RIS hijacking 195.80.239.0/24 ? [was: NCC#2002092793 RIS Beacon /20]
Hi Mike,
You returned 195.80.224/20 in February so we wanted to start using the range for our customers now.
However for some reasons you started using it again for RIS.
whois -h riswhois -M 195.80.224/20
route: 195.80.239.0/24 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-05-19 11:33Z 80.81.192.30@rrc12 lastupd-last: 2005-05-19 12:33Z 80.81.192.126@rrc12 seen-at: rrc12 num-rispeers: 2 source: RISWHOIS
So, what are you plans now?
I think this announcement somehow came back by mistake. RIS is not allowed to use the address range as it has been returned to you officially. The RIS operators should be able to find out what exactly is happening, I'm cc-ing them (as well as the internal ris-int list) on this mail. RIS folk: Though querying the RIS DB for this range via the risearch.html CGI yields zero results, the looking-glass pages do see 195.80.239.0/24 being announced to rrc12 by 2 peers at the DE-CIX. http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC121&query=1&arg=195.80.239.0%2F24 Regards, -- Rene
When I looked at the config files, it looks we do not announce those old Beacon prefixes, but still they are allowed in access-list for outgoing traffic. I will clean-up old Beacon prefixes from access-list, but I'm not sure that will help or not. I will check it out with James if problem still stays. Arife On Fri, May 20, 2005 at 02:03:11PM +0200, Rene Wilhelm wrote:
Hi Mike,
You returned 195.80.224/20 in February so we wanted to start using the range for our customers now.
However for some reasons you started using it again for RIS.
whois -h riswhois -M 195.80.224/20
route: 195.80.239.0/24 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-05-19 11:33Z 80.81.192.30@rrc12 lastupd-last: 2005-05-19 12:33Z 80.81.192.126@rrc12 seen-at: rrc12 num-rispeers: 2 source: RISWHOIS
So, what are you plans now?
I think this announcement somehow came back by mistake. RIS is not allowed to use the address range as it has been returned to you officially.
The RIS operators should be able to find out what exactly is happening, I'm cc-ing them (as well as the internal ris-int list) on this mail.
RIS folk:
Though querying the RIS DB for this range via the risearch.html CGI yields zero results, the looking-glass pages do see 195.80.239.0/24 being announced to rrc12 by 2 peers at the DE-CIX.
http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC121&query=1&arg=195.80.239.0%2F24
Regards,
-- Rene
Guys, After spent sometime to look at BGP conf files, I could not find anything wrong, and now it looks we just announce what we have to announce on RRCs. I think at 19th of May, when OPS replaced the old RRC07, we accidently started to announce old Anchor prefixes for a short while. Sorry for that. Arife On Wed, May 25, 2005 at 12:15:29PM +0200, Arife Vural wrote:
When I looked at the config files, it looks we do not announce those old Beacon prefixes, but still they are allowed in access-list for outgoing traffic.
I will clean-up old Beacon prefixes from access-list, but I'm not sure that will help or not. I will check it out with James if problem still stays.
Arife
On Fri, May 20, 2005 at 02:03:11PM +0200, Rene Wilhelm wrote:
Hi Mike,
You returned 195.80.224/20 in February so we wanted to start using the range for our customers now.
However for some reasons you started using it again for RIS.
whois -h riswhois -M 195.80.224/20
route: 195.80.239.0/24 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-05-19 11:33Z 80.81.192.30@rrc12 lastupd-last: 2005-05-19 12:33Z 80.81.192.126@rrc12 seen-at: rrc12 num-rispeers: 2 source: RISWHOIS
So, what are you plans now?
I think this announcement somehow came back by mistake. RIS is not allowed to use the address range as it has been returned to you officially.
The RIS operators should be able to find out what exactly is happening, I'm cc-ing them (as well as the internal ris-int list) on this mail.
RIS folk:
Though querying the RIS DB for this range via the risearch.html CGI yields zero results, the looking-glass pages do see 195.80.239.0/24 being announced to rrc12 by 2 peers at the DE-CIX.
http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC121&query=1&arg=195.80.239.0%2F24
Regards,
-- Rene
Hi Arife, Something still seems wrong, riswhois still sees the prefix in the dumps and presumably looking glass will also report them. (no time to check those right now): cow$ whois -h riswhois -x 195.80.239.0/24 % This is RIPE NCC's Routing Information Service % whois gateway to collected BGP Routing Tables % IPv4 or IPv6 address to origin prefix match % % For more information visit http://www.ripe.net/ris/riswhois.html route: 195.80.239.0/24 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-05-25 14:13Z 80.81.192.30@rrc12 lastupd-last: 2005-05-25 14:13Z 80.81.192.126@rrc12 seen-at: rrc12 num-rispeers: 2 source: RISWHOIS The last-update dates are newer, but it's the same two peers that report the prefix as seen originating from AS12654. Similarly, RIS' "Debogonizing" announcements in 87/8 are still seen from two peers (other than the above) while the RS department already started allocating from this range: cow$ whois -h riswhois -M 87/8 .... route: 87.192.0.0/16 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-03-23 08:33Z 193.203.0.7@rrc05 lastupd-last: 2005-05-26 13:51Z 212.47.190.1@rrc00 seen-at: rrc00,rrc05 num-rispeers: 2 source: RISWHOIS route: 87.255.248.0/21 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-03-23 08:33Z 193.203.0.7@rrc05 lastupd-last: 2005-05-26 13:51Z 212.47.190.1@rrc00 seen-at: rrc00,rrc05 num-rispeers: 2 source: RISWHOIS So although for the most part RIS seems to announce what it should announce, some oddities, left-overs from old beacons, are still seen. -- Rene On Thu, 26 May 2005, Arife Vural wrote:
Guys,
After spent sometime to look at BGP conf files, I could not find anything wrong, and now it looks we just announce what we have to announce on RRCs.
I think at 19th of May, when OPS replaced the old RRC07, we accidently started to announce old Anchor prefixes for a short while.
Sorry for that.
Arife
On Wed, May 25, 2005 at 12:15:29PM +0200, Arife Vural wrote:
When I looked at the config files, it looks we do not announce those old Beacon prefixes, but still they are allowed in access-list for outgoing traffic.
I will clean-up old Beacon prefixes from access-list, but I'm not sure that will help or not. I will check it out with James if problem still stays.
Arife
On Fri, May 20, 2005 at 02:03:11PM +0200, Rene Wilhelm wrote:
Hi Mike,
You returned 195.80.224/20 in February so we wanted to start using the range for our customers now.
However for some reasons you started using it again for RIS.
whois -h riswhois -M 195.80.224/20
route: 195.80.239.0/24 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-05-19 11:33Z 80.81.192.30@rrc12 lastupd-last: 2005-05-19 12:33Z 80.81.192.126@rrc12 seen-at: rrc12 num-rispeers: 2 source: RISWHOIS
So, what are you plans now?
I think this announcement somehow came back by mistake. RIS is not allowed to use the address range as it has been returned to you officially.
The RIS operators should be able to find out what exactly is happening, I'm cc-ing them (as well as the internal ris-int list) on this mail.
RIS folk:
Though querying the RIS DB for this range via the risearch.html CGI yields zero results, the looking-glass pages do see 195.80.239.0/24 being announced to rrc12 by 2 peers at the DE-CIX.
http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC121&query=1&arg=195.80.239.0%2F24
Regards,
-- Rene
participants (2)
-
Arife Vural -
Rene Wilhelm