routes to hit 50,000 soon? or filter AS 7007....

Mailman List Mirror (Read Only)
1

out of 47000 routes from Agis, 7327 of them have 7007 in them.

I spoke to them and they said that thier router broke..

They won't give us an answer, but when I said I was from Net Access, he
said "nac.net?" like he knew me, and they were vague. They also claimed
that they had 'turned thier router off', but the routes were still in for
almost 25 minutes later. Not only that, it seemed mailcious to me, because
the only announced the /24 of our name servers (207.99.0.0/24) and not our
whole /17.

VERY STRANGE. AND THEY WON'T ANSWER ANY QUESTIONS.

[rs.internic.net]
FL Internet Exchange (ASN-FLIX)
   115 Walnut Avenue
   Revere, MA 02151-5125
   US

   Autonomous System Name: FLIX
   Autonomous System Number: 7007

   Coordinator:
      Bono, Vincent J. [1LT] (VB14) vbono@MAI.NET
      703-734-8602 1-800-918-0524 (FAX) 1-703-506-1436

sorry if someone thinks this is the wrong message for the group, but it does
effect us all...

we are seeing lots of routes coming in

sho ip bgp sum
BGP table version is 6699646, main routing table version 6699646
49793 network entries (94886/99644 paths) using 8897576 bytes of memory
11894 BGP path attribute entries using 1541824 bytes of memory

but the routes seem to be coming from AS 7007... They are advertising many
routes, even our own. Sorry, but email and phones to them isn't working.

*> 156.5.0.0 137.39.167.29 50 701 701 701 1239
1790 7007 ?
* 208.131.13.29 0 5650 6176 1239

1790

7007 ?
*> 167.32.0.0 137.39.167.29 50 701 701 701 1239
1790 7007 ?
* 208.131.13.29 50 5650 3561 3561

1239

1790 7007 ?
*> 192.56.218.0 137.39.167.29 0 701 701 701 3561
194 3909 1 1239 17
90 7007 ?
*> 192.72.0.0 137.39.167.29 50 701 701 701 1239
1790 7007 ?
* 208.131.13.29 50 5650 3561 3561

1239

1790 7007 ?
*> 192.73.26.0 137.39.167.29 50 701 701 701 1239
1790 7007 ?
* 208.131.13.29 50 5650 3561 3561

1239

1790 7007 ?
*> 192.73.28.0 137.39.167.29 50 701 701 701 1239
1790 7007 ?
* 208.131.13.29 50 5650 3561 3561

1239

1790 7007 ?
*> 192.76.170.0 137.39.167.29 50 701 701 701 1239
1790 7007 ?
* 208.131.13.29 0 5650 6176 1239

1790

7007 ?
* 192.83.0.0 208.131.13.29 0 5650 6176 1239

1790

7007 ?
*> 137.39.167.29 50 701 701 701 1239
1790 7007 ?
* 192.83.64.0 208.131.13.29 0 5650 6176 1239

1790

2

Are your nameservers in the first class C of your CIDR block by any
chance??? They have been taking CIDR blocks and squirting out
Class C equivilents.

Sadly, many poeple (including me) think, oooh, nice big CDIR block lets
put all my important boxes in it's first Class C... Seems to be a
very bad descision ;-(

Regards,

aid

3

==>They won't give us an answer, but when I said I was from Net Access, he
==>said "nac.net?" like he knew me, and they were vague. They also claimed
==>that they had 'turned thier router off', but the routes were still in for
==>almost 25 minutes later. Not only that, it seemed mailcious to me, because
==>the only announced the /24 of our name servers (207.99.0.0/24) and not our
==>whole /17.

They announced the first classful block from all CIDRs in the table.

For example, if I had 172.16.0.0/14, 172.16.0.0/16 would have been
announced. I venture to take a guess that it's something nasty with
redistribution of BGP into a classful IGP and back into BGP again, but
since it's not my network, I can't tell you what happened.

/cah