New subject: NCC#2002092793 RIS hijacking 195.80.239.0/24, finally it's gone!

8 Jun 2005

      Hi Arife,

I understand it's a difficult issue; fortunately we're left
with only 1 debogon prefix:

	whois -h riswhois -F -M 87/8 |grep 12654
	12654	87.255.248.0/21	1

The other one, 87.192.0.0/16, is now announced by AS25441 and seen
by 64 RIS peers. Perhaps all it takes to clear the bogus debogon
is for a new owner to insert a fresh announcement?

If you want to continue contacting every AS which according
to the routing tables sees the debogon route, you could
also check route-views' routers for info.

For example, @oregon-ix:

   x27$ telnet route-views.oregon-ix.net
   [...]
   route-views.oregon-ix.net>sh ip bgp 87.255.248.0/21
   BGP routing table entry for 87.255.248.0/21, version 60855137
   Paths: (1 available, best #1, table Default-IP-Routing-Table)
   Not advertised to any peer
   3277 6820 3246 5400 5400 3257 28747 12654
    194.85.4.55 from 194.85.4.55 (194.85.4.55)
      Origin IGP, localpref 100, valid, external, best
      Community: 3277:6820 3277:65361

Only the "5400 3257 28747 12654" part is in common with RIS,
the other ASNs are different.

Cheers,

-- Rene
...
Hi Mike,
I'm chasing those guys who still think we announce that prefix. But I have
not got any useful info from them. Last, I contacted with AS9177, but I
have not got any reply back.
I attached the e-mail that I got from Tiscali, it looks this route still
is hanging there because of a Cisco bug or maybe other vendor OS bugs.
I do not know what else I could do be honest ...
Arife
--
From: Alexander Koch <koch@tiscali.net>
To: Arife Vural <arife@ripe.net>
Subject: Re: Need a favor
Message-ID: <20050608120049.GA21021@shekinah.ip.tiscali.net>
References: <20050608120017.GC22290@ripe.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050608120017.GC22290@ripe.net>
Organization: Tiscali International Network B.V.
X-NCC-RegID: eu.nacnet
User-Agent: Mutt/1.5.9i
X-RIPE-Spam-Level: 
X-RIPE-Spam-Tests: BAYES_00
X-RIPE-Spam-Status: U 0.298951 / -2.6
X-RIPE-Signature: f24e950eeaafece3eb369dee26ae860b
Status: RO
Content-Length: 1707
Lines: 50
Hello Arife,
what you see is probably comparable to IPv6 ghosts routes
where a /35 more specific route sticked in the routing table
long after it was theoretically withdrawn.
We currently do not see the route from RealROOT, but then,
AS28747 was changed to AS 9009 two weeks ago or so. Also
seeing the AS path I believe you can safely assume AS5400
(BT's backbone) is not seeing it either... your best bet
might be to contact bgp@sunrise.net and/or AS9177 directly.
Does that help?
Best regards,
Alexander
On Wed, 8 June 2005 14:00:17 +0200, Arife Vural wrote:
...
Hi Alexander,
Part of De-bogonising project we were announcing 87/8. We stopped it
for a while, but it's seen in routing tables. Be honest, I could not
explain why this route was still in the routing tables even if we do
not have any entries in our config file for that prefix.
On rrc00, it's seen like that,
rrc00> sh ip bgp 87.255.248.0/21 
BGP routing table entry for 87.255.248.0/21
Paths: (1 available, best #1, table Default-IP-Routing-Table)
  Not advertised to any peer
  9177 6730 5400 3257 28747 12654
    212.47.190.1 from 212.47.190.1 (213.193.66.42)
      Origin IGP, localpref 100, valid, external, best
      Last update: Wed Jun  8 10:20:46 2005
I contacted with AS28747, but could not get any reply back to check
whether they get this prefix from us or not.
I would like to ask you to check whether you get this prefix from AS28747.  
If so, not sure but resetting the session with AS28747 would make any help?
Kind regards.
Arife
-- 
Alexander Koch <koch@tiscali.net> / ako4-ripe
Tiscali Int., Peering Coordination
Phone +49 6103 916 480, Fax +49 6103 916 464
On Tue, Jun 07, 2005 at 10:13:17AM +0200, RIPE NCC Hostmaster wrote:
...
Dear Colleagues,
It's quiet in this ticket for quite a while, while on the Net it's not
so quiet: the ranges are still (again?) announced and visible 
(in case you don't know):
route:        87.255.248.0/21
origin:       AS12654
descr:        RIPE-NCC-RIS-AS RIPE NCC RIS Project.
lastupd-frst: 2005-06-05 14:10Z  212.47.190.1@rrc00
lastupd-last: 2005-06-05 14:10Z  212.47.190.1@rrc00
seen-at:      rrc00
num-rispeers: 1
source:       RISWHOIS
We are still curious when is it going to stop.
--
Sincerely,
Mike Petuschak
RIPE NCC
...
Hi Arife,
Thanks for the update.
Today RISwhois only sees 1 (one) peer at rrc00 forwarding the
old debogon announcments from 87/8:
route:        87.192.0.0/16
  origin:       AS12654
  descr:        RIPE-NCC-RIS-AS RIPE NCC RIS Project.
  lastupd-frst: 2005-06-01 10:11Z  212.47.190.1@rrc00
  lastupd-last: 2005-06-01 10:11Z  212.47.190.1@rrc00
  seen-at:      rrc00
  num-rispeers: 1
  source:       RISWHOIS
route:        87.255.248.0/21
  origin:       AS12654
  descr:        RIPE-NCC-RIS-AS RIPE NCC RIS Project.
  lastupd-frst: 2005-06-01 10:11Z  212.47.190.1@rrc00
  lastupd-last: 2005-06-01 10:11Z  212.47.190.1@rrc00
  seen-at:      rrc00
  num-rispeers: 1
  source:       RISWHOIS
The last update is yesterday, 10:11 UTC  (14:11 local time)
is that when you reset the session with AS28747?
-- Rene

Re: NCC#2002092793 [ris-int] RIS hijacking 195.80.239.0/24

Rene Wilhelm

Arife Vural

tags

participants (2)