Packets from net 10 (no, not the lyrics)

Mailman List Mirror (Read Only)
1

Date: Tue, 23 Sep 1997 20:46:15 +0900
To: Cary Howell <chowell@comstar.net>
From: Martyn Williams <martyn@twics.com>
Subject: Re: Spammer at new home.
Cc: nanog@merit.edu

Isn't spammer Quantum at quantcom.com ?

Actually, quantumcomm.com is a more interesting traceroute.
Especially hops 11 and 12, clearly being passed by Sprintlink.
Does anyone besides me see it as an issue that Sprintlink would
pass those packets? No, the network 10 isn't in my routing
tables.

Should I be filtering all reserved space at my border, or would
it be reasonable for me to expect the big guys not to take packets
with clearly inappropriate source addresses?

Or is my view on the situation incomplete?

traceroute www.quantumcomm.com
traceroute to www.quantumcomm.com (206.191.222.77), 30 hops max, 40 byte packets
1 www-186 (205.210.186.2) 2 ms * 1 ms
2 bcicor1-100bt-e1.barrie.connex.net (205.189.200.35) 1 ms 1 ms 1 ms
3 207.107.244.217 (207.107.244.217) 6 ms 207.107.244.213 (207.107.244.213) 6
ms spc-tor-7-Serial11-0-0-28.Sprint-Canada.Net (207.107.244.209) 6 ms
4 204.50.251.33 (204.50.251.33) 112 ms 11 ms 220 ms
5 144.228.165.25 (144.228.165.25) 20 ms 22 ms 19 ms
6 144.228.60.21 (144.228.60.21) 20 ms 21 ms 20 ms
7 144.232.0.78 (144.232.0.78) 21 ms 48 ms 20 ms
8 144.232.8.86 (144.232.8.86) 71 ms 77 ms 31 ms
9 144.228.50.18 (144.228.50.18) 43 ms 40 ms 37 ms
10 sl-sspace-1-S0-T1.sprintlink.net (144.228.18.78) 41 ms 39 ms 43 ms
11 10.1.0.5 (10.1.0.5) 41 ms 44 ms 41 ms
12 10.0.0.138 (10.0.0.138) 110 ms 71 ms 50 ms
13 206.191.222.77 (206.191.222.77) 76 ms 53 ms 51 ms

bcicor1.barrie>sh ip rout 10.0.0.0
% Network not in table
bcicor1.barrie>sh ip bgp sum
BGP table version is 3941193, main routing table version 3941193
48010 network entries (187332/187900 paths) using 11208976 bytes of memory
19645 BGP path attribute entries using 2615348 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
Dampening enabled. 243 history paths, 78 dampened paths
93539 received paths for inbound soft reconfiguration

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State
206.186.255.219 4 3602 1397791 460484 3941185 0 0 1w1d
206.221.252.1 4 6327 1107934 701905 3941185 0 0 1d07h

2

You don't need to see the prefix for 10/8 to be able to pass packets
through hosts in said prefix. Some consider it poor form to use
RFC1918 space for hosts that are visible to the outside world. As
long as you don't _announce_ said space to the rest of the world it
really only breaks MTU path discovery and maked debugging a little
more difficult.

Alec