Re: Saudi Telecom sending route with invalid attributes 212.118.142.0/24

[Ryan Gray <ryan () longlines com>]

Actually just started seeing these problems again today.  Is anyone else seeing this today from something other than 
212.118.142.0/24?  Looks like it started about two hours ago.


Regards,
Ryan Gray
Long Lines
www.longlines.com





On Sep 12, 2011, at 8:18 PM, Schiller, Heather A wrote:

> Could be this..?
>
> http://www.juniper.net/techpubs/en_US/junos11.2/topics/reference/configuration-statement/independent-domain-edit-routing-options.html
>   
>
> "unrecognized transitive attributes" depend on whatever code version you are running... What's more important is how 
> the unrecoginized attribute is handled.  Ideally you accept and pass the route and log it.  The problem is with 
> devices that aren't so graceful.. dropping sessions and wreaking havoc:
>
> http://www.cisco.com/warp/public/707/cisco-sa-20100827-bgp.shtml
>
> --Heather 
>
> -----Original Message-----
> From: Aftab Siddiqui [mailto:aftab.siddiqui () gmail com] 
> Sent: Saturday, September 10, 2011 6:49 PM
> To: Richard Barnes
> Cc: Jonas Frey (Probe Networks); nanog () nanog org
> Subject: Re: Saudi Telecom sending route with invalid attributes 212.118.142.0/24
>
> with in the span of couple of hours this prefix was originated from 3 ASN i.e. AS3561 (Savvis), AS8866 (BTC) and 
> AS25019 (STC original custodians).
>
> As per the STC it was orginated by one of their customer having Juniper router. but I still don't understand why/how 
> they are adv this prefix with unrecog transitive attributes.
>
> Can any one suggest.
>
> Regards,
>
> Aftab A. Siddiqui
>
>
> On Sun, Sep 11, 2011 at 3:26 AM, Richard Barnes <richard.barnes () gmail com>wrote:
>
> > Looks like the RIS collectors are seeing it originating mostly from 
> > STC and KACST ASNs:
> > <http://stat.ripe.net/212.118.142.0/24>
> >
> > Some of the "show ip bgp" reports on that screen are also showing
> > AS8866 "BTC-AS Bulgarian Telecommunication Company".  Not sure what's 
> > up with that.
> >
> > --Richard
> >
> >
> >
> > On Sat, Sep 10, 2011 at 2:01 PM, Christopher Morrow 
> > <morrowc.lists () gmail com> wrote:
> > > On Fri, Sep 9, 2011 at 9:26 PM, Kyle Duren <pixitha.kyle () gmail com>
> > wrote:
> > > > Is this announcement still showing up this way (no easy way to 
> > > > check myself).
> > >
> > > ripe ris?
> > >
> > > > -Kyle
> > > >
> > > > On Thu, Sep 8, 2011 at 4:20 PM, Clay Haynes 
> > > > <chaynes () centracomm net>
> > wrote:
> > > > > On Thu, Sep 8, 2011 at 7:11 PM, Jonas Frey (Probe Networks) < 
> > > > > jf () probe-networks de> wrote:
> > > > >
> > > > > > Hello,
> > > > > >
> > > > > > anyone else getting a route for 212.118.142.0/24 with invalid 
> > > > > > attributes? Seems this is (again) causing problems with some 
> > > > > > (older) routers/software.
> > > > > >
> > > > > >              Announcement bits (4): 0-KRT 3-KRT 5-Resolve tree 
> > > > > > 1 6-Resolve tree 2
> > > > > >               AS path: 6453 39386 25019 I Unrecognized Attributes:
> > 39
> > > > > > bytes
> > > > > >               AS path:  Attr flags e0 code 80: 00 00 fd 88 40 
> > > > > > 01 01
> > 02
> > > > > > 40 02 04 02 01 5b a0 c0 11 04 02 01 fc da 80 04 04 00 00 00 01 
> > > > > > 40 05
> > 04
> > > > > > 00 00 00 64
> > > > > >               Accepted Multipath
> > > > > >
> > > > > >
> > > > > > -Jonas
> > > > > Yup! We're seeing the same thing too, and we're filtering it out.
> > > > > Originating AS is 25019
> > > > >
> > > > > -Clay