[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Saudi Telecom sending route with invalid attributes 212.118.142.0/24 - Redux
Hi Chris,
I've send an email to the person I know within STC responsible for
international transit.
Let's hope he can assist.
Regards,
Erik Bais
> -----Original Message-----
> From: Christopher Morrow [mailto:morrowc.lists at gmail.com]
> Sent: Monday, September 19, 2011 10:58 PM
> To: Schiller, Heather A; info at irnetco.net
> Cc: Jonas Frey (Probe Networks); nanog at nanog.org
> Subject: Re: Saudi Telecom sending route with invalid attributes
> 212.118.142.0/24 - Redux
>
> suliman.alzain at saudi.net.sa - bounces :( Ripe folks (if listening)
> perhaps you could ping the other live POC's there and request an
> update? :)
>
> On Mon, Sep 19, 2011 at 4:54 PM, Christopher Morrow
> <morrowc.lists at gmail.com> wrote:
> > In the off chance that no one already attempted an email to the folks
> > nominally in charge there:
> >
> > person: ? ? ? ? Hejji almazroua
> > address: ? ? ? ?SaudiNet
> > address: ? ? ? ?P.O.Box: 295997, Riyadh 11351, Saudi Arabia.
> > phone: ? ? ? ? ?+9661 218 0300
> > fax-no: ? ? ? ? +9661 218 0311
> > e-mail: ? ? ? ? info at irnetco.net
> > nic-hdl: ? ? ? ?Ha125-RIPE
> > mnt-by: ? ? ? ? irnetco-ripe-mnt
> > source: ? ? ? ? RIPE # Filtered
> >
> > person: ? ? ? Suliman I. Al-Zain
> > address: ? ? ?Saudi Telecom Co. (SaudiNet)
> > address: ? ? ?P.O.Box: 295997, Riyadh 11351, Saudi Arabia.
> > phone: ? ? ? ?+9661 218 2034
> > fax-no: ? ? ? +9661 218 0311
> > e-mail: ? ? ? suliman.alzain at saudi.net.sa
> > nic-hdl: ? ? ?SA702-RIPE
> > source: ? ? ? RIPE # Filtered
> >
> >
> > Do the Saudi-Telecom folks have a method to suppress the /24
> > (212.118.142.0/24) which is also covered by: 212.118.128.0/19
> >
> > it'd really help lots of other Internet folk if you'd suppress this
> /24 ...
> >
> > -chris
> >
> > On Mon, Sep 19, 2011 at 3:26 PM, Schiller, Heather A
> > <heather.schiller at verizon.com> wrote:
> >>
> >> Seeing it again here too.. Has anyone contacted them?
> >>
> >> ..and for folks who are choosing to blackhole the prefix in order to
> supress the route, please remember not to export it!
> >>
> >> AS25019 SAUDINETSTC-AS Autonomus System Number for SaudiNet
> 2011-09-08 18:23:53 UTC 2011-09-19 19:16:27 UTC
> >> AS8866 ?BTC-AS Bulgarian Telecommunication Company Plc. 2011-09-08
> 18:35:14 UTC 2011-09-19 19:15:42 UTC
> >> AS10026 PACNET Pacnet Global Ltd ? ? ? ?2011-09-11 02:41:40 UTC
> 2011-09-19 16:00:00 UTC
> >> AS8767 ?MNET-AS M-net AS ? ? ? ?2011-09-14 12:13:01 UTC 2011-09-14
> 12:14:00 UTC
> >> AS3561 ?SAVVIS - Savvis 2011-09-09 19:42:15 UTC 2011-09-10 16:27:18
> UTC
> >> AS3549 ?GBLX Global Crossing Ltd. ? ? ? 2011-09-09 16:13:15 UTC
> 2011-09-09 17:05:38 UTC
> >> AS1239 ?SPRINTLINK - Sprint ? ? 2011-09-09 03:18:28 UTC 2011-09-09
> 15:56:41 UTC
> >> AS65000 -Private Use AS- ? ? ? ?2011-09-08 18:34:28 UTC 2011-09-08
> 18:34:29 UTC
> >>
> >> ?--heather
> >>
> >> -----Original Message-----
> >> From: Ryan Gray [mailto:ryan at longlines.com]
> >> Sent: Monday, September 19, 2011 3:09 PM
> >> To: Schiller, Heather A
> >> Cc: Aftab Siddiqui; Richard Barnes; Jonas Frey (Probe Networks);
> nanog at nanog.org
> >> Subject: Re: Saudi Telecom sending route with invalid attributes
> 212.118.142.0/24
> >>
> >> Actually just started seeing these problems again today. ?Is anyone
> else seeing this today from something other than 212.118.142.0/24?
> ?Looks like it started about two hours ago.
> >>
> >>
> >> Regards,
> >> Ryan Gray
> >> Long Lines
> >> www.longlines.com
> >>
> >>
> >>
> >>
> >>
> >> On Sep 12, 2011, at 8:18 PM, Schiller, Heather A wrote:
> >>
> >>>
> >>> Could be this..?
> >>>
> >>>
> http://www.juniper.net/techpubs/en_US/junos11.2/topics/reference/confi
> >>> guration-statement/independent-domain-edit-routing-options.html
> >>>
> >>> "unrecognized transitive attributes" depend on whatever code
> version you are running... What's more important is how the
> unrecoginized attribute is handled. ?Ideally you accept and pass the
> route and log it. ?The problem is with devices that aren't so
> graceful.. dropping sessions and wreaking havoc:
> >>>
> >>> http://www.cisco.com/warp/public/707/cisco-sa-20100827-bgp.shtml
> >>>
> >>> --Heather
> >>>
> >>> -----Original Message-----
> >>> From: Aftab Siddiqui [mailto:aftab.siddiqui at gmail.com]
> >>> Sent: Saturday, September 10, 2011 6:49 PM
> >>> To: Richard Barnes
> >>> Cc: Jonas Frey (Probe Networks); nanog at nanog.org
> >>> Subject: Re: Saudi Telecom sending route with invalid attributes
> >>> 212.118.142.0/24
> >>>
> >>> with in the span of couple of hours this prefix was originated from
> 3 ASN i.e. AS3561 (Savvis), AS8866 (BTC) and AS25019 (STC original
> custodians).
> >>>
> >>> As per the STC it was orginated by one of their customer having
> Juniper router. but I still don't understand why/how they are adv this
> prefix with unrecog transitive attributes.
> >>>
> >>> Can any one suggest.
> >>>
> >>> Regards,
> >>>
> >>> Aftab A. Siddiqui
> >>>
> >>>
> >>> On Sun, Sep 11, 2011 at 3:26 AM, Richard Barnes
> <richard.barnes at gmail.com>wrote:
> >>>
> >>>> Looks like the RIS collectors are seeing it originating mostly
> from
> >>>> STC and KACST ASNs:
> >>>> <http://stat.ripe.net/212.118.142.0/24>
> >>>>
> >>>> Some of the "show ip bgp" reports on that screen are also showing
> >>>> AS8866 "BTC-AS Bulgarian Telecommunication Company". ?Not sure
> what's
> >>>> up with that.
> >>>>
> >>>> --Richard
> >>>>
> >>>>
> >>>>
> >>>> On Sat, Sep 10, 2011 at 2:01 PM, Christopher Morrow
> >>>> <morrowc.lists at gmail.com> wrote:
> >>>>> On Fri, Sep 9, 2011 at 9:26 PM, Kyle Duren
> <pixitha.kyle at gmail.com>
> >>>> wrote:
> >>>>>> Is this announcement still showing up this way (no easy way to
> >>>>>> check myself).
> >>>>>
> >>>>> ripe ris?
> >>>>>
> >>>>>> -Kyle
> >>>>>>
> >>>>>> On Thu, Sep 8, 2011 at 4:20 PM, Clay Haynes
> >>>>>> <chaynes at centracomm.net>
> >>>> wrote:
> >>>>>>
> >>>>>>> On Thu, Sep 8, 2011 at 7:11 PM, Jonas Frey (Probe Networks) <
> >>>>>>> jf at probe-networks.de> wrote:
> >>>>>>>
> >>>>>>>> Hello,
> >>>>>>>>
> >>>>>>>> anyone else getting a route for 212.118.142.0/24 with invalid
> >>>>>>>> attributes? Seems this is (again) causing problems with some
> >>>>>>>> (older) routers/software.
> >>>>>>>>
> >>>>>>>> ? ? ? ? ? ? ?Announcement bits (4): 0-KRT 3-KRT 5-Resolve tree
> >>>>>>>> 1 6-Resolve tree 2
> >>>>>>>> ? ? ? ? ? ? ? AS path: 6453 39386 25019 I Unrecognized
> Attributes:
> >>>> 39
> >>>>>>>> bytes
> >>>>>>>> ? ? ? ? ? ? ? AS path: ?Attr flags e0 code 80: 00 00 fd 88 40
> >>>>>>>> 01 01
> >>>> 02
> >>>>>>>> 40 02 04 02 01 5b a0 c0 11 04 02 01 fc da 80 04 04 00 00 00 01
> 40
> >>>>>>>> 05
> >>>> 04
> >>>>>>>> 00 00 00 64
> >>>>>>>> ? ? ? ? ? ? ? Accepted Multipath
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> -Jonas
> >>>>>>>>
> >>>>>>>>
> >>>>>>> Yup! We're seeing the same thing too, and we're filtering it
> out.
> >>>>>>> Originating AS is 25019
> >>>>>>>
> >>>>>>> -Clay
> >>>>>>>
> >>>>>>
> >>>>>
> >>>>>
> >>>>
> >>>>
> >>>
> >>>
> >>
> >>
> >>
> >
>
> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 10.0.1410 / Virus Database: 1520/3906 - Release Date: 09/19/11