[ris-int] RIS hijacking 195.80.239.0/24 ? [was: NCC#2002092793 RIS Beacon /20]
Rene Wilhelm wilhelm at ripe.net
Fri May 27 02:10:28 CEST 2005
Hi Arife, Something still seems wrong, riswhois still sees the prefix in the dumps and presumably looking glass will also report them. (no time to check those right now): cow$ whois -h riswhois -x 195.80.239.0/24 % This is RIPE NCC's Routing Information Service % whois gateway to collected BGP Routing Tables % IPv4 or IPv6 address to origin prefix match % % For more information visit http://www.ripe.net/ris/riswhois.html route: 195.80.239.0/24 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-05-25 14:13Z 80.81.192.30 at rrc12 lastupd-last: 2005-05-25 14:13Z 80.81.192.126 at rrc12 seen-at: rrc12 num-rispeers: 2 source: RISWHOIS The last-update dates are newer, but it's the same two peers that report the prefix as seen originating from AS12654. Similarly, RIS' "Debogonizing" announcements in 87/8 are still seen from two peers (other than the above) while the RS department already started allocating from this range: cow$ whois -h riswhois -M 87/8 .... route: 87.192.0.0/16 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-03-23 08:33Z 193.203.0.7 at rrc05 lastupd-last: 2005-05-26 13:51Z 212.47.190.1 at rrc00 seen-at: rrc00,rrc05 num-rispeers: 2 source: RISWHOIS route: 87.255.248.0/21 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-03-23 08:33Z 193.203.0.7 at rrc05 lastupd-last: 2005-05-26 13:51Z 212.47.190.1 at rrc00 seen-at: rrc00,rrc05 num-rispeers: 2 source: RISWHOIS So although for the most part RIS seems to announce what it should announce, some oddities, left-overs from old beacons, are still seen. -- Rene On Thu, 26 May 2005, Arife Vural wrote: > > Guys, > > After spent sometime to look at BGP conf files, I could not find anything > wrong, and now it looks we just announce what we have to announce on RRCs. > > I think at 19th of May, when OPS replaced the old RRC07, we accidently > started to announce old Anchor prefixes for a short while. > > Sorry for that. > > Arife > > > On Wed, May 25, 2005 at 12:15:29PM +0200, Arife Vural wrote: > > > > > > When I looked at the config files, it looks we do not announce those old > > Beacon prefixes, but still they are allowed in access-list for outgoing > > traffic. > > > > I will clean-up old Beacon prefixes from access-list, but I'm not sure > > that will help or not. I will check it out with James if problem still > > stays. > > > > Arife > > > > On Fri, May 20, 2005 at 02:03:11PM +0200, Rene Wilhelm wrote: > > > Hi Mike, > > > > > > > You returned 195.80.224/20 in February so we wanted to start using the range > > > > for our customers now. > > > > > > > > However for some reasons you started using it again for RIS. > > > > > > > > whois -h riswhois -M 195.80.224/20 > > > > > > > > route: 195.80.239.0/24 > > > > origin: AS12654 > > > > descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. > > > > lastupd-frst: 2005-05-19 11:33Z 80.81.192.30 at rrc12 > > > > lastupd-last: 2005-05-19 12:33Z 80.81.192.126 at rrc12 > > > > seen-at: rrc12 > > > > num-rispeers: 2 > > > > source: RISWHOIS > > > > > > > > > > > > So, what are you plans now? > > > > > > I think this announcement somehow came back by mistake. RIS is not > > > allowed to use the address range as it has been returned to you officially. > > > > > > The RIS operators should be able to find out what exactly is happening, > > > I'm cc-ing them (as well as the internal ris-int list) on this mail. > > > > > > RIS folk: > > > > > > Though querying the RIS DB for this range via the risearch.html > > > CGI yields zero results, the looking-glass pages do see 195.80.239.0/24 > > > being announced to rrc12 by 2 peers at the DE-CIX. > > > > > > http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC121&query=1&arg=195.80.239.0%2F24 > > > > > > > > > Regards, > > > > > > -- Rene > >
[ Ris-int Archives ]