[144806] in North American Network Operators' Group
RE: Saudi Telecom sending route with invalid attributes
daemon@ATHENA.MIT.EDU (Schiller, Heather A)
Mon Sep 19 15:27:31 2011
From: "Schiller, Heather A" <heather.schiller@verizon.com>
To: Ryan Gray <ryan@longlines.com>
Date: Mon, 19 Sep 2011 15:26:29 -0400
In-Reply-To: <C353DE35-7505-48B1-AFF3-C20DB30A966B@longlines.com>
Cc: "Jonas Frey \(Probe Networks\)" <jf@probe-networks.de>,
"nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Seeing it again here too.. Has anyone contacted them?
..and for folks who are choosing to blackhole the prefix in order to supres=
s the route, please remember not to export it!
AS25019 SAUDINETSTC-AS Autonomus System Number for SaudiNet 2011-09-08 18:2=
3:53 UTC 2011-09-19 19:16:27 UTC
AS8866 BTC-AS Bulgarian Telecommunication Company Plc. 2011-09-08 18:35:14 =
UTC 2011-09-19 19:15:42 UTC
AS10026 PACNET Pacnet Global Ltd 2011-09-11 02:41:40 UTC 2011-09-19 16:00:0=
0 UTC
AS8767 MNET-AS M-net AS 2011-09-14 12:13:01 UTC 2011-09-14 12:14:00 UTC
AS3561 SAVVIS - Savvis 2011-09-09 19:42:15 UTC 2011-09-10 16:27:18 UTC
AS3549 GBLX Global Crossing Ltd. 2011-09-09 16:13:15 UTC 2011-09-09 17:05:3=
8 UTC
AS1239 SPRINTLINK - Sprint 2011-09-09 03:18:28 UTC 2011-09-09 15:56:41 UTC
AS65000 -Private Use AS- 2011-09-08 18:34:28 UTC 2011-09-08 18:34:29 UTC
--heather=20
-----Original Message-----
From: Ryan Gray [mailto:ryan@longlines.com]=20
Sent: Monday, September 19, 2011 3:09 PM
To: Schiller, Heather A
Cc: Aftab Siddiqui; Richard Barnes; Jonas Frey (Probe Networks); nanog@nano=
g.org
Subject: Re: Saudi Telecom sending route with invalid attributes 212.118.14=
2.0/24
Actually just started seeing these problems again today. Is anyone else se=
eing this today from something other than 212.118.142.0/24? Looks like it =
started about two hours ago.
Regards,
Ryan Gray
Long Lines
www.longlines.com
On Sep 12, 2011, at 8:18 PM, Schiller, Heather A wrote:
>=20
> Could be this..?
>=20
> http://www.juniper.net/techpubs/en_US/junos11.2/topics/reference/confi
> guration-statement/independent-domain-edit-routing-options.html
>=20
> "unrecognized transitive attributes" depend on whatever code version you =
are running... What's more important is how the unrecoginized attribute is =
handled. Ideally you accept and pass the route and log it. The problem is=
with devices that aren't so graceful.. dropping sessions and wreaking havo=
c:
>=20
> http://www.cisco.com/warp/public/707/cisco-sa-20100827-bgp.shtml
>=20
> --Heather
>=20
> -----Original Message-----
> From: Aftab Siddiqui [mailto:aftab.siddiqui@gmail.com]
> Sent: Saturday, September 10, 2011 6:49 PM
> To: Richard Barnes
> Cc: Jonas Frey (Probe Networks); nanog@nanog.org
> Subject: Re: Saudi Telecom sending route with invalid attributes=20
> 212.118.142.0/24
>=20
> with in the span of couple of hours this prefix was originated from 3 ASN=
i.e. AS3561 (Savvis), AS8866 (BTC) and AS25019 (STC original custodians).
>=20
> As per the STC it was orginated by one of their customer having Juniper r=
outer. but I still don't understand why/how they are adv this prefix with u=
nrecog transitive attributes.
>=20
> Can any one suggest.
>=20
> Regards,
>=20
> Aftab A. Siddiqui
>=20
>=20
> On Sun, Sep 11, 2011 at 3:26 AM, Richard Barnes <richard.barnes@gmail.com=
>wrote:
>=20
>> Looks like the RIS collectors are seeing it originating mostly from=20
>> STC and KACST ASNs:
>> <http://stat.ripe.net/212.118.142.0/24>
>>=20
>> Some of the "show ip bgp" reports on that screen are also showing
>> AS8866 "BTC-AS Bulgarian Telecommunication Company". Not sure what's=20
>> up with that.
>>=20
>> --Richard
>>=20
>>=20
>>=20
>> On Sat, Sep 10, 2011 at 2:01 PM, Christopher Morrow=20
>> <morrowc.lists@gmail.com> wrote:
>>> On Fri, Sep 9, 2011 at 9:26 PM, Kyle Duren <pixitha.kyle@gmail.com>
>> wrote:
>>>> Is this announcement still showing up this way (no easy way to=20
>>>> check myself).
>>>=20
>>> ripe ris?
>>>=20
>>>> -Kyle
>>>>=20
>>>> On Thu, Sep 8, 2011 at 4:20 PM, Clay Haynes=20
>>>> <chaynes@centracomm.net>
>> wrote:
>>>>=20
>>>>> On Thu, Sep 8, 2011 at 7:11 PM, Jonas Frey (Probe Networks) <=20
>>>>> jf@probe-networks.de> wrote:
>>>>>=20
>>>>>> Hello,
>>>>>>=20
>>>>>> anyone else getting a route for 212.118.142.0/24 with invalid=20
>>>>>> attributes? Seems this is (again) causing problems with some
>>>>>> (older) routers/software.
>>>>>>=20
>>>>>> Announcement bits (4): 0-KRT 3-KRT 5-Resolve tree
>>>>>> 1 6-Resolve tree 2
>>>>>> AS path: 6453 39386 25019 I Unrecognized Attributes:
>> 39
>>>>>> bytes
>>>>>> AS path: Attr flags e0 code 80: 00 00 fd 88 40
>>>>>> 01 01
>> 02
>>>>>> 40 02 04 02 01 5b a0 c0 11 04 02 01 fc da 80 04 04 00 00 00 01 40=20
>>>>>> 05
>> 04
>>>>>> 00 00 00 64
>>>>>> Accepted Multipath
>>>>>>=20
>>>>>>=20
>>>>>> -Jonas
>>>>>>=20
>>>>>>=20
>>>>> Yup! We're seeing the same thing too, and we're filtering it out.
>>>>> Originating AS is 25019
>>>>>=20
>>>>> -Clay
>>>>>=20
>>>>=20
>>>=20
>>>=20
>>=20
>>=20
>=20
>=20
