I received an alert from Cyclops telling me a probe in AS513 had seen a /32 that I announce to Cogent for one of our BGP sessions.
Did anyone else see this?
We had a problem with cogent about a year ago. Somehow.. cymru was
announcing a /32 of ours and black holing it for whatever reason. It
was removed but wasn't happy that cogent was allowing cymru to do this
sort of action. To this date we do not have a valid reason from cogent
on why they allowed this to happen.
Cheers,
Zak Thompson
Are you relying on the /24 filtering "everybody" does, or did you announce it to them with NO-EXPORT set?
Yes, I absolutely love the /24 filtering "everybody" does. Internet
littering at its best.
If there is DDoS attack going on from/to specific /32, sometimes they do
that to avoid too much overload for the network.
Cogent should give the answer for what's going on.
Alex
Zak Thompson wrote:
ML <ml@kenweb.org> writes:
I received an alert from Cyclops telling me a probe in AS513 had seen
a /32 that I announce to Cogent for one of our BGP sessions.Did anyone else see this?
cyclops alerted me that the /32s my routers use got announced. I'm still
tying to figure out what's up. They're not routes I announce, and as far
as I can tell, they were announced with a cern next hop.
seph
Yes, I absolutely love the /24 filtering "everybody" does. Internet
littering at its best.
Yes, nice...
mh
If there is DDoS attack going on from/to specific /32, sometimes they do
that to avoid too much overload for the network.
Cogent should give the answer for what's going on.
Generally, such is kept in-AS (null-routing or routing to some other
sink of choice).
mh
I called cogent. Best guess is that they leaked the /32 announcements
that people do for the peer a/b stuff. They normally filter them, and
don't have any recommendation about whether or not to set no export.
seph
seph <seph@directionless.org> writes:
There is no rule that says you have to filter at /24, or that no other
network may ever advertise something longer. This issue is probably best
expressed as "you are highly unlikely to have full global Internet
reachability if you announce something longer than a /24", not "you are
highly unlikely to have anyone accept your announcement if it are longer
than a /24".
Richard A Steenbergen wrote: