[144804] in North American Network Operators' Group
Re: Saudi Telecom sending route with invalid attributes
daemon@ATHENA.MIT.EDU (Ryan Gray)
Mon Sep 19 15:11:06 2011
From: Ryan Gray <ryan@longlines.com>
In-Reply-To: <B9EBD2474913AD4A995B8C7B8BEF8C0E14F19D22DE@FHDP1LUMXC7V43.us.one.verizon.com>
Date: Mon, 19 Sep 2011 14:09:12 -0500
To: "Schiller, Heather A" <heather.schiller@verizon.com>
Cc: "Jonas Frey \(Probe Networks\)" <jf@probe-networks.de>,
"nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Actually just started seeing these problems again today. Is anyone else =
seeing this today from something other than 212.118.142.0/24? Looks =
like it started about two hours ago.
Regards,
Ryan Gray
Long Lines
www.longlines.com
On Sep 12, 2011, at 8:18 PM, Schiller, Heather A wrote:
>=20
> Could be this..?
>=20
> =
http://www.juniper.net/techpubs/en_US/junos11.2/topics/reference/configura=
tion-statement/independent-domain-edit-routing-options.html =20
>=20
> "unrecognized transitive attributes" depend on whatever code version =
you are running... What's more important is how the unrecoginized =
attribute is handled. Ideally you accept and pass the route and log it. =
The problem is with devices that aren't so graceful.. dropping sessions =
and wreaking havoc:
>=20
> http://www.cisco.com/warp/public/707/cisco-sa-20100827-bgp.shtml
>=20
> --Heather=20
>=20
> -----Original Message-----
> From: Aftab Siddiqui [mailto:aftab.siddiqui@gmail.com]=20
> Sent: Saturday, September 10, 2011 6:49 PM
> To: Richard Barnes
> Cc: Jonas Frey (Probe Networks); nanog@nanog.org
> Subject: Re: Saudi Telecom sending route with invalid attributes =
212.118.142.0/24
>=20
> with in the span of couple of hours this prefix was originated from 3 =
ASN i.e. AS3561 (Savvis), AS8866 (BTC) and AS25019 (STC original =
custodians).
>=20
> As per the STC it was orginated by one of their customer having =
Juniper router. but I still don't understand why/how they are adv this =
prefix with unrecog transitive attributes.
>=20
> Can any one suggest.
>=20
> Regards,
>=20
> Aftab A. Siddiqui
>=20
>=20
> On Sun, Sep 11, 2011 at 3:26 AM, Richard Barnes =
<richard.barnes@gmail.com>wrote:
>=20
>> Looks like the RIS collectors are seeing it originating mostly from=20=
>> STC and KACST ASNs:
>> <http://stat.ripe.net/212.118.142.0/24>
>>=20
>> Some of the "show ip bgp" reports on that screen are also showing
>> AS8866 "BTC-AS Bulgarian Telecommunication Company". Not sure what's=20=
>> up with that.
>>=20
>> --Richard
>>=20
>>=20
>>=20
>> On Sat, Sep 10, 2011 at 2:01 PM, Christopher Morrow=20
>> <morrowc.lists@gmail.com> wrote:
>>> On Fri, Sep 9, 2011 at 9:26 PM, Kyle Duren <pixitha.kyle@gmail.com>
>> wrote:
>>>> Is this announcement still showing up this way (no easy way to=20
>>>> check myself).
>>>=20
>>> ripe ris?
>>>=20
>>>> -Kyle
>>>>=20
>>>> On Thu, Sep 8, 2011 at 4:20 PM, Clay Haynes=20
>>>> <chaynes@centracomm.net>
>> wrote:
>>>>=20
>>>>> On Thu, Sep 8, 2011 at 7:11 PM, Jonas Frey (Probe Networks) <=20
>>>>> jf@probe-networks.de> wrote:
>>>>>=20
>>>>>> Hello,
>>>>>>=20
>>>>>> anyone else getting a route for 212.118.142.0/24 with invalid=20
>>>>>> attributes? Seems this is (again) causing problems with some=20
>>>>>> (older) routers/software.
>>>>>>=20
>>>>>> Announcement bits (4): 0-KRT 3-KRT 5-Resolve tree=20
>>>>>> 1 6-Resolve tree 2
>>>>>> AS path: 6453 39386 25019 I Unrecognized =
Attributes:
>> 39
>>>>>> bytes
>>>>>> AS path: Attr flags e0 code 80: 00 00 fd 88 40=20
>>>>>> 01 01
>> 02
>>>>>> 40 02 04 02 01 5b a0 c0 11 04 02 01 fc da 80 04 04 00 00 00 01=20
>>>>>> 40 05
>> 04
>>>>>> 00 00 00 64
>>>>>> Accepted Multipath
>>>>>>=20
>>>>>>=20
>>>>>> -Jonas
>>>>>>=20
>>>>>>=20
>>>>> Yup! We're seeing the same thing too, and we're filtering it out.
>>>>> Originating AS is 25019
>>>>>=20
>>>>> -Clay
>>>>>=20
>>>>=20
>>>=20
>>>=20
>>=20
>>=20
>=20
>=20
