Need Help Getting IP Unblocked by AT&T

Mailman List Mirror (Read Only)
1

I'm not sure where to take this issue. The Regular AT&T NOC contacts
are refusing to talk to me since I do not have a circuit ID, and do not
seem to have any understanding about transiting issues. I am unable to
fully monitor and manage a router I control, as all traffic bound to its
lan IP that transits through the AT&T network is blocked. The Router is
connected to a Verizon circuit, but any connection that transits through
AT&T is blocked. The ip in Question is from a direct ARIN allocation
that I control. I have attached a ping demonstrating that I am
receiving an ICMP deny from an AT&T core router. I have also attached a
traceroute to both the offending IP and the WAN IP which appears to be
working.

braaen@brian-debian:~$ ping gw.bwtc.net
PING gw.bwtc.net (72.14.76.1) 56(84) bytes of data.

From 12.89.27.105 icmp_seq=1 Packet filtered
From 12.89.27.105 icmp_seq=3 Packet filtered

^C
--- gw.bwtc.net ping statistics ---
4 packets transmitted, 0 received, +2 errors, 100% packet loss, time 3004ms

braaen@brian-debian:~$ sudo traceroute-nanog -AO gw.bwtc.net
[sudo] password for braaen:
traceroute to gw.bwtc.net (72.14.76.1), 64 hops max, 40 byte packets
1 gw-alpha.america.net (69.60.176.65) [AS4452] dns@america.net 3 ms
3 ms 3 ms
2 gw-alpha.america.net (69.60.176.65) [AS4452] dns@america.net 3 ms
3 ms 4 ms
3 69.60.160.8 (69.60.160.8) [AS4452] dns@america.net 13 ms
rtrs00.america.net (69.60.176.21) [AS4452] dns@america.net 13 ms
69.60.160.8 (69.60.160.8) [AS4452] dns@america.net 13 ms
4 69.60.160.8 (69.60.160.8) [AS4452] dns@america.net 12 ms 35 ms 17 ms
5 gig4-16.core2.suw1.qualitytech.com (64.88.172.145) [AS20141]
dnsadmin@globix.net [MPLS: Label 673 Exp 0] 15 ms 14 ms 25 ms
6 gig4-16.core2.suw1.qualitytech.com (64.88.172.145) [AS20141]
dnsadmin@globix.net 14 ms 14 ms 18 ms
7 ten8-3.peer1.suw1.qualitytech.com (64.88.172.197) [AS20141]
dnsadmin@globix.net 14 ms 12 ms 14 ms
8 border11.tge3-3.qts-1.acs.pnap.net (64.94.3.113) [AS14745]
hostmaster@pnap.net 14 ms 14 ms 14 ms
9 core1.te2-2-bbnet2.acs002.pnap.net (64.94.0.79) [AS14745]
hostmaster@pnap.net 14 ms core1.te2-1-bbnet1.acs002.pnap.net
(64.94.0.15) [AS14745] hostmaster@pnap.net 14 ms 12.86.102.5
(12.86.102.5) [<NONE>] rm-hostmaster@ems.att.com 14 ms
10 12.86.102.5 (12.86.102.5) [<NONE>] rm-hostmaster@ems.att.com 13 ms
23 ms 13 ms
11 cr1.attga.ip.att.net (12.122.141.2) [<NONE>]
rm-hostmaster@ems.att.com [MPLS: Label 16745 Exp 0] 40 ms
cr2.ormfl.ip.att.net (12.122.5.141) [<NONE>] rm-hostmaster@ems.att.com
[MPLS: Label 20348 Exp 0] More labels 40 ms More labels 40 ms
12 cr2.ormfl.ip.att.net (12.122.5.141) [<NONE>]
rm-hostmaster@ems.att.com More labels 40 ms More labels 41 ms More
labels 40 ms
13 cr2.nwrla.ip.att.net (12.122.30.77) [<NONE>]
rm-hostmaster@ems.att.com [MPLS: Label 0 Exp 0] More labels 40 ms
gar1.nwrla.ip.att.net (12.123.153.85) [<NONE>]
rm-hostmaster@ems.att.com 38 ms 38 ms
14 gar1.nwrla.ip.att.net (12.123.153.85) [<NONE>]
rm-hostmaster@ems.att.com 50 ms 38 ms 38 ms
15 12.89.27.106 (12.89.27.106) [<NONE>] rm-hostmaster@ems.att.com 43
ms 44 ms 44 ms
16 * * 12.89.27.105 (12.89.27.105) [<NONE>] rm-hostmaster@ems.att.com
44 ms !A

braaen@brian-debian:~$ sudo traceroute-nanog -AO 157.130.26.166
traceroute to 157.130.26.166 (157.130.26.166), 64 hops max, 40 byte packets
1 gw-alpha.america.net (69.60.176.65) [AS4452] dns@america.net 4 ms
3 ms 6 ms
2 gw-alpha.america.net (69.60.176.65) [AS4452] dns@america.net 3 ms
3 ms 3 ms
3 rtrs00.america.net (69.60.176.21) [AS4452] dns@america.net 14 ms
13 ms 13 ms
4 69.60.160.8 (69.60.160.8) [AS4452] dns@america.net 13 ms 13 ms 12 ms
5 66.0.192.194 (66.0.192.194) [AS20141] dns@deltacom.net 13 ms 13
ms 15 ms
6 gig4-16.core2.suw1.qualitytech.com (64.88.172.145) [AS20141]
dnsadmin@globix.net [MPLS: Label 673 Exp 0] 30 ms
ten8-3.peer1.suw1.qualitytech.com (64.88.172.197) [AS20141]
dnsadmin@globix.net 14 ms gig4-16.core2.suw1.qualitytech.com
(64.88.172.145) [AS20141] dnsadmin@globix.net 34 ms
7 ten8-3.peer1.suw1.qualitytech.com (64.88.172.197) [AS20141]
dnsadmin@globix.net 19 ms 13 ms 13 ms
8 core3.tge4-1-bbnet1.acs.pnap.net (64.94.0.3) [AS14745]
hostmaster@pnap.net 14 ms core3.tge4-1-bbnet2.acs.pnap.net (64.94.0.67)
[AS14745] hostmaster@pnap.net 14 ms 15 ms
9 core3.tge4-1-bbnet2.acs.pnap.net (64.94.0.67) [AS14745]
hostmaster@pnap.net 14 ms core3.tge4-1-bbnet1.acs.pnap.net (64.94.0.3)
[AS14745] hostmaster@pnap.net 14 ms 15 ms
10 TenGigabitEthernet3-4.ar5.ATL1.gblx.net (207.218.80.217) [AS3549]
dns@gblx.net.80.218.207.in-addr.arpa 14 ms 14 ms 14 ms
11 ge4-3-1000M.ar3.PTY1.gblx.net (67.16.135.18) [AS22566] dns@gblx.net
18 ms 14 ms 14 ms
12 0.so-1-1-0.XT1.ATL4.ALTER.NET (152.63.86.170) [<NONE>]
hostmaster@uu.net 14 ms 49 ms verizon-1.ar2.ATL2.gblx.net
(64.208.110.170) [AS3549] dns@gblx.net 17 ms
13 0.so-1-1-0.XT1.ATL4.ALTER.NET (152.63.86.170) [<NONE>]
hostmaster@uu.net 33 ms 14 ms 16 ms
14 0.so-7-1-0.XL3.BOS4.ALTER.NET (152.63.0.209) [<NONE>]
hostmaster@uu.net 42 ms 48 ms 49 ms
15 POS6-0.GW10.BOS4.ALTER.NET (152.63.17.37) [<NONE>]
hostmaster@uu.net 41 ms 42 ms 41 ms
16 * networkinnovations-gw.customer.alter.net (157.130.26.166) [<NONE>]
hostmaster@uu.net 53 ms *

2

Work through your provider, I would start with you local end. They should
help you, you ARE their customer. If not, you need a new provider. Look
into out of band management.

Robert D. Scott Robert@ufl.edu
Senior Network Engineer 352-273-0113 Phone
CNS - Network Services 352-392-2061 CNS Phone Tree
University of Florida 352-392-9440 FAX
Florida Lambda Rail 352-294-3571 FLR NOC
Gainesville, FL 32611 321-663-0421 Cell

3

I appreciate the offline replies. After doing some more research myself
the issue appears to be related to the fact that AT&T is announcing the
block directly. I did show "ip bgp 72.14.76.0" in a couple routers and
some showed the route originating in 701 (they were able to reach it)
and others showed it originating in 7018 (and they could not reach it).

Here is my question, since I am an ARIN admin contact for the IP block
how is the best way to get AT&T to quit announcing the block.

4

I have sent a complaint to the AT&T abuse contact from my ARIN contact
address asking them to stop announcing the route.

5

Brian Raaen wrote:

I appreciate the offline replies. After doing some more research myself
the issue appears to be related to the fact that AT&T is announcing the
block directly. I did show "ip bgp 72.14.76.0" in a couple routers and
some showed the route originating in 701 (they were able to reach it)
and others showed it originating in 7018 (and they could not reach it).

Here is my question, since I am an ARIN admin contact for the IP block
how is the best way to get AT&T to quit announcing the block.

If they absolutely refuse to talk to you, have someone who is an AT&T customer open a ticket with them about being unable to reach your network.

I would suspect that the discussion here. may get their attention.

6

I have not seen any changes yet, although I did get an automated
response from their abuse address that they received my message. Also,
to answer another question I have not changed backbones in over two
years. I largely suspect that this is an issue of a simple typo and not
anything malicious.

7

No is just seems to die in their core network.

Dorn Hetzel wrote:

8

It appears that AT&T started announcing a block of a former customer
that we had reclaimed. AT&T contacted me offline and let me know that
the issue was resolved.

Brian Raaen wrote: