AT&T blocking individual IP addresses

Mailman List Mirror (Read Only)
1

As of about an hour ago AT&T appear to have started blocking access to a few
of our IP addresses. This is being done at a /32 level, and the IP addresses
above and below are still allowed through.

Has anyone seen them do this before, or know who I need to contact to get it
fixed? AT&T won't talk to me as I'm not a customer...

Traceroute to the blocked IPs from AT&T all end at :
  5 cr2.phlpa.ip.att.net (12.122.3.226) [MPLS: Labels 20559/17406 Exp 0] 116
msec 20 msec 20 msec
  6 cr2.cl2oh.ip.att.net (12.122.2.209) [MPLS: Labels 20527/17406 Exp 0] 24
msec 20 msec 20 msec
  7 cr1.cl2oh.ip.att.net (12.122.2.125) [MPLS: Labels 0/17406 Exp 0] 24 msec
20 msec 20 msec
  8 cr82.dtrmi.ip.att.net (12.123.139.154) [MPLS: Label 16623 Exp 0] 24 msec
20 msec 20 msec
  9 gar4.dtrmi.ip.att.net (12.122.102.89) 20 msec 20 msec 20 msec
10 12.87.238.238 [AS 7018] 24 msec 20 msec 24 msec
11 12.87.238.237 [AS 7018] !A * *

Traceroute to the neighboring IP addresses don't go anywhere near the above
path, so it's apparently a blackhole of sorts.

  Scott.

2

Are they bots or C&C servers, or open DNS recursors?

3

They are (authenticated-required) proxy servers with 10's of thousands of
users behind them, so it's possible that they were seeing some bot-like
traffic from them, although the volume would have been tiny compared to the
volume of legitimate traffic.

  Scott.

4

So, if, say, AT&T customers are getting zorched from traffic behind those proxies, then blocking them would make sense, no?

;>

Do you have visibility into the traffic into/out of those proxies, in order to determine if there's DDoS or spam or other undesirable traffic emanating from them?

5

So, wait, are they your addresses or not?

6

They are our non-AT&T addresses, and AT&T was blocking access to them from
their network, so any of our customers on AT&T were unable to access our
systems.

AT&T has now resolved the problem, claiming that it was a "provisioning
error"...

Thanks,
  Scott.