NCC#2002092793 [ris-int] RIS hijacking 195.80.239.0/24, finally it's gone!
Arife Vural arife at ripe.net
Thu Jun 9 15:52:15 CEST 2005
Hi guys, Finally, this route is also disappeared from routing tables. I do not see on RRC00 anymore, in a couple of hours you will not see from riswhois as well. rrc00> sh ip bgp 87.255.248.0/21 % Network not in table A. -- From: <peering at bt.com> Sender: <piyush.patel at bt.com> To: <arife at ripe.net>, <peering at bt.com> X-OriginalArrivalTime: 09 Jun 2005 13:42:49.0863 (UTC) FILETIME=[208C0170:01C56CF9] X-RIPE-Spam-Level: X-RIPE-Spam-Tests: BAYES_00,NO_REAL_NAME X-RIPE-Spam-Status: U 0.281868 / -2.6 X-RIPE-Signature: ead9d970294533e5fd8c601b83fdd02e Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by birch.ripe.net id j59DhKUU030139 Status: RO Content-Length: 4001 Lines: 131 Hi Arife, This one was very strange. Not sure why our router was still thinking it was seeing the prefix from Tiscali. Hard clearing the sessions solve the problem. t2a4.se-sto#sh ip bgp 87.255.248.0 % Network not in table Regards, Piyush. -----Original Message----- From: Arife Vural [mailto:arife at ripe.net] Sent: 09 June 2005 10:09 To: peering G Subject: Problem getting prefixes from RIS (AS12654) Hi there, Part of De-bogonising project we were announcing 87/8. We stopped it for a while, but it's seen in routing tables as follow, rrc00> sh ip bgp 87.255.248.0/21 BGP routing table entry for 87.255.248.0/21 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 9177 6730 5400 3257 28747 12654 212.47.190.1 from 212.47.190.1 (213.193.66.42) Origin IGP, localpref 100, valid, external, best Last update: Wed Jun 8 10:20:46 2005 I checked it out with AS3257, it looks they do not see that prefix anymore, but it's still seen by AS5400. BT Global Services: Looking Glass Query: BGP Network Router: Netherlands - ixp1.nl-ams2 Address: 87.255.248.0 BGP routing table entry for 87.255.248.0/21, version 51534071 Bestpath Modifiers: deterministic-med Paths: (2 available, best #1) Multipath: eBGP Advertised to update-groups: 1 3257 28747 12654 166.49.166.184 (metric 181) from 166.49.166.32 (166.49.166.32) Origin IGP, metric 0, localpref 180, valid, internal, best Community: 3257:4000 3257:5044 5400:3001 5400:3002 Originator: 166.49.166.184, Cluster list: 166.49.166.32, 166.49.166.176 3257 28747 12654 166.49.166.184 (metric 181) from 166.49.166.33 (166.49.166.33) Origin IGP, metric 0, localpref 180, valid, internal Community: 3257:4000 3257:5044 5400:3001 5400:3002 Originator: 166.49.166.184, Cluster list: 166.49.166.33, 166.49.166.176 I was wondering whether you could reset the session with AS3257 and make sure you will not announce that route to your peers. Regards. Arife ----- Forwarded message from Alexander Koch <koch at tiscali.net> ----- From: Alexander Koch <koch at tiscali.net> To: Arife Vural <arife at ripe.net> Subject: Re: Need a favor Date: Wed, 8 Jun 2005 14:00:49 +0200 Hello Arife, what you see is probably comparable to IPv6 ghosts routes where a /35 more specific route sticked in the routing table long after it was theoretically withdrawn. We currently do not see the route from RealROOT, but then, AS28747 was changed to AS 9009 two weeks ago or so. Also seeing the AS path I believe you can safely assume AS5400 (BT's backbone) is not seeing it either... your best bet might be to contact bgp at sunrise.net and/or AS9177 directly. Does that help? Best regards, Alexander On Wed, 8 June 2005 14:00:17 +0200, Arife Vural wrote: > Hi Alexander, > > Part of De-bogonising project we were announcing 87/8. We stopped it > for a while, but it's seen in routing tables. Be honest, I could not > explain why this route was still in the routing tables even if we do > not have any entries in our config file for that prefix. > > On rrc00, it's seen like that, > > rrc00> sh ip bgp 87.255.248.0/21 > BGP routing table entry for 87.255.248.0/21 > Paths: (1 available, best #1, table Default-IP-Routing-Table) > Not advertised to any peer > 9177 6730 5400 3257 28747 12654 > 212.47.190.1 from 212.47.190.1 (213.193.66.42) > Origin IGP, localpref 100, valid, external, best > Last update: Wed Jun 8 10:20:46 2005 > > I contacted with AS28747, but could not get any reply back to check > whether they get this prefix from us or not. > > I would like to ask you to check whether you get this prefix from > AS28747. > If so, not sure but resetting the session with AS28747 would make any help? > > Kind regards. > > Arife -- Alexander Koch <koch at tiscali.net> / ako4-ripe Tiscali Int., Peering Coordination Phone +49 6103 916 480, Fax +49 6103 916 464 ----- End forwarded message ----- On Wed, Jun 08, 2005 at 04:03:04PM +0200, Rene Wilhelm wrote: > Hi Arife, > > I understand it's a difficult issue; fortunately we're left > with only 1 debogon prefix: > > whois -h riswhois -F -M 87/8 |grep 12654 > 12654 87.255.248.0/21 1 > > The other one, 87.192.0.0/16, is now announced by AS25441 and seen > by 64 RIS peers. Perhaps all it takes to clear the bogus debogon > is for a new owner to insert a fresh announcement? > > If you want to continue contacting every AS which according > to the routing tables sees the debogon route, you could > also check route-views' routers for info. > > For example, @oregon-ix: > > x27$ telnet route-views.oregon-ix.net > [...] > route-views.oregon-ix.net>sh ip bgp 87.255.248.0/21 > BGP routing table entry for 87.255.248.0/21, version 60855137 > Paths: (1 available, best #1, table Default-IP-Routing-Table) > Not advertised to any peer > 3277 6820 3246 5400 5400 3257 28747 12654 > 194.85.4.55 from 194.85.4.55 (194.85.4.55) > Origin IGP, localpref 100, valid, external, best > Community: 3277:6820 3277:65361 > > Only the "5400 3257 28747 12654" part is in common with RIS, > the other ASNs are different. > > Cheers, > > -- Rene > > > > Hi Mike, > > > > I'm chasing those guys who still think we announce that prefix. But I have > > not got any useful info from them. Last, I contacted with AS9177, but I > > have not got any reply back. > > > > I attached the e-mail that I got from Tiscali, it looks this route still > > is hanging there because of a Cisco bug or maybe other vendor OS bugs. > > I do not know what else I could do be honest ... > > > > Arife > > > > -- > > > > From: Alexander Koch <koch at tiscali.net> > > To: Arife Vural <arife at ripe.net> > > Subject: Re: Need a favor > > Message-ID: <20050608120049.GA21021 at shekinah.ip.tiscali.net> > > References: <20050608120017.GC22290 at ripe.net> > > Mime-Version: 1.0 > > Content-Type: text/plain; charset=us-ascii > > Content-Disposition: inline > > In-Reply-To: <20050608120017.GC22290 at ripe.net> > > Organization: Tiscali International Network B.V. > > X-NCC-RegID: eu.nacnet > > User-Agent: Mutt/1.5.9i > > X-RIPE-Spam-Level: > > X-RIPE-Spam-Tests: BAYES_00 > > X-RIPE-Spam-Status: U 0.298951 / -2.6 > > X-RIPE-Signature: f24e950eeaafece3eb369dee26ae860b > > Status: RO > > Content-Length: 1707 > > Lines: 50 > > > > Hello Arife, > > > > what you see is probably comparable to IPv6 ghosts routes > > where a /35 more specific route sticked in the routing table > > long after it was theoretically withdrawn. > > > > We currently do not see the route from RealROOT, but then, > > AS28747 was changed to AS 9009 two weeks ago or so. Also > > seeing the AS path I believe you can safely assume AS5400 > > (BT's backbone) is not seeing it either... your best bet > > might be to contact bgp at sunrise.net and/or AS9177 directly. > > > > Does that help? > > > > Best regards, > > Alexander > > > > On Wed, 8 June 2005 14:00:17 +0200, Arife Vural wrote: > > > Hi Alexander, > > > > > > Part of De-bogonising project we were announcing 87/8. We stopped it > > > for a while, but it's seen in routing tables. Be honest, I could not > > > explain why this route was still in the routing tables even if we do > > > not have any entries in our config file for that prefix. > > > > > > On rrc00, it's seen like that, > > > > > > rrc00> sh ip bgp 87.255.248.0/21 > > > BGP routing table entry for 87.255.248.0/21 > > > Paths: (1 available, best #1, table Default-IP-Routing-Table) > > > Not advertised to any peer > > > 9177 6730 5400 3257 28747 12654 > > > 212.47.190.1 from 212.47.190.1 (213.193.66.42) > > > Origin IGP, localpref 100, valid, external, best > > > Last update: Wed Jun 8 10:20:46 2005 > > > > > > I contacted with AS28747, but could not get any reply back to check > > > whether they get this prefix from us or not. > > > > > > I would like to ask you to check whether you get this prefix from AS28747. > > > If so, not sure but resetting the session with AS28747 would make any help? > > > > > > Kind regards. > > > > > > Arife > > > > -- > > Alexander Koch <koch at tiscali.net> / ako4-ripe > > Tiscali Int., Peering Coordination > > Phone +49 6103 916 480, Fax +49 6103 916 464 > > > > On Tue, Jun 07, 2005 at 10:13:17AM +0200, RIPE NCC Hostmaster wrote: > > > Dear Colleagues, > > > > > > It's quiet in this ticket for quite a while, while on the Net it's not > > > so quiet: the ranges are still (again?) announced and visible > > > (in case you don't know): > > > > > > route: 87.255.248.0/21 > > > origin: AS12654 > > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > > lastupd-frst: 2005-06-05 14:10Z 212.47.190.1 at rrc00 > > > lastupd-last: 2005-06-05 14:10Z 212.47.190.1 at rrc00 > > > seen-at: rrc00 > > > num-rispeers: 1 > > > source: RISWHOIS > > > > > > We are still curious when is it going to stop. > > > > > > > > > -- > > > Sincerely, > > > > > > Mike Petuschak > > > RIPE NCC > > > > > > > > > > > > > Hi Arife, > > > > > > > > Thanks for the update. > > > > > > > > Today RISwhois only sees 1 (one) peer at rrc00 forwarding the > > > > old debogon announcments from 87/8: > > > > > > > > route: 87.192.0.0/16 > > > > origin: AS12654 > > > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > > > seen-at: rrc00 > > > > num-rispeers: 1 > > > > source: RISWHOIS > > > > > > > > route: 87.255.248.0/21 > > > > origin: AS12654 > > > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > > > lastupd-frst: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > > > lastupd-last: 2005-06-01 10:11Z 212.47.190.1 at rrc00 > > > > seen-at: rrc00 > > > > num-rispeers: 1 > > > > source: RISWHOIS > > > > > > > > > > > > The last update is yesterday, 10:11 UTC (14:11 local time) > > > > is that when you reset the session with AS28747? > > > > > > > > -- Rene
[ Ris-int Archives ]