Re: What's going on with AS147028?

[August Yang via NANOG <nanog () nanog org>]

Indeed the network feeds some of the major route collectors.

One known cause is LL-IX <https://ll-ix.com/en/services> which operates in a topology that partially transits routes 
from physical exchanges to its participants and strips their ASN in path. 
> Possibility to peer with a large number of AMS-IX (Netherlands, Haarlem), DE-CIX (Germany, Frankfurt), MSK-IX 
> (Russia, Moscow), SIX (USA, Seattle) and PLIX (Poland, Warsaw) participants

The network operator might have intentionally or unintentionally forgot to prepend his own ASN before exporting to the 
collectors. Chances are misconfigured route reflector or the eager of more visible peers on those toolkits.

The issue is widely observed on a number of hobby networks.

Best regards
August Yang

> On Jul 12, 2022, at 3:49 PM, Eric Dugas via NANOG <nanog () nanog org> wrote:
>
> A friend of mine mentioned that both our Canadian ASNs were listed in AS147028's peer list on 
> https://bgp.he.net/AS147028 but we have no adjacency to this network.
>
> Their peer count jumped from 1 in May 2022 to 1,800 and just a few days ago jumped to 8,800. Beside NL-IX, all the IX 
> they are listed on are virtual IX with a few dozen "hobby networks".
>
> The only lead I have is they use HE as transit and they're pumping back BGP feed to route collectors like RIPE RIS or 
> Route Views with routes stripped of HE's ASN.
>
> Eric

Attachment: smime.p7s
Description: