NCC#2002092793 [ris-int] RIS hijacking 195.80.239.0/24
Rene Wilhelm wilhelm at ripe.net
Wed Jun 8 16:03:04 CEST 2005
Hi Arife, I understand it's a difficult issue; fortunately we're left with only 1 debogon prefix: whois -h riswhois -F -M 87/8 |grep 12654 12654 87.255.248.0/21 1 The other one, 87.192.0.0/16, is now announced by AS25441 and seen by 64 RIS peers. Perhaps all it takes to clear the bogus debogon is for a new owner to insert a fresh announcement? If you want to continue contacting every AS which according to the routing tables sees the debogon route, you could also check route-views' routers for info. For example, @oregon-ix: x27$ telnet route-views.oregon-ix.net [...] route-views.oregon-ix.net>sh ip bgp 87.255.248.0/21 BGP routing table entry for 87.255.248.0/21, version 60855137 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 3277 6820 3246 5400 5400 3257 28747 12654 194.85.4.55 from 194.85.4.55 (194.85.4.55) Origin IGP, localpref 100, valid, external, best Community: 3277:6820 3277:65361 Only the "5400 3257 28747 12654" part is in common with RIS, the other ASNs are different. Cheers, -- Rene > Hi Mike, > > I'm chasing those guys who still think we announce that prefix. But I have > not got any useful info from them. Last, I contacted with AS9177, but I > have not got any reply back. > > I attached the e-mail that I got from Tiscali, it looks this route still > is hanging there because of a Cisco bug or maybe other vendor OS bugs. > I do not know what else I could do be honest ... > > Arife > > -- > > From: Alexander Koch <koch at tiscali.net> > To: Arife Vural <arife at ripe.net> > Subject: Re: Need a favor > Message-ID: <20050608120049.GA21021 at shekinah.ip.tiscali.net> > References: <20050608120017.GC22290 at ripe.net> > Mime-Version: 1.0 > Content-Type: text/plain; charset=us-ascii > Content-Disposition: inline > In-Reply-To: <20050608120017.GC22290 at ripe.net> > Organization: Tiscali International Network B.V. > X-NCC-RegID: eu.nacnet > User-Agent: Mutt/1.5.9i > X-RIPE-Spam-Level: > X-RIPE-Spam-Tests: BAYES_00 > X-RIPE-Spam-Status: U 0.298951 / -2.6 > X-RIPE-Signature: f24e950eeaafece3eb369dee26ae860b > Status: RO > Content-Length: 1707 > Lines: 50 > > Hello Arife, > > what you see is probably comparable to IPv6 ghosts routes > where a /35 more specific route sticked in the routing table > long after it was theoretically withdrawn. > > We currently do not see the route from RealROOT, but then, > AS28747 was changed to AS 9009 two weeks ago or so. Also > seeing the AS path I believe you can safely assume AS5400 > (BT's backbone) is not seeing it either... your best bet > might be to contact bgp at sunrise.net and/or AS9177 directly. > > Does that help? > > Best regards, > Alexander > > On Wed, 8 June 2005 14:00:17 +0200, Arife Vural wrote: > > Hi Alexander, > > > > Part of De-bogonising project we were announcing 87/8. We stopped it > > for a while, but it's seen in routing tables. Be honest, I could not > > explain why this route was still in the routing tables even if we do > > not have any entries in our config file for that prefix. > > > > On rrc00, it's seen like that, > > > > rrc00> sh ip bgp 87.255.248.0/21 > > BGP routing table entry for 87.255.248.0/21 > > Paths: (1 available, best #1, table Default-IP-Routing-Table) > > Not advertised to any peer > > 9177 6730 5400 3257 28747 12654 > > 212.47.190.1 from 212.47.190.1 (213.193.66.42) > > Origin IGP, localpref 100, valid, external, best > > Last update: Wed Jun 8 10:20:46 2005 > > > > I contacted with AS28747, but could not get any reply back to check > > whether they get this prefix from us or not. > > > > I would like to ask you to check whether you get this prefix from AS28747. > > If so, not sure but resetting the session with AS28747 would make any help? > > > > Kind regards. > > > > Arife > > -- > Alexander Koch <koch at tiscali.net> / ako4-ripe > Tiscali Int., Peering Coordination > Phone +49 6103 916 480, Fax +49 6103 916 464 > > On Tue, Jun 07, 2005 at 10:13:17AM +0200, RIPE NCC Hostmaster wrote: > > Dear Colleagues, > > > > It's quiet in this ticket for quite a while, while on the Net it's not > > so quiet: the ranges are still (again?) announced and visible > > (in case you don't know): > > > > route: 87.255.248.0/21 > > origin: AS12654 > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > lastupd-frst: 2005-06-05 14:10Z 212.47.190.1 at rrc00 > > lastupd-last: 2005-06-05 14:10Z 212.47.190.1 at rrc00 > > seen-at: rrc00 > > num-rispeers: 1 > > source: RISWHOIS > > > > We are still curious when is it going to stop. > > > > > > -- > > Sincerely, > > > > Mike Petuschak > > RIPE NCC > > > > > > > > > Hi Arife, > > > > > > Thanks for the update. > > > > > > Today RISwhois only sees 1 (one) peer at rrc00 forwarding the > > > old debogon announcments from 87/8: > > > > > > route: 87.192.0.0/16 > > > origin: AS12654 > > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > > seen-at: rrc00 > > > num-rispeers: 1 > > > source: RISWHOIS > > > > > > route: 87.255.248.0/21 > > > origin: AS12654 > > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > > seen-at: rrc00 > > > num-rispeers: 1 > > > source: RISWHOIS > > > > > > > > > The last update is yesterday, 10:11 UTC (14:11 local time) > > > is that when you reset the session with AS28747? > > > > > > -- Rene
[ Ris-int Archives ]