NCC#2002092793 [ris-int] RIS hijacking 195.80.239.0/24
Rene Wilhelm wilhelm at ripe.net
Wed Jun 8 16:03:04 CEST 2005
Hi Arife,
I understand it's a difficult issue; fortunately we're left
with only 1 debogon prefix:
whois -h riswhois -F -M 87/8 |grep 12654
12654 87.255.248.0/21 1
The other one, 87.192.0.0/16, is now announced by AS25441 and seen
by 64 RIS peers. Perhaps all it takes to clear the bogus debogon
is for a new owner to insert a fresh announcement?
If you want to continue contacting every AS which according
to the routing tables sees the debogon route, you could
also check route-views' routers for info.
For example, @oregon-ix:
x27$ telnet route-views.oregon-ix.net
[...]
route-views.oregon-ix.net>sh ip bgp 87.255.248.0/21
BGP routing table entry for 87.255.248.0/21, version 60855137
Paths: (1 available, best #1, table Default-IP-Routing-Table)
Not advertised to any peer
3277 6820 3246 5400 5400 3257 28747 12654
194.85.4.55 from 194.85.4.55 (194.85.4.55)
Origin IGP, localpref 100, valid, external, best
Community: 3277:6820 3277:65361
Only the "5400 3257 28747 12654" part is in common with RIS,
the other ASNs are different.
Cheers,
-- Rene
> Hi Mike,
>
> I'm chasing those guys who still think we announce that prefix. But I have
> not got any useful info from them. Last, I contacted with AS9177, but I
> have not got any reply back.
>
> I attached the e-mail that I got from Tiscali, it looks this route still
> is hanging there because of a Cisco bug or maybe other vendor OS bugs.
> I do not know what else I could do be honest ...
>
> Arife
>
> --
>
> From: Alexander Koch <koch at tiscali.net>
> To: Arife Vural <arife at ripe.net>
> Subject: Re: Need a favor
> Message-ID: <20050608120049.GA21021 at shekinah.ip.tiscali.net>
> References: <20050608120017.GC22290 at ripe.net>
> Mime-Version: 1.0
> Content-Type: text/plain; charset=us-ascii
> Content-Disposition: inline
> In-Reply-To: <20050608120017.GC22290 at ripe.net>
> Organization: Tiscali International Network B.V.
> X-NCC-RegID: eu.nacnet
> User-Agent: Mutt/1.5.9i
> X-RIPE-Spam-Level:
> X-RIPE-Spam-Tests: BAYES_00
> X-RIPE-Spam-Status: U 0.298951 / -2.6
> X-RIPE-Signature: f24e950eeaafece3eb369dee26ae860b
> Status: RO
> Content-Length: 1707
> Lines: 50
>
> Hello Arife,
>
> what you see is probably comparable to IPv6 ghosts routes
> where a /35 more specific route sticked in the routing table
> long after it was theoretically withdrawn.
>
> We currently do not see the route from RealROOT, but then,
> AS28747 was changed to AS 9009 two weeks ago or so. Also
> seeing the AS path I believe you can safely assume AS5400
> (BT's backbone) is not seeing it either... your best bet
> might be to contact bgp at sunrise.net and/or AS9177 directly.
>
> Does that help?
>
> Best regards,
> Alexander
>
> On Wed, 8 June 2005 14:00:17 +0200, Arife Vural wrote:
> > Hi Alexander,
> >
> > Part of De-bogonising project we were announcing 87/8. We stopped it
> > for a while, but it's seen in routing tables. Be honest, I could not
> > explain why this route was still in the routing tables even if we do
> > not have any entries in our config file for that prefix.
> >
> > On rrc00, it's seen like that,
> >
> > rrc00> sh ip bgp 87.255.248.0/21
> > BGP routing table entry for 87.255.248.0/21
> > Paths: (1 available, best #1, table Default-IP-Routing-Table)
> > Not advertised to any peer
> > 9177 6730 5400 3257 28747 12654
> > 212.47.190.1 from 212.47.190.1 (213.193.66.42)
> > Origin IGP, localpref 100, valid, external, best
> > Last update: Wed Jun 8 10:20:46 2005
> >
> > I contacted with AS28747, but could not get any reply back to check
> > whether they get this prefix from us or not.
> >
> > I would like to ask you to check whether you get this prefix from AS28747.
> > If so, not sure but resetting the session with AS28747 would make any help?
> >
> > Kind regards.
> >
> > Arife
>
> --
> Alexander Koch <koch at tiscali.net> / ako4-ripe
> Tiscali Int., Peering Coordination
> Phone +49 6103 916 480, Fax +49 6103 916 464
>
> On Tue, Jun 07, 2005 at 10:13:17AM +0200, RIPE NCC Hostmaster wrote:
> > Dear Colleagues,
> >
> > It's quiet in this ticket for quite a while, while on the Net it's not
> > so quiet: the ranges are still (again?) announced and visible
> > (in case you don't know):
> >
> > route: 87.255.248.0/21
> > origin: AS12654
> > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project.
> > lastupd-frst: 2005-06-05 14:10Z 212.47.190.1 at rrc00
> > lastupd-last: 2005-06-05 14:10Z 212.47.190.1 at rrc00
> > seen-at: rrc00
> > num-rispeers: 1
> > source: RISWHOIS
> >
> > We are still curious when is it going to stop.
> >
> >
> > --
> > Sincerely,
> >
> > Mike Petuschak
> > RIPE NCC
> >
> >
> >
> > > Hi Arife,
> > >
> > > Thanks for the update.
> > >
> > > Today RISwhois only sees 1 (one) peer at rrc00 forwarding the
> > > old debogon announcments from 87/8:
> > >
> > > route: 87.192.0.0/16
> > > origin: AS12654
> > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project.
> > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1 at rrc00
> > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1 at rrc00
> > > seen-at: rrc00
> > > num-rispeers: 1
> > > source: RISWHOIS
> > >
> > > route: 87.255.248.0/21
> > > origin: AS12654
> > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project.
> > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1 at rrc00
> > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1 at rrc00
> > > seen-at: rrc00
> > > num-rispeers: 1
> > > source: RISWHOIS
> > >
> > >
> > > The last update is yesterday, 10:11 UTC (14:11 local time)
> > > is that when you reset the session with AS28747?
> > >
> > > -- Rene
[ Ris-int Archives ]