[181620] in North American Network Operators' Group
Re: NTT->HE earlier today (~10am EDT)
daemon@ATHENA.MIT.EDU (Jared Mauch)
Mon Jun 29 17:51:24 2015
X-Original-To: nanog@nanog.org
From: Jared Mauch <jared@puck.nether.net>
In-Reply-To: <5591B620.2000407@he.net>
Date: Mon, 29 Jun 2015 17:51:18 -0400
To: Mike Leber <mleber@he.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
Greetings,
We are aware of this issue and as is usual we filter customers based on =
their registered routes. This creates some unique challenges that we =
have been speaking about publicly and privately with various groups.
I have started the process (yay telco-speak) to fix this.
It would be helpful if networks would take a look at what routes they =
have registered in the various IRRs as well as if their AS-SETs expand =
out to something quite large. We have seen many customers import =
objects that then import their other upstream networks.
We have found the IRR Explorer tool helpful to look at who has =
registered our IP space and to police these registrations with the =
various IRRs out there. http://irrexplorer.nlnog.net/
http://irrexplorer.nlnog.net/prefix/184.105.213.86
The stability of the routing ecosystem is something that I personally =
care a lot about and have privately given Mike and others my cell number =
to allow them to follow-up. As is often operators end up chasing =
problems after the fact, and this appears to be no exception. *sigh*
- Jared
> On Jun 29, 2015, at 5:18 PM, Mike Leber <mleber@he.net> wrote:
>=20
> NTT's customer Sofia Connect leaked our routes to NTT. NTT accepted =
these routes instead of properly filtering their customer announcements. =
As a network of non-trivial size, announcing over 75,000 customer =
routes which is nearly 15% of the IPv4 routing table, we'd expect the =
common courtesy of having our ASN included in their customer facing =
AS-PATH filters, as we extend this same courtesy to other networks of =
this size (such as AS2914).
>=20
> Mike.
>=20
> On 6/29/15 2:04 PM, Jim Popovitch wrote:
>> Hello,
>>=20
>> I haven't seen anything to explain this, so I'm asking a larger
>> audience. Did anyone notice any unusual NTT or HE routing this AM?
>>=20
>> Here's what I saw:
>>=20
>>=20
>> 2.|-- xe-0-1-0-17.r04.atlnga05.us.bb.gin.ntt.net 0.0% 20 0.8
>> 0.7 0.6 0.9 0.1
>> 3.|-- ae-2.r20.atlnga05.us.bb.gin.ntt.net 0.0% 20 4.6
>> 6.2 0.5 13.6 4.8
>> 4.|-- ae-4.r22.asbnva02.us.bb.gin.ntt.net 0.0% 20 15.3
>> 15.0 13.9 15.8 0.7
>> 5.|-- ae-4.r20.frnkge04.de.bb.gin.ntt.net 0.0% 20 127.3
>> 106.7 98.5 127.3 11.1
>> 6.|-- ae-2.r02.frnkge04.de.bb.gin.ntt.net 0.0% 20 126.8
>> 126.0 125.7 126.8 0.2
>> 7.|-- ae-1.r00.sofibu01.bg.bb.gin.ntt.net 0.0% 20 131.1
>> 130.0 128.7 131.4 1.2
>> 8.|-- 83.217.227.42 80.0% 20 148.5
>> 146.0 144.2 148.5 2.0
>> 9.|-- ip-48-93.sofia-connect.net 90.0% 20 184.5
>> 163.8 143.1 184.5 29.3
>> 10.|-- ??? 100.0 20 0.0
>> 0.0 0.0 0.0 0.0
>> 11.|-- 10ge5-4.core1.vie1.he.net 75.0% 20 160.7
>> 150.4 143.9 160.7 6.3
>> 12.|-- 10ge1-4.core1.prg1.he.net 80.0% 20 158.4
>> 159.5 157.9 161.1 1.6
>> 13.|-- 10ge10-12.core1.fra1.he.net 75.0% 20 154.5
>> 159.2 145.9 174.4 10.7
>> 14.|-- 100ge5-2.core1.par2.he.net 75.0% 20 187.9
>> 172.9 157.1 187.9 11.1
>> 15.|-- 100ge7-1.core1.nyc4.he.net 78.9% 19 147.2
>> 146.2 144.6 147.5 1.4
>> 16.|-- 100ge7-2.core1.chi1.he.net 78.9% 19 165.6
>> 172.1 165.6 183.5 8.0
>> 17.|-- 10ge15-2.core1.den1.he.net 89.5% 19 201.3
>> 204.7 201.3 208.1 4.8
>>=20
>>=20
>> -Jim P.
