[164906] in North American Network Operators' Group
RE: Strange entries from AS1 in global table
daemon@ATHENA.MIT.EDU (James Sink)
Thu Aug 8 16:52:16 2013
From: James Sink <james.sink@freedomvoice.com>
CC: NANOG Mailing List <nanog@nanog.org>
Date: Thu, 8 Aug 2013 20:40:28 +0000
In-Reply-To: <15AC4C89-E85E-40B4-B72B-77691E822102@gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
That's correct, I have seen L3 use that for MPLS as recently as a few month=
s ago.=20
-James
-----Original Message-----
From: Brad Fleming [mailto:bdflemin@gmail.com]=20
Sent: Thursday, August 08, 2013 7:49 AM
To: Humberto Galiza
Cc: NANOG Mailing List
Subject: Re: Strange entries from AS1 in global table
I think Level(3) uses it for at least some L3 MPLS VPN stuff. We peer with =
that AS for dedicated SIP service transport for example.
On Aug 8, 2013, at 5:25 AM, Humberto Galiza <humbertogaliza@gmail.com> wrot=
e:
> Looking at our routers I can see this:
> 3549 3356 26114 1 i
> 12956 1239 23520 23383 1 ?
>=20
> but neither 26114 or 23383 are Brazilian ISP=B4s. Anyway, I guess it=B4s=
=20
> probably leaked routes or even use of AS 1 as private one (I don=B4t=20
> think level3 guys are using this AS anymore...).
>=20
> Cheers,
> Humberto Galiza
>=20
>=20
> 2013/8/4 Anurag Bhatia <me@anuragbhatia.com>:
>> Hello everyone
>>=20
>>=20
>> I was looking at global IPv4 table and saw some strange entries from AS1=
.
>> As per ARIN whois AS1 seems to be with Level3 but I noticed few=20
>> prefixes of Brazil based ISP - Netvip
>>=20
>>=20
>> http://bgp.he.net/AS1#_prefixes
>>=20
>>=20
>>=20
>> Looking at any prefix in detail, it seems like there are multiple=20
>> ASNs announcing same prefix.
>>=20
>> E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931=20
>> (Netvip's allocated ASN). Same is true with 177.185.98.0/24,=20
>> 177.185.98.0/24and so on.
>> http://bgp.he.net/net/177.185.96.0/24
>>=20
>> So seems like AS1 acting like a mirror for all announcements of=20
>> AS52931. To see who exactly gave "transit" to AS1 by Netvip in=20
>> Brazil, I checked Oregon and noticed these routes:
>>=20
>> 3356 3549 16735 52931 1 i
>>=20
>>=20
>>=20
>> Seems like AS52931 itself is acting as transit for AS1 (and AS16735=20
>> which seems like a backbone ISP in Brazil) is not filtering these=20
>> routes further passing to Level3 (AS3549+AS3356).
>>=20
>>=20
>>=20
>> I am curious to know what could be possible reason for an ASN like=20
>> AS1 acting in exact mirror of AS52931? Could it be a case of internal=20
>> use of
>> AS1 (assuming it to be private ASN)? May be it's a case of leaked=20
>> internal routes?
>>=20
>>=20
>>=20
>> Appreciate your time & answer.
>>=20
>>=20
>>=20
>> Thanks.
>>=20
>> --
>>=20
>> Anurag Bhatia
>> anuragbhatia.com
>>=20
>> Linkedin <http://in.linkedin.com/in/anuragbhatia21> |=20
>> Twitter<https://twitter.com/anurag_bhatia>
>> Skype: anuragbhatia.com
>=20
