[163714] in North American Network Operators' Group
RE: TWT 24.55.0.0/18 blacklisted by Team Cymru 38.229.66.20
daemon@ATHENA.MIT.EDU (Koch, Andrew)
Fri Jun 14 16:43:17 2013
From: "Koch, Andrew" <andrew.koch@tdstelecom.com>
To: "'paul.zugnoni@jivesoftware.com'" <paul.zugnoni@jivesoftware.com>,
"'nanog@nanog.org'" <nanog@nanog.org>
Date: Fri, 14 Jun 2013 20:42:12 +0000
In-Reply-To: <73A9A2579638014A8254BF9FE31DDB24795A59CC@mbx6.jiveland.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On June 14, 2013 15:22 Paul Zugnoni [mailto:paul.zugnoni@jivesoftware.com] =
wrote:
> Have at least one user, a TWT broadband customer, reporting his IP as
> being within 24.55.0.0/18, which I'm receiving from Team Cymru
> 38.229.66.20 Bogon peer. Anyone from TWT aware?
>=20
> > show route receive-protocol bgp 38.229.66.20 24.55.0.0/18 terse
>=20
> inet.0: 458306 destinations, 2258530 routes (458303 active, 2 holddown, 2
> hidden)
> Restart Complete
> Prefix Nexthop MED Lclpref AS path
> * 24.55.0.0/18 38.229.66.20 65332 I
>=20
> From all my transit providers, it's origin is 11427.
That prefix does not show on the HTTP version http://www.team-ymru.org/Serv=
ices/Bogons/fullbogons-ipv4.txt (# last updated 1371214084 (Fri Jun 14 12:4=
8:04 2013 GMT).
It appears this prefix was allocated by ARIN a couple weeks ago.
NetRange: 24.55.0.0 - 24.55.63.255=20
CIDR: 24.55.0.0/18=20
OriginAS: AS11427=20
NetName: RRSW=20
NetHandle: NET-24-55-0-0-1=20
Parent: NET-24-0-0-0-0=20
NetType: Direct Allocation=20
RegDate: 2013-05-28=20
Updated: 2013-05-28=20
Ref: http://whois.arin.net/rest/net/NET-24-55-0-0-1
I reported the mismatch between the BGP and HTTP feeds to support@cymru, bu=
t have not received a response yet. You may need to filter the announcemen=
t out from Team Cymru until they figure out why the BGP feed is not updated=
.
Andy Koch
TDS Telecom - IP Network Operations
andrew.koch@tdstelecom.com
