RE: Saudi Telecom sending route with invalid attributes 212.118.142.0/24 - Redux

["Schiller, Heather A" <heather.schiller () verizon com>]

Seeing it again here too.. Has anyone contacted them?

..and for folks who are choosing to blackhole the prefix in order to supress the route, please remember not to export 
it!

AS25019 SAUDINETSTC-AS Autonomus System Number for SaudiNet     2011-09-08 18:23:53 UTC 2011-09-19 19:16:27 UTC
AS8866  BTC-AS Bulgarian Telecommunication Company Plc. 2011-09-08 18:35:14 UTC 2011-09-19 19:15:42 UTC
AS10026 PACNET Pacnet Global Ltd        2011-09-11 02:41:40 UTC 2011-09-19 16:00:00 UTC
AS8767  MNET-AS M-net AS        2011-09-14 12:13:01 UTC 2011-09-14 12:14:00 UTC
AS3561  SAVVIS - Savvis 2011-09-09 19:42:15 UTC 2011-09-10 16:27:18 UTC
AS3549  GBLX Global Crossing Ltd.       2011-09-09 16:13:15 UTC 2011-09-09 17:05:38 UTC
AS1239  SPRINTLINK - Sprint     2011-09-09 03:18:28 UTC 2011-09-09 15:56:41 UTC
AS65000 -Private Use AS-        2011-09-08 18:34:28 UTC 2011-09-08 18:34:29 UTC

 --heather 

-----Original Message-----
From: Ryan Gray [mailto:ryan () longlines com] 
Sent: Monday, September 19, 2011 3:09 PM
To: Schiller, Heather A
Cc: Aftab Siddiqui; Richard Barnes; Jonas Frey (Probe Networks); nanog () nanog org
Subject: Re: Saudi Telecom sending route with invalid attributes 212.118.142.0/24

Actually just started seeing these problems again today.  Is anyone else seeing this today from something other than 
212.118.142.0/24?  Looks like it started about two hours ago.


Regards,
Ryan Gray
Long Lines
www.longlines.com





On Sep 12, 2011, at 8:18 PM, Schiller, Heather A wrote:

> Could be this..?
>
> http://www.juniper.net/techpubs/en_US/junos11.2/topics/reference/confi
> guration-statement/independent-domain-edit-routing-options.html
>
> "unrecognized transitive attributes" depend on whatever code version you are running... What's more important is how 
> the unrecoginized attribute is handled.  Ideally you accept and pass the route and log it.  The problem is with 
> devices that aren't so graceful.. dropping sessions and wreaking havoc:
>
> http://www.cisco.com/warp/public/707/cisco-sa-20100827-bgp.shtml
>
> --Heather
>
> -----Original Message-----
> From: Aftab Siddiqui [mailto:aftab.siddiqui () gmail com]
> Sent: Saturday, September 10, 2011 6:49 PM
> To: Richard Barnes
> Cc: Jonas Frey (Probe Networks); nanog () nanog org
> Subject: Re: Saudi Telecom sending route with invalid attributes 
> 212.118.142.0/24
>
> with in the span of couple of hours this prefix was originated from 3 ASN i.e. AS3561 (Savvis), AS8866 (BTC) and 
> AS25019 (STC original custodians).
>
> As per the STC it was orginated by one of their customer having Juniper router. but I still don't understand why/how 
> they are adv this prefix with unrecog transitive attributes.
>
> Can any one suggest.
>
> Regards,
>
> Aftab A. Siddiqui
>
>
> On Sun, Sep 11, 2011 at 3:26 AM, Richard Barnes <richard.barnes () gmail com>wrote:
>
> > Looks like the RIS collectors are seeing it originating mostly from 
> > STC and KACST ASNs:
> > <http://stat.ripe.net/212.118.142.0/24>
> >
> > Some of the "show ip bgp" reports on that screen are also showing
> > AS8866 "BTC-AS Bulgarian Telecommunication Company".  Not sure what's 
> > up with that.
> >
> > --Richard
> >
> >
> >
> > On Sat, Sep 10, 2011 at 2:01 PM, Christopher Morrow 
> > <morrowc.lists () gmail com> wrote:
> > > On Fri, Sep 9, 2011 at 9:26 PM, Kyle Duren <pixitha.kyle () gmail com>
> > wrote:
> > > > Is this announcement still showing up this way (no easy way to 
> > > > check myself).
> > >
> > > ripe ris?
> > >
> > > > -Kyle
> > > >
> > > > On Thu, Sep 8, 2011 at 4:20 PM, Clay Haynes 
> > > > <chaynes () centracomm net>
> > wrote:
> > > > > On Thu, Sep 8, 2011 at 7:11 PM, Jonas Frey (Probe Networks) < 
> > > > > jf () probe-networks de> wrote:
> > > > >
> > > > > > Hello,
> > > > > >
> > > > > > anyone else getting a route for 212.118.142.0/24 with invalid 
> > > > > > attributes? Seems this is (again) causing problems with some
> > > > > > (older) routers/software.
> > > > > >
> > > > > >              Announcement bits (4): 0-KRT 3-KRT 5-Resolve tree
> > > > > > 1 6-Resolve tree 2
> > > > > >               AS path: 6453 39386 25019 I Unrecognized Attributes:
> > 39
> > > > > > bytes
> > > > > >               AS path:  Attr flags e0 code 80: 00 00 fd 88 40
> > > > > > 01 01
> > 02
> > > > > > 40 02 04 02 01 5b a0 c0 11 04 02 01 fc da 80 04 04 00 00 00 01 40 
> > > > > > 05
> > 04
> > > > > > 00 00 00 64
> > > > > >               Accepted Multipath
> > > > > >
> > > > > >
> > > > > > -Jonas
> > > > > Yup! We're seeing the same thing too, and we're filtering it out.
> > > > > Originating AS is 25019
> > > > >
> > > > > -Clay