NCC#2002092793 [ris-int] RIS hijacking 195.80.239.0/24
Arife Vural arife at ripe.net
Wed Jun 8 15:11:35 CEST 2005
Hi Mike, I'm chasing those guys who still think we announce that prefix. But I have not got any useful info from them. Last, I contacted with AS9177, but I have not got any reply back. I attached the e-mail that I got from Tiscali, it looks this route still is hanging there because of a Cisco bug or maybe other vendor OS bugs. I do not know what else I could do be honest ... Arife -- From: Alexander Koch <koch at tiscali.net> To: Arife Vural <arife at ripe.net> Subject: Re: Need a favor Message-ID: <20050608120049.GA21021 at shekinah.ip.tiscali.net> References: <20050608120017.GC22290 at ripe.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050608120017.GC22290 at ripe.net> Organization: Tiscali International Network B.V. X-NCC-RegID: eu.nacnet User-Agent: Mutt/1.5.9i X-RIPE-Spam-Level: X-RIPE-Spam-Tests: BAYES_00 X-RIPE-Spam-Status: U 0.298951 / -2.6 X-RIPE-Signature: f24e950eeaafece3eb369dee26ae860b Status: RO Content-Length: 1707 Lines: 50 Hello Arife, what you see is probably comparable to IPv6 ghosts routes where a /35 more specific route sticked in the routing table long after it was theoretically withdrawn. We currently do not see the route from RealROOT, but then, AS28747 was changed to AS 9009 two weeks ago or so. Also seeing the AS path I believe you can safely assume AS5400 (BT's backbone) is not seeing it either... your best bet might be to contact bgp at sunrise.net and/or AS9177 directly. Does that help? Best regards, Alexander On Wed, 8 June 2005 14:00:17 +0200, Arife Vural wrote: > Hi Alexander, > > Part of De-bogonising project we were announcing 87/8. We stopped it > for a while, but it's seen in routing tables. Be honest, I could not > explain why this route was still in the routing tables even if we do > not have any entries in our config file for that prefix. > > On rrc00, it's seen like that, > > rrc00> sh ip bgp 87.255.248.0/21 > BGP routing table entry for 87.255.248.0/21 > Paths: (1 available, best #1, table Default-IP-Routing-Table) > Not advertised to any peer > 9177 6730 5400 3257 28747 12654 > 212.47.190.1 from 212.47.190.1 (213.193.66.42) > Origin IGP, localpref 100, valid, external, best > Last update: Wed Jun 8 10:20:46 2005 > > I contacted with AS28747, but could not get any reply back to check > whether they get this prefix from us or not. > > I would like to ask you to check whether you get this prefix from AS28747. > If so, not sure but resetting the session with AS28747 would make any help? > > Kind regards. > > Arife -- Alexander Koch <koch at tiscali.net> / ako4-ripe Tiscali Int., Peering Coordination Phone +49 6103 916 480, Fax +49 6103 916 464 On Tue, Jun 07, 2005 at 10:13:17AM +0200, RIPE NCC Hostmaster wrote: > Dear Colleagues, > > It's quiet in this ticket for quite a while, while on the Net it's not > so quiet: the ranges are still (again?) announced and visible > (in case you don't know): > > route: 87.255.248.0/21 > origin: AS12654 > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > lastupd-frst: 2005-06-05 14:10Z 212.47.190.1 at rrc00 > lastupd-last: 2005-06-05 14:10Z 212.47.190.1 at rrc00 > seen-at: rrc00 > num-rispeers: 1 > source: RISWHOIS > > We are still curious when is it going to stop. > > > -- > Sincerely, > > Mike Petuschak > RIPE NCC > > > > > Hi Arife, > > > > Thanks for the update. > > > > Today RISwhois only sees 1 (one) peer at rrc00 forwarding the > > old debogon announcments from 87/8: > > > > route: 87.192.0.0/16 > > origin: AS12654 > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > seen-at: rrc00 > > num-rispeers: 1 > > source: RISWHOIS > > > > route: 87.255.248.0/21 > > origin: AS12654 > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > seen-at: rrc00 > > num-rispeers: 1 > > source: RISWHOIS > > > > > > The last update is yesterday, 10:11 UTC (14:11 local time) > > is that when you reset the session with AS28747? > > > > -- Rene > > > > On Wed, 1 Jun 2005, Arife Vural wrote: > > > > > > > > Latest update about this issue: > > > > > > It looks only AS28747 is announcing prefixes from 87/8 even if we do not > > > announce it. I have contacted them to check out which prefixes they get > > > from us and also reset the session. > > > > > > I hope that help. > > > > > > I had a chat with james, that might be a bug on router software, not to > > > propogate the routes properly. But, still it does not explain how that > > > route got there. > > > > > > Arife > > > > > > On Tue, May 31, 2005 at 11:49:39AM +0200, Henk Uijterwaal wrote: > > > > Hi Mike, > > > > > > > > >Prefixes were removed that time, but then (after quite a long time) > > > > >re-inserted. > > > > > > > > Which is strange, right? > > > > > > > > >P.S. Actually, the agreement was that RS sends a message to james at ripe.net, > > > > >and dfk at ripe.net only, however we started CC'ing ris at ripe.net too as no one > > > > >was answering the messages. > > > > > > > > That is actually my problem ;-) I don't really care who is mailing who, > > > > but I do care if there is no follow-up on the mails. > > > > > > > > Henk > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > > Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net > > > > RIPE Network Coordination Centre http://www.amsterdamned.org/~henk > > > > P.O.Box 10096 Singel 258 Phone: +31.20.5354414 > > > > 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 > > > > The Netherlands The Netherlands Mobile: +31.6.55861746 > > > > ------------------------------------------------------------------------------ > > > > > > > > Look here junior, don't you be so happy. > > > > And for Heaven's sake, don't you be so sad. (Tom Verlaine) > > > > > >
[ Ris-int Archives ]