Re: NTT->HE earlier today (~10am EDT)

[Faisal Imtiaz <faisal () snappytelecom net>]

Hi Jared,

This is neat !, for someone who recently started working the IRR's, I can tell you that it has been very difficult 
finding all info in one location. 

What you shared is pretty neat !, and I would like to clean up the records associated with our prefixes.

Can you suggest some practical tips on getting older 'stale' records cleaned up from the different registries ?
(i.e. records created for us by others, in a former time-frame).

Regards

Faisal Imtiaz
Snappy Internet & Telecom

----- Original Message -----
> From: "Jared Mauch" <jared () puck nether net>
> To: "Mike Leber" <mleber () he net>
> Cc: nanog () nanog org
> Sent: Monday, June 29, 2015 5:51:18 PM
> Subject: Re: NTT->HE earlier today (~10am EDT)
>
> Greetings,
>
> We are aware of this issue and as is usual we filter customers based on their
> registered routes.  This creates some unique challenges that we have been
> speaking about publicly and privately with various groups.
>
> I have started the process (yay telco-speak) to fix this.
>
> It would be helpful if networks would take a look at what routes they have
> registered in the various IRRs as well as if their AS-SETs expand out to
> something quite large.  We have seen many customers import objects that then
> import their other upstream networks.
>
> We have found the IRR Explorer tool helpful to look at who has registered our
> IP space and to police these registrations with the various IRRs out there.
> http://irrexplorer.nlnog.net/
>
> http://irrexplorer.nlnog.net/prefix/184.105.213.86
>
> The stability of the routing ecosystem is something that I personally care a
> lot about and have privately given Mike and others my cell number to allow
> them to follow-up.  As is often operators end up chasing problems after the
> fact, and this appears to be no exception.  *sigh*
>
> - Jared
>
> > On Jun 29, 2015, at 5:18 PM, Mike Leber <mleber () he net> wrote:
> >
> > NTT's customer Sofia Connect leaked our routes to NTT.  NTT accepted these
> > routes instead of properly filtering their customer announcements.  As a
> > network of non-trivial size, announcing over 75,000 customer routes which
> > is nearly 15% of the IPv4 routing table, we'd expect the common courtesy
> > of having our ASN included in their customer facing AS-PATH filters, as we
> > extend this same courtesy to other networks of this size (such as AS2914).
> >
> > Mike.
> >
> > On 6/29/15 2:04 PM, Jim Popovitch wrote:
> > > Hello,
> > >
> > > I haven't seen anything to explain this, so I'm asking a larger
> > > audience.  Did anyone notice any unusual NTT or HE routing this AM?
> > >
> > > Here's what I saw:
> > >
> > >
> > >   2.|-- xe-0-1-0-17.r04.atlnga05.us.bb.gin.ntt.net  0.0%    20    0.8
> > > 0.7   0.6   0.9   0.1
> > >   3.|-- ae-2.r20.atlnga05.us.bb.gin.ntt.net         0.0%    20    4.6
> > > 6.2   0.5  13.6   4.8
> > >   4.|-- ae-4.r22.asbnva02.us.bb.gin.ntt.net         0.0%    20   15.3
> > > 15.0 13.9 15.8 0.7
> > >   5.|-- ae-4.r20.frnkge04.de.bb.gin.ntt.net         0.0%    20  127.3
> > > 106.7  98.5 127.3  11.1
> > >   6.|-- ae-2.r02.frnkge04.de.bb.gin.ntt.net         0.0%    20  126.8
> > > 126.0 125.7 126.8   0.2
> > >   7.|-- ae-1.r00.sofibu01.bg.bb.gin.ntt.net         0.0%    20  131.1
> > > 130.0 128.7 131.4   1.2
> > >   8.|-- 83.217.227.42                              80.0%    20  148.5
> > > 146.0 144.2 148.5   2.0
> > >   9.|-- ip-48-93.sofia-connect.net                 90.0%    20  184.5
> > > 163.8 143.1 184.5  29.3
> > >  10.|-- ???                                        100.0    20    0.0
> > > 0.0   0.0   0.0   0.0
> > >  11.|-- 10ge5-4.core1.vie1.he.net                  75.0%    20  160.7
> > > 150.4 143.9 160.7   6.3
> > >  12.|-- 10ge1-4.core1.prg1.he.net                  80.0%    20  158.4
> > > 159.5 157.9 161.1   1.6
> > >  13.|-- 10ge10-12.core1.fra1.he.net                75.0%    20  154.5
> > > 159.2 145.9 174.4  10.7
> > >  14.|-- 100ge5-2.core1.par2.he.net                 75.0%    20  187.9
> > > 172.9 157.1 187.9  11.1
> > >  15.|-- 100ge7-1.core1.nyc4.he.net                 78.9%    19  147.2
> > > 146.2 144.6 147.5   1.4
> > >  16.|-- 100ge7-2.core1.chi1.he.net                 78.9%    19  165.6
> > > 172.1 165.6 183.5   8.0
> > >  17.|-- 10ge15-2.core1.den1.he.net                 89.5%    19  201.3
> > > 204.7 201.3 208.1   4.8
> > >
> > >
> > > -Jim P.