ATT BGP - Advertising my network on accident

This issue has been resolved by breaking up the /22 into /24's. Thanks to
all for the advise.

Maybe next time I will take someone's advise and advertise one of ATT's
/8's.

From:
Eric Williams/Connectria
To:
nanog@nanog.org
Date:
06/24/2010 02:37 PM
Subject:
ATT BGP - Advertising my network on accident

AT&T is currently advertising my address space to the internet
accidentally via BGP which they should not be. Since they are advertising
my address space on accident, we are dead in the water. Does anybody out
there work for ATT or know of the number I can call in order to have them
stop advertising my /22 ASAP!!!!

I wonder how much of the de-aggregation in the routing table is
attributable to issues like this?

Have you found a contact at ATT to get this stopped?

Have you found a contact at ATT to get this stopped?

I'm fairly certain JayB at least reads nanog... the OP didn't mention
if this was 7018, 7132 or the ATT_ENS AS with the route though :frowning:

Looks like the prefix in question is 208.91.48.0/22
and it was briefly announced by 7018 yesterday, but
that announcement seems to be gone now. I see 11734
is announcing 208.91.48.0/22 + 208.91.48.0/24 now,
but not 208.91.49.0/24 - 208.91.51.0/24.

So, as periodically happens to me, what started as an idle curiosity
turned into an experiment. I took a look at a RIB snapshot from
Friday, from one of the RouteViews collectors, to see how common it is
that a block gets advertised by two different ASes, as a whole block
by one, and as a set of smaller blocks by the other.

It turns out there's a non-trivial amount out there -- 490 blocks
broken up, adding 1,815 prefixes announced, accounting for 19,623 RIB
entries. More details below; let me know if you're interested in even
more. Seems kind of interesting, as a form of deaggregation that
doesn't show up in things like the CIDR report (since it's not within
a single AS).

(Standard caveats apply: This is a quick pass, not controlled for
things like two ASes belonging to the same entity.)

--Richard

Total number of deaggregated prefixes: 490
Total additional prefixes advertised: 1815
Total additional RIB entries: 19623 (0.5% out of 3530845 total entries)
Total addresses affected: 78863360 (roughly 1,203 /16s)

Extremal points:

1. Largest deaggregated block: 17.0.0.0/8, advertised by AS7018
(AT&T), deaggregated into two /9s by AS714 (Apple Engineering)

2. Most fractured block: 58.140.0.0/14, advertised by AS3786 (LG
DACOM, KR), deaggregated into 69 prefixes (ranging from /17 to /24) by
AS10036 (C&M Communication, KR).

Distribution of the number of additional prefixes:
Prefixes Count
   2 343
   3 13
   4 80
   5 5
   6 1
   7 4
   8 17
   9 5
  10 1
  11 1
  14 1
  15 1
  16 6
  17 1
  20 2
  32 7
  34 1
  69 1

Distribution of prefix lengths deaggregated:
Len Count
8 1
11 1
12 3
13 9
14 17
15 22
16 47
17 25
18 29
19 65
20 52
21 56
22 69
23 92
24 2

Distribution of the number of addresses affected:
Addresses Count
     512 2
    1024 92
    2048 69
    4096 56
    8192 52
   16384 65
   32768 29
   65536 25
  131072 47
  262144 22
  524288 17
1048576 9
2097152 3
4194304 1
33554432 1

you may find http://archive.psg.com/jsac-deag.pdf of interest

randy