Strange entries from AS1 in global table

Mailman List Mirror (Read Only)
1

Hello everyone

I was looking at global IPv4 table and saw some strange entries from AS1.
As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of
Brazil based ISP - Netvip

http://bgp.he.net/AS1#_prefixes

Looking at any prefix in detail, it seems like there are multiple ASNs
announcing same prefix.

E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931
(Netvip's allocated ASN). Same is true with 177.185.98.0/24,
177.185.98.0/24and so on.
http://bgp.he.net/net/177.185.96.0/24

So seems like AS1 acting like a mirror for all announcements of AS52931. To
see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon
and noticed these routes:

3356 3549 16735 52931 1 i

Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which
seems like a backbone ISP in Brazil) is not filtering these routes further
passing to Level3 (AS3549+AS3356).

I am curious to know what could be possible reason for an ASN like AS1
acting in exact mirror of AS52931? Could it be a case of internal use of
AS1 (assuming it to be private ASN)? May be it's a case of leaked internal
routes?

Appreciate your time & answer.

Thanks.

2

Looking at our routers I can see this:
3549 3356 26114 1 i
12956 1239 23520 23383 1 ?

but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s
probably leaked routes or even use of AS 1 as private one (I don´t
think level3 guys are using this AS anymore...).

Cheers,
Humberto Galiza

3

Level 3 currently uses AS 1 in their MPLS network. I'm unsure if it's used elsewhere, but AS 1 could get into the AS paths of prefixes in the global routing table this way. I wouldn't expect to see it originating routes outside of the WAN interface for customers though and those are typically way too small to make it into the global routing table.

-Vinny

4

I think Level(3) uses it for at least some L3 MPLS VPN stuff. We peer with that AS for dedicated SIP service transport for example.

5

That's correct, I have seen L3 use that for MPLS as recently as a few months ago.
-James