Hello,
I haven't seen anything to explain this, so I'm asking a larger
audience. Did anyone notice any unusual NTT or HE routing this AM?
Here's what I saw:
2.|-- xe-0-1-0-17.r04.atlnga05.us.bb.gin.ntt.net 0.0% 20 0.8
0.7 0.6 0.9 0.1
3.|-- ae-2.r20.atlnga05.us.bb.gin.ntt.net 0.0% 20 4.6
6.2 0.5 13.6 4.8
4.|-- ae-4.r22.asbnva02.us.bb.gin.ntt.net 0.0% 20 15.3
15.0 13.9 15.8 0.7
5.|-- ae-4.r20.frnkge04.de.bb.gin.ntt.net 0.0% 20 127.3
106.7 98.5 127.3 11.1
6.|-- ae-2.r02.frnkge04.de.bb.gin.ntt.net 0.0% 20 126.8
126.0 125.7 126.8 0.2
7.|-- ae-1.r00.sofibu01.bg.bb.gin.ntt.net 0.0% 20 131.1
130.0 128.7 131.4 1.2
8.|-- 83.217.227.42 80.0% 20 148.5
146.0 144.2 148.5 2.0
9.|-- ip-48-93.sofia-connect.net 90.0% 20 184.5
163.8 143.1 184.5 29.3
10.|-- ??? 100.0 20 0.0
0.0 0.0 0.0 0.0
11.|-- 10ge5-4.core1.vie1.he.net 75.0% 20 160.7
150.4 143.9 160.7 6.3
12.|-- 10ge1-4.core1.prg1.he.net 80.0% 20 158.4
159.5 157.9 161.1 1.6
13.|-- 10ge10-12.core1.fra1.he.net 75.0% 20 154.5
159.2 145.9 174.4 10.7
14.|-- 100ge5-2.core1.par2.he.net 75.0% 20 187.9
172.9 157.1 187.9 11.1
15.|-- 100ge7-1.core1.nyc4.he.net 78.9% 19 147.2
146.2 144.6 147.5 1.4
16.|-- 100ge7-2.core1.chi1.he.net 78.9% 19 165.6
172.1 165.6 183.5 8.0
17.|-- 10ge15-2.core1.den1.he.net 89.5% 19 201.3
204.7 201.3 208.1 4.8
-Jim P.
NTT's customer Sofia Connect leaked our routes to NTT. NTT accepted these routes instead of properly filtering their customer announcements. As a network of non-trivial size, announcing over 75,000 customer routes which is nearly 15% of the IPv4 routing table, we'd expect the common courtesy of having our ASN included in their customer facing AS-PATH filters, as we extend this same courtesy to other networks of this size (such as AS2914).
Mike.
Greetings,
We are aware of this issue and as is usual we filter customers based on their registered routes. This creates some unique challenges that we have been speaking about publicly and privately with various groups.
I have started the process (yay telco-speak) to fix this.
It would be helpful if networks would take a look at what routes they have registered in the various IRRs as well as if their AS-SETs expand out to something quite large. We have seen many customers import objects that then import their other upstream networks.
We have found the IRR Explorer tool helpful to look at who has registered our IP space and to police these registrations with the various IRRs out there. http://irrexplorer.nlnog.net/
http://irrexplorer.nlnog.net/prefix/184.105.213.86
The stability of the routing ecosystem is something that I personally care a lot about and have privately given Mike and others my cell number to allow them to follow-up. As is often operators end up chasing problems after the fact, and this appears to be no exception. *sigh*
- Jared
Hi Jared,
This is neat !, for someone who recently started working the IRR's, I can tell you that it has been very difficult finding all info in one location.
What you shared is pretty neat !, and I would like to clean up the records associated with our prefixes.
Can you suggest some practical tips on getting older 'stale' records cleaned up from the different registries ?
(i.e. records created for us by others, in a former time-frame).
Regards
Faisal Imtiaz
Snappy Internet & Telecom
I've not found a great method as it usually involves a lot
of either happy or grumpy sounding emails to addresses that may
bounce quite a lot. We have had good luck getting RADB to clean out
older entries.
I recently helped someone announce some IP blocks from the
NTT network and there are many crusty IRR objects that seem
impossible to clean up because the IRR is feels like first-in-never-out
input.
http://irrexplorer.nlnog.net/prefix/203.10.78.0/24
- Jared