Re: request for help: 192.139.135.0/24

[Job Snijders <job () ntt net>]

Ack for NTT

On Mon, Apr 1, 2019 at 21:36 Christopher Morrow <morrowc.lists () gmail com>
wrote:

> (from offline chat and pokery)
>
> It looks like 701/1239/3356 are permitting 4837 to announce this prefix
> because:
> $ whois -h whois.radb.net 192.139.135.0
> route:      192.139.135.0/24
> descr:      managedway company
> origin:     AS53292
> mnt-by:     MAINT-AS53292
> changed:    rsanders () managedway com 20181128  #23:11:53Z
> source:     RADB
>
> route:         192.139.135.0/24
> descr:         GLENQCY1
> origin:        AS271
> mnt-by:        BELL-RC
> changed:       config () in bell ca 19930820
> source:        BELL
>
> route:      192.139.135.0/24
> descr:      CMI IP Transit
> origin:     AS4808
> admin-c:    MAINT-CMI-INT-HK
> tech-c:     MAINT-CMI-INT-HK
> mnt-by:     MAINT-CMI-INT-HK
> changed:    qas_support () cmi chinamobile com 20160525
> source:     NTTCOM
>
> mntner:         MAINT-CMI-INT-HK
> descr:          China Mobile International Limited
> country:        HK
> admin-c:        CMIL1-AP
> upd-to:         qas_support () cmi chinamobile com
> auth:           # Filtered
> mnt-by:         MAINT-CMI-INT-HK
> referral-by:    APNIC-HM
> last-modified:  2017-11-22T09:00:43Z
> source:         APNIC
>
>
> There is some less-than-great management of the associated IRR data.
> It'd be in the best interest of <someone> (Metro Wireless) to start
> asking the various IRR's:
>   bell - config () in bell ca ?
>   radb -
>   nttcom - job?
>   apnic -
>
> to remove the objects in question.
> I'm curious why NTT's still holding this record since there's a competing
> ROA?
>
> On Mon, Apr 1, 2019 at 1:27 PM Jay Borkenhagen <jayb () braeburn org> wrote:
> > [No attempts at 01-April humor will be attempted in this message.]
> >
> >
> > Seeking help from routing engineers around the 'net:
> >
> >
> > ARIN documents that 192.139.135.0/24 has been allocated to Metro
> > Wireless International:
> >
> >  https://whois.arin.net/rest/net/NET-192-139-135-0-1
> >
> > Further, the party to whom 192.139.135.0/24 has been allocated has
> > published a ROA in ARIN's hosted RPKI asserting that bgp announcements
> > for that prefix are valid only when originating in AS63251.  To view
> > this, go to your favorite RPKI vantage point that uses ARIN's TAL.  If
> > you don't yet have a favorite, feel free to telnet to
> > route-server.ip.att.net and run:
> >
> >  show validation database record 192.139.135.0/24
> >
> >
> > Unfortunately, as may be seen at route-views, etc, most of the
> > Internet now prefers an invalid path that's mis-originated in as4808:
> >
> >
> >      Network          Next Hop          Path
> >  *   192.139.135.0    208.51.134.254    3549 3356 4837 4808 i
> >  *                    194.85.40.15      3267 3356 4837 4808 i
> >  *                    193.0.0.56        3333 1273 4837 4808 i
> >  *                    37.139.139.0      57866 6762 4837 4808 i
> >  *                    12.0.1.63         7018 1299 53292 63251 ?
> >  *                    140.192.8.16      54728 20130 6939 4837 4808 i
> >  *                    91.218.184.60     49788 1299 53292 63251 ?
> >  *                    203.181.248.168   7660 2516 4837 4808 i
> >  *                    154.11.12.212     852 4837 4808 i
> >  *                    134.222.87.1      286 1299 53292 63251 ?
> >  *                    209.124.176.223   101 101 3356 4837 4808 i
> >  *                    137.39.3.55       701 4837 4808 i
> >  *                    94.142.247.3      8283 1239 4837 4808 i
> >  *                    162.251.163.2     53767 3257 1299 53292 63251 ?
> >  *                    212.66.96.126     20912 1267 3356 4837 4808 i
> >  *                    198.58.198.255    1403 6461 4837 4808 i
> >  *                    198.58.198.254    1403 6461 4837 4808 i
> >  *>                   202.232.0.2       2497 4837 4808 i
> >  *                    203.62.252.83     1221 4637 4837 4808 i
> >  *                    132.198.255.253   1351 6939 4837 4808 i
> >  *                    206.24.210.80     3561 209 4837 4808 i
> >  *                    195.208.112.161   3277 39710 9002 3356 4837 4808 i
> >  *                    217.192.89.50     3303 4837 4808 i
> >  *                    173.205.57.234    53364 3257 1299 53292 63251 ?
> >  *                    207.172.6.20      6079 3356 4837 4808 i
> >  *                    207.172.6.1       6079 3356 4837 4808 i
> >  *                    208.74.64.40      19214 174 4837 4837 4808 i
> >  *                    144.228.241.130   1239 4837 4808 i
> >  *                    162.250.137.254   4901 6079 3356 4837 4808 i
> >  *                    114.31.199.1      4826 1299 53292 63251 i
> >  *                    64.71.137.241     6939 4837 4808 i
> >
> >
> > Please help the Metro Wireless International folks get this cleared up
> > so their 192.139.135.0/24 can once again be usable.  In particular,
> > help is sought from 4837 and their transit providers:
> >
> >  1239
> >  701
> >  3356
> >
> > (Yes, I am trying to reach folks at those networks in other ways, too.)
> >
> >
> > Thanks.
> >
> >                                                 Jay B.