Re: NTT->HE earlier today (~10am EDT)

[Jared Mauch <jared () puck nether net>]

Greetings,

We are aware of this issue and as is usual we filter customers based on their registered routes.  This creates some 
unique challenges that we have been speaking about publicly and privately with various groups.

I have started the process (yay telco-speak) to fix this.

It would be helpful if networks would take a look at what routes they have registered in the various IRRs as well as if 
their AS-SETs expand out to something quite large.  We have seen many customers import objects that then import their 
other upstream networks.

We have found the IRR Explorer tool helpful to look at who has registered our IP space and to police these 
registrations with the various IRRs out there.  http://irrexplorer.nlnog.net/

http://irrexplorer.nlnog.net/prefix/184.105.213.86

The stability of the routing ecosystem is something that I personally care a lot about and have privately given Mike 
and others my cell number to allow them to follow-up.  As is often operators end up chasing problems after the fact, 
and this appears to be no exception.  *sigh*

- Jared

> On Jun 29, 2015, at 5:18 PM, Mike Leber <mleber () he net> wrote:
>
> NTT's customer Sofia Connect leaked our routes to NTT.  NTT accepted these routes instead of properly filtering their 
> customer announcements.  As a network of non-trivial size, announcing over 75,000 customer routes which is nearly 15% 
> of the IPv4 routing table, we'd expect the common courtesy of having our ASN included in their customer facing 
> AS-PATH filters, as we extend this same courtesy to other networks of this size (such as AS2914).
>
> Mike.
>
> On 6/29/15 2:04 PM, Jim Popovitch wrote:
> > Hello,
> >
> > I haven't seen anything to explain this, so I'm asking a larger
> > audience.  Did anyone notice any unusual NTT or HE routing this AM?
> >
> > Here's what I saw:
> >
> >
> >   2.|-- xe-0-1-0-17.r04.atlnga05.us.bb.gin.ntt.net  0.0%    20    0.8
> > 0.7   0.6   0.9   0.1
> >   3.|-- ae-2.r20.atlnga05.us.bb.gin.ntt.net         0.0%    20    4.6
> > 6.2   0.5  13.6   4.8
> >   4.|-- ae-4.r22.asbnva02.us.bb.gin.ntt.net         0.0%    20   15.3
> > 15.0 13.9 15.8 0.7
> >   5.|-- ae-4.r20.frnkge04.de.bb.gin.ntt.net         0.0%    20  127.3
> > 106.7  98.5 127.3  11.1
> >   6.|-- ae-2.r02.frnkge04.de.bb.gin.ntt.net         0.0%    20  126.8
> > 126.0 125.7 126.8   0.2
> >   7.|-- ae-1.r00.sofibu01.bg.bb.gin.ntt.net         0.0%    20  131.1
> > 130.0 128.7 131.4   1.2
> >   8.|-- 83.217.227.42                              80.0%    20  148.5
> > 146.0 144.2 148.5   2.0
> >   9.|-- ip-48-93.sofia-connect.net                 90.0%    20  184.5
> > 163.8 143.1 184.5  29.3
> >  10.|-- ???                                        100.0    20    0.0
> > 0.0   0.0   0.0   0.0
> >  11.|-- 10ge5-4.core1.vie1.he.net                  75.0%    20  160.7
> > 150.4 143.9 160.7   6.3
> >  12.|-- 10ge1-4.core1.prg1.he.net                  80.0%    20  158.4
> > 159.5 157.9 161.1   1.6
> >  13.|-- 10ge10-12.core1.fra1.he.net                75.0%    20  154.5
> > 159.2 145.9 174.4  10.7
> >  14.|-- 100ge5-2.core1.par2.he.net                 75.0%    20  187.9
> > 172.9 157.1 187.9  11.1
> >  15.|-- 100ge7-1.core1.nyc4.he.net                 78.9%    19  147.2
> > 146.2 144.6 147.5   1.4
> >  16.|-- 100ge7-2.core1.chi1.he.net                 78.9%    19  165.6
> > 172.1 165.6 183.5   8.0
> >  17.|-- 10ge15-2.core1.den1.he.net                 89.5%    19  201.3
> > 204.7 201.3 208.1   4.8
> >
> >
> > -Jim P.