Re: [ris-int] RIS hijacking 195.80.239.0/24 NCC#2002092793
Hi Arife, Last friday I wrote:
Something still seems wrong, riswhois still sees the prefix in the dumps and presumably looking glass will also report them. (no time to check those right now):
Checking looking glasses today, 195.80.239.0/24 is no longer seen. RISwhois still sees it, but that's due to rrc12 raw data not making it to halfweg.ripe.net since thursday May 26th. (subject of another ris@ripe.net ticket) However, the debogon prefixes 87.192.0.0/16 and 87.255.248.0/21 are still seen in the RRC looking glasses: http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC051&query=1&arg=87.192.0.0%2F16 http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC051&query=1&arg=87.255.248.0%2F21 http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=1&arg=87.255.248.0%2F21 http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=1&arg=87.192.0.0%2F16 If you or James or someone else took specific action to make 195.80.239.0/24 go away, you may want to do the same for these prefixes under 87/8. Cheers, -- Rene
Hi all,
If you or James or someone else took specific action to make 195.80.239.0/24 go away, you may want to do the same for these prefixes under 87/8.
The agreement was that RS would send a ticket to RIS when they start to allocate from a /8 and it thus has to be removed from the debogon list. I did see the ticket weeks ago but the prefixes have not been removed. Can you (probably SED and OPS) please check the procedure for handling such requests, then stick to it? Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
Hi Henk,
If you or James or someone else took specific action to make 195.80.239.0/24 go away, you may want to do the same for these prefixes under 87/8.
The agreement was that RS would send a ticket to RIS when they start to allocate from a /8 and it thus has to be removed from the debogon list. I did see the ticket weeks ago but the prefixes have not been removed.
Prefixes were removed that time, but then (after quite a long time) re-inserted. P.S. Actually, the agreement was that RS sends a message to james@ripe.net, and dfk@ripe.net only, however we started CC'ing ris@ripe.net too as no one was answering the messages. -- Sincerely, Mike Petuschak RIPE NCC
Hi Mike,
Prefixes were removed that time, but then (after quite a long time) re-inserted.
Which is strange, right?
P.S. Actually, the agreement was that RS sends a message to james@ripe.net, and dfk@ripe.net only, however we started CC'ing ris@ripe.net too as no one was answering the messages.
That is actually my problem ;-) I don't really care who is mailing who, but I do care if there is no follow-up on the mails. Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
Hi guys, To send those request, ris@ripe.net or ris-request@ripe.net are the right place. I look at the ticket after I got back from NANOG, and could not find any clear reason why we still announced that De-bogon prefixes. Nothing in bgpd config files, and also no whois entries. My suspicion is few ASes somehow (?) they still get those prefixes from us. I shutdown those sessions now, and will look at with James, whether we can find anything that would help to sort out this problem. Arife On Tue, May 31, 2005 at 11:49:39AM +0200, Henk Uijterwaal wrote:
Hi Mike,
Prefixes were removed that time, but then (after quite a long time) re-inserted.
Which is strange, right?
P.S. Actually, the agreement was that RS sends a message to james@ripe.net, and dfk@ripe.net only, however we started CC'ing ris@ripe.net too as no one was answering the messages.
That is actually my problem ;-) I don't really care who is mailing who, but I do care if there is no follow-up on the mails.
Henk
------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------
Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
I do not know how much this help but we have route-set, it's called AS12654:RS-RIS and 87/8 is mentioning there. I updated it, and guys who get prefixes from us use that route-set. But those change will not be effected so soon. During the day, I will check it out and let you know when those routes disappeared from BGP routing tables. Arife On Wed, Jun 01, 2005 at 10:20:44AM +0200, Arife Vural wrote:
Hi guys,
To send those request, ris@ripe.net or ris-request@ripe.net are the right place.
I look at the ticket after I got back from NANOG, and could not find any clear reason why we still announced that De-bogon prefixes. Nothing in bgpd config files, and also no whois entries.
My suspicion is few ASes somehow (?) they still get those prefixes from us. I shutdown those sessions now, and will look at with James, whether we can find anything that would help to sort out this problem.
Arife
On Tue, May 31, 2005 at 11:49:39AM +0200, Henk Uijterwaal wrote:
Hi Mike,
Prefixes were removed that time, but then (after quite a long time) re-inserted.
Which is strange, right?
P.S. Actually, the agreement was that RS sends a message to james@ripe.net, and dfk@ripe.net only, however we started CC'ing ris@ripe.net too as no one was answering the messages.
That is actually my problem ;-) I don't really care who is mailing who, but I do care if there is no follow-up on the mails.
Henk
------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------
Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
Latest update about this issue: It looks only AS28747 is announcing prefixes from 87/8 even if we do not announce it. I have contacted them to check out which prefixes they get from us and also reset the session. I hope that help. I had a chat with james, that might be a bug on router software, not to propogate the routes properly. But, still it does not explain how that route got there. Arife On Tue, May 31, 2005 at 11:49:39AM +0200, Henk Uijterwaal wrote:
Hi Mike,
Prefixes were removed that time, but then (after quite a long time) re-inserted.
Which is strange, right?
P.S. Actually, the agreement was that RS sends a message to james@ripe.net, and dfk@ripe.net only, however we started CC'ing ris@ripe.net too as no one was answering the messages.
That is actually my problem ;-) I don't really care who is mailing who, but I do care if there is no follow-up on the mails.
Henk
------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------
Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
Hi Arife, Thanks for the update. Today RISwhois only sees 1 (one) peer at rrc00 forwarding the old debogon announcments from 87/8: route: 87.192.0.0/16 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-06-01 10:11Z 212.47.190.1@rrc00 lastupd-last: 2005-06-01 10:11Z 212.47.190.1@rrc00 seen-at: rrc00 num-rispeers: 1 source: RISWHOIS route: 87.255.248.0/21 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-06-01 10:11Z 212.47.190.1@rrc00 lastupd-last: 2005-06-01 10:11Z 212.47.190.1@rrc00 seen-at: rrc00 num-rispeers: 1 source: RISWHOIS The last update is yesterday, 10:11 UTC (14:11 local time) is that when you reset the session with AS28747? -- Rene On Wed, 1 Jun 2005, Arife Vural wrote:
Latest update about this issue:
It looks only AS28747 is announcing prefixes from 87/8 even if we do not announce it. I have contacted them to check out which prefixes they get from us and also reset the session.
I hope that help.
I had a chat with james, that might be a bug on router software, not to propogate the routes properly. But, still it does not explain how that route got there.
Arife
On Tue, May 31, 2005 at 11:49:39AM +0200, Henk Uijterwaal wrote:
Hi Mike,
Prefixes were removed that time, but then (after quite a long time) re-inserted.
Which is strange, right?
P.S. Actually, the agreement was that RS sends a message to james@ripe.net, and dfk@ripe.net only, however we started CC'ing ris@ripe.net too as no one was answering the messages.
That is actually my problem ;-) I don't really care who is mailing who, but I do care if there is no follow-up on the mails.
Henk
------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------
Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
Dear Colleagues, It's quiet in this ticket for quite a while, while on the Net it's not so quiet: the ranges are still (again?) announced and visible (in case you don't know): route: 87.255.248.0/21 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-06-05 14:10Z 212.47.190.1@rrc00 lastupd-last: 2005-06-05 14:10Z 212.47.190.1@rrc00 seen-at: rrc00 num-rispeers: 1 source: RISWHOIS We are still curious when is it going to stop. -- Sincerely, Mike Petuschak RIPE NCC
Hi Arife,
Thanks for the update.
Today RISwhois only sees 1 (one) peer at rrc00 forwarding the old debogon announcments from 87/8:
route: 87.192.0.0/16 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-06-01 10:11Z 212.47.190.1@rrc00 lastupd-last: 2005-06-01 10:11Z 212.47.190.1@rrc00 seen-at: rrc00 num-rispeers: 1 source: RISWHOIS
route: 87.255.248.0/21 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-06-01 10:11Z 212.47.190.1@rrc00 lastupd-last: 2005-06-01 10:11Z 212.47.190.1@rrc00 seen-at: rrc00 num-rispeers: 1 source: RISWHOIS
The last update is yesterday, 10:11 UTC (14:11 local time) is that when you reset the session with AS28747?
-- Rene
On Wed, 1 Jun 2005, Arife Vural wrote:
Latest update about this issue:
It looks only AS28747 is announcing prefixes from 87/8 even if we do not announce it. I have contacted them to check out which prefixes they get from us and also reset the session.
I hope that help.
I had a chat with james, that might be a bug on router software, not to propogate the routes properly. But, still it does not explain how that route got there.
Arife
On Tue, May 31, 2005 at 11:49:39AM +0200, Henk Uijterwaal wrote:
Hi Mike,
Prefixes were removed that time, but then (after quite a long time) re-inserted.
Which is strange, right?
P.S. Actually, the agreement was that RS sends a message to james@ripe.net, and dfk@ripe.net only, however we started CC'ing ris@ripe.net too as no one was answering the messages.
That is actually my problem ;-) I don't really care who is mailing who, but I do care if there is no follow-up on the mails.
Henk
------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------
Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
Hi Mike, I'm chasing those guys who still think we announce that prefix. But I have not got any useful info from them. Last, I contacted with AS9177, but I have not got any reply back. I attached the e-mail that I got from Tiscali, it looks this route still is hanging there because of a Cisco bug or maybe other vendor OS bugs. I do not know what else I could do be honest ... Arife -- From: Alexander Koch <koch@tiscali.net> To: Arife Vural <arife@ripe.net> Subject: Re: Need a favor Message-ID: <20050608120049.GA21021@shekinah.ip.tiscali.net> References: <20050608120017.GC22290@ripe.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050608120017.GC22290@ripe.net> Organization: Tiscali International Network B.V. X-NCC-RegID: eu.nacnet User-Agent: Mutt/1.5.9i X-RIPE-Spam-Level: X-RIPE-Spam-Tests: BAYES_00 X-RIPE-Spam-Status: U 0.298951 / -2.6 X-RIPE-Signature: f24e950eeaafece3eb369dee26ae860b Status: RO Content-Length: 1707 Lines: 50 Hello Arife, what you see is probably comparable to IPv6 ghosts routes where a /35 more specific route sticked in the routing table long after it was theoretically withdrawn. We currently do not see the route from RealROOT, but then, AS28747 was changed to AS 9009 two weeks ago or so. Also seeing the AS path I believe you can safely assume AS5400 (BT's backbone) is not seeing it either... your best bet might be to contact bgp@sunrise.net and/or AS9177 directly. Does that help? Best regards, Alexander On Wed, 8 June 2005 14:00:17 +0200, Arife Vural wrote:
Hi Alexander,
Part of De-bogonising project we were announcing 87/8. We stopped it for a while, but it's seen in routing tables. Be honest, I could not explain why this route was still in the routing tables even if we do not have any entries in our config file for that prefix.
On rrc00, it's seen like that,
rrc00> sh ip bgp 87.255.248.0/21 BGP routing table entry for 87.255.248.0/21 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 9177 6730 5400 3257 28747 12654 212.47.190.1 from 212.47.190.1 (213.193.66.42) Origin IGP, localpref 100, valid, external, best Last update: Wed Jun 8 10:20:46 2005
I contacted with AS28747, but could not get any reply back to check whether they get this prefix from us or not.
I would like to ask you to check whether you get this prefix from AS28747. If so, not sure but resetting the session with AS28747 would make any help?
Kind regards.
Arife
-- Alexander Koch <koch@tiscali.net> / ako4-ripe Tiscali Int., Peering Coordination Phone +49 6103 916 480, Fax +49 6103 916 464 On Tue, Jun 07, 2005 at 10:13:17AM +0200, RIPE NCC Hostmaster wrote:
Dear Colleagues,
It's quiet in this ticket for quite a while, while on the Net it's not so quiet: the ranges are still (again?) announced and visible (in case you don't know):
route: 87.255.248.0/21 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-06-05 14:10Z 212.47.190.1@rrc00 lastupd-last: 2005-06-05 14:10Z 212.47.190.1@rrc00 seen-at: rrc00 num-rispeers: 1 source: RISWHOIS
We are still curious when is it going to stop.
-- Sincerely,
Mike Petuschak RIPE NCC
Hi Arife,
Thanks for the update.
Today RISwhois only sees 1 (one) peer at rrc00 forwarding the old debogon announcments from 87/8:
route: 87.192.0.0/16 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-06-01 10:11Z 212.47.190.1@rrc00 lastupd-last: 2005-06-01 10:11Z 212.47.190.1@rrc00 seen-at: rrc00 num-rispeers: 1 source: RISWHOIS
route: 87.255.248.0/21 origin: AS12654 descr: RIPE-NCC-RIS-AS RIPE NCC RIS Project. lastupd-frst: 2005-06-01 10:11Z 212.47.190.1@rrc00 lastupd-last: 2005-06-01 10:11Z 212.47.190.1@rrc00 seen-at: rrc00 num-rispeers: 1 source: RISWHOIS
The last update is yesterday, 10:11 UTC (14:11 local time) is that when you reset the session with AS28747?
-- Rene
On Wed, 1 Jun 2005, Arife Vural wrote:
Latest update about this issue:
It looks only AS28747 is announcing prefixes from 87/8 even if we do not announce it. I have contacted them to check out which prefixes they get from us and also reset the session.
I hope that help.
I had a chat with james, that might be a bug on router software, not to propogate the routes properly. But, still it does not explain how that route got there.
Arife
On Tue, May 31, 2005 at 11:49:39AM +0200, Henk Uijterwaal wrote:
Hi Mike,
Prefixes were removed that time, but then (after quite a long time) re-inserted.
Which is strange, right?
P.S. Actually, the agreement was that RS sends a message to james@ripe.net, and dfk@ripe.net only, however we started CC'ing ris@ripe.net too as no one was answering the messages.
That is actually my problem ;-) I don't really care who is mailing who, but I do care if there is no follow-up on the mails.
Henk
------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------
Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
participants (4)
-
Arife Vural -
Henk Uijterwaal -
Rene Wilhelm -
RIPE NCC Hostmaster