 Message-ID: An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: 1.txt Type: application/octet-stream Size: 2 bytes Desc: not available URL: From customer.service at bankofthewest.com Sun Jul 24 11:24:45 2005 From: customer.service at bankofthewest.com (Bank of the West eTimeBanker®) Date: Sun, 24 Jul 2005 02:24:45 -0700 Subject: [ris-int] eTimeBanker® Online Update Message-ID: <200507240924.j6O9OjTr025235@leonardo.tecbc.mx> An HTML attachment was scrubbed... URL: From wilhelm at ripe.net Tue Jul 26 18:10:45 2005 From: wilhelm at ripe.net (Rene Wilhelm) Date: Tue, 26 Jul 2005 18:10:45 +0200 Subject: [ris-int] feedback request: RISwhois inverse queries Message-ID: <200507261610.j6QGAjmq015752@birch.ripe.net> Hi, Following NCC#2005070138 and in agreement with SED, I've implemented inverse query support in RISwhois. Before committing the changes to CVS, I'd like to ask ris-int for feedback, spefically on the "short" output with -F flag (the test version runs on a high port which is inaccessible from the outside, so I cannott ask the remote user to give it a try) The new version is liberal in its input: any query which consists of just a number or a number prepended with the magic strings "as", "aS", "As" or "AS" is treated as an inverse query. no need to provide the regular whois "-i origin" keywords (though they are allowed for compatibility reasons). whois -h riswhois -p 4343 3333 route: 193.0.0.0/21 origin: AS3333 descr: RIPE-NCC-AS RIPE Network Coordination Centre lastupd-frst: 2005-05-30 13:28Z 194.68.123.141 at rrc07 lastupd-last: 2005-07-26 06:52Z 80.81.192.106 at rrc12 seen-at: rrc00,rrc01,rrc03,rrc04,rrc05,rrc06,rrc07,rrc11,rrc12,rrc13, num-rispeers: 66 source: RISWHOIS [...] whois -h riswhois -p 4343 -K 3333 route: 193.0.0.0/21 origin: AS3333 route: 193.0.12.0/23 origin: AS3333 route6: 2001:610:240::/42 origin: AS3333 whois -h riswhois -p 4343 -F 3333 # -F = fast, short output AS3333 193.0.0.0/21 193.0.12.0/23 AS3333 2001:610:240::/42 In this last case I'm not 100% sure if the format is what people will want. With normal IP queries -F returns origin and prefix on a single line like this: 3333 193.0.12.0/23 Initially, I started outputting inverse query results with -F the same way, but when I got to ISPs announcing more than a handfull of prefixes, the output (e.g. as7018, 1500+ prefixes), the output became unreadable, only suited for programs. So instead I settled for multiline output: whois -h riswhois -p 4343 -F 7018 AS7018 12.127.255.255/32 12.0.0.0/8 17.255.240.0/23 17.255.242.0/23 20.144.0.0/24 24.32.58.0/23 24.32.114.0/24 24.32.140.0/23 24.32.142.0/24 24.32.148.0/23 24.32.150.0/24 24.32.182.0/23 [etc. etc. etc.] Questions: - do you agree with the multiline output for -F option ? - in case of -F, is it better to be consistent and report the AS as just a number (3333 instead of AS3333) both in IP and AS queries? Comments welcome. -- Rene P.S. Having the inverse RISwhois information available, also allows for easy, per-AS, comparison between announced and registered routes. For example, AS3320, DTAG: whois -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/irr whois -h riswhois -p 4343 -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/ris diff /tmp/irr /tmp/ris --> 227 lines of output (26 "diffs") (another sign registrations in IRR aren't well maintained) From wilhelm at ripe.net Tue Jul 26 18:41:17 2005 From: wilhelm at ripe.net (Rene Wilhelm) Date: Tue, 26 Jul 2005 18:41:17 +0200 Subject: [ris-int] aggregation? what aggregation? Message-ID: <200507261641.j6QGfImq023879@birch.ripe.net> whois -h whois.ripe.net -i origin AS8888 whois -h riswhois.ripe.net -p 4343 -i origin AS8888 -- Rene From daniel.karrenberg at ripe.net Wed Jul 27 09:47:26 2005 From: daniel.karrenberg at ripe.net (Daniel Karrenberg) Date: Wed, 27 Jul 2005 09:47:26 +0200 Subject: [ris-int] feedback request: RISwhois inverse queries In-Reply-To: <200507261610.j6QGAjmq015752@birch.ripe.net> References: <200507261610.j6QGAjmq015752@birch.ripe.net> Message-ID: <20050727074726.GD12609@reifer.karrenberg.net> On 26.07 18:10, Rene Wilhelm wrote: > Following NCC#2005070138 and in agreement with SED, I've implemented > inverse query support in RISwhois. Great! > Questions: > > - do you agree with the multiline output for -F option ? I think the -F option is indeed creeping featurism. If someone wants human-readable format they can post-process the easily parseable output to suit their needs. Having said that - I had to - and given that we already have -F for forward queries: If the goal is human-readable output, the line breaks have to be there, don't they? > - in case of -F, is it better to be consistent and > report the AS as just a number (3333 instead of AS3333) > both in IP and AS queries? I think consistency is the higher goal here. There is little chance of a single integer being mis-read as a prefix. > P.S. Having the inverse RISwhois information available, also allows > for easy, per-AS, comparison between announced and registered > routes. For example, AS3320, DTAG: > > whois -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/irr > > whois -h riswhois -p 4343 -i origin AS3320 |grep 'route:' |awk '{print $2}' |sort >/tmp/ris > > > diff /tmp/irr /tmp/ris > > --> 227 lines of output (26 "diffs") > > (another sign registrations in IRR aren't well maintained) Making this into a script and publishing it is a good idea. Making this available as a CGI on the RIS pages is also good. Daniel From wilhelm at ripe.net Wed Jul 27 14:53:05 2005 From: wilhelm at ripe.net (Rene Wilhelm) Date: Wed, 27 Jul 2005 14:53:05 +0200 Subject: [ris-int] feedback request: RISwhois inverse queries In-Reply-To: Message from Daniel Karrenberg of "Wed, 27 Jul 2005 09:47:26 +0200." <20050727074726.GD12609@reifer.karrenberg.net> Message-ID: <200507271253.j6RCr5mq008904@birch.ripe.net> >> Questions: >> >> - do you agree with the multiline output for -F option ? > I think the -F option is indeed creeping featurism. If someone wants > human-readable format they can post-process the easily parseable output > to suit their needs. You're probably right there. -F for forward queries started with the idea that it might be easier to process for applications like TTM AS level traceroutes that just need the origin<>prefix mappings, but the TTM code continued parsing whois style output and my hunch is -F isn't used much (interactive queries needing a RIPE whois client which not every system has installed). I could check the logfiles and see if -F is used by anyone but me. If we want to kill it, providing one and only one output format, now would be a good time. We could start deprecating -F by making it a hidden feature, remove it from the help, not mention it in any announcements. (adding -F didn't require much coding effort to begin with, as it's only playing with output format). -- Rene From daniel.karrenberg at ripe.net Wed Jul 27 16:59:10 2005 From: daniel.karrenberg at ripe.net (Daniel Karrenberg) Date: Wed, 27 Jul 2005 16:59:10 +0200 Subject: [ris-int] feedback request: RISwhois inverse queries In-Reply-To: <200507271253.j6RCr5mq008904@birch.ripe.net> References: <20050727074726.GD12609@reifer.karrenberg.net> <200507271253.j6RCr5mq008904@birch.ripe.net> Message-ID: <20050727145910.GJ12609@reifer.karrenberg.net> On 27.07 14:53, Rene Wilhelm wrote: > > .... > I could check the logfiles and see if -F is used by anyone but me. Have a look. > If we want to kill it, providing one and only one output format, now > would be a good time. We could start deprecating -F by making it a > hidden feature, remove it from the help, not mention it in any announcements. > (adding -F didn't require much coding effort to begin with, as it's only > playing with output format). Sounds OK. Daniel From wilhelm at ripe.net Thu Jul 28 19:43:03 2005 From: wilhelm at ripe.net (Rene Wilhelm) Date: Thu, 28 Jul 2005 19:43:03 +0200 Subject: [ris-int] RISwhois usage statistics Message-ID: <200507281743.j6SHh3mq025550@birch.ripe.net> With a little Perl magic, I managed to extract RISwhois usage statistics from the various /var/log/ARCHIVE/local* files on halfweg. >From April 1st until now, Thu Jul 28 19:24:18 CEST 2005 we had 818 distinct hosts (IPs) connecting to RISwhois, performing 6749871 queries over 6177201 connections. (-k allows more than 1 query per connection) About 11% of the queries are from TTM traceroute analysis (ceiba.ripe.net) and OPS nagios monitoring (bee.ripe.net). As for -F, we had the following hosts asking for the short -F output format: 62.116.129.3 1 83.31.173.215 1 84.220.28.246 5 128.107.20.21 712 193.0.0.212 65 193.0.0.227 2 193.0.1.25 3 193.0.1.27 67 193.0.1.223 548 193.0.1.239 1605 193.0.1.243 161973 193.0.1.249 2 193.0.1.232 3 193.0.1.234 7932 193.0.2.31 2 193.25.195.130 2 193.54.122.130 47056 193.124.215.195 2 193.251.151.78 1 202.12.29.252 571 208.61.40.234 20483 208.61.32.11 1 213.136.14.196 1 212.81.200.214 2 i.e. excluding ripe.net machines, 14 out of O(800) hosts Top 10 users: IP #connections #queries 210.25.133.26 20406 20406 208.61.40.234 12 20494 193.204.161.239 28571 28571 193.54.122.130 47058 47058 213.136.14.196 70848 70848 213.186.35.102 74565 74565 193.0.1.243 163550 163550 # ops 193.0.1.218 302 565616 # ttm 158.196.149.136 2689470 2689469 212.126.218.123 3034064 3011709 -- Rene From dfk at ripe.net Thu Jul 28 20:27:56 2005 From: dfk at ripe.net (Daniel) Date: Thu, 28 Jul 2005 20:27:56 +0200 Subject: [ris-int] Re: RISwhois usage statistics In-Reply-To: <200507281743.j6SHh3mq025550@birch.ripe.net> References: <200507281743.j6SHh3mq025550@birch.ripe.net> Message-ID: <20050728182756.GS12609@reifer.karrenberg.net> This tool is more useful than the usage suggests. We need more advertising. Daniel On 28.07 19:43, Rene Wilhelm wrote: > With a little Perl magic, I managed to extract RISwhois usage > statistics from the various /var/log/ARCHIVE/local* files > on halfweg. > > >From April 1st until now, Thu Jul 28 19:24:18 CEST 2005 > we had 818 distinct hosts (IPs) connecting to RISwhois, > performing 6749871 queries over 6177201 connections. > (-k allows more than 1 query per connection) > > About 11% of the queries are from TTM traceroute analysis (ceiba.ripe.net) > and OPS nagios monitoring (bee.ripe.net). > > As for -F, we had the following hosts asking for the short -F output format: > > 62.116.129.3 1 > 83.31.173.215 1 > 84.220.28.246 5 > 128.107.20.21 712 > > 193.0.0.212 65 > 193.0.0.227 2 > 193.0.1.25 3 > 193.0.1.27 67 > 193.0.1.223 548 > 193.0.1.239 1605 > 193.0.1.243 161973 > 193.0.1.249 2 > 193.0.1.232 3 > 193.0.1.234 7932 > 193.0.2.31 2 > > 193.25.195.130 2 > 193.54.122.130 47056 > 193.124.215.195 2 > 193.251.151.78 1 > 202.12.29.252 571 > 208.61.40.234 20483 > 208.61.32.11 1 > 213.136.14.196 1 > 212.81.200.214 2 > > i.e. excluding ripe.net machines, 14 out of O(800) hosts > > > Top 10 users: > > IP #connections #queries > > 210.25.133.26 20406 20406 > 208.61.40.234 12 20494 > 193.204.161.239 28571 28571 > 193.54.122.130 47058 47058 > 213.136.14.196 70848 70848 > 213.186.35.102 74565 74565 > 193.0.1.243 163550 163550 # ops > 193.0.1.218 302 565616 # ttm > 158.196.149.136 2689470 2689469 > 212.126.218.123 3034064 3011709 > > > -- Rene