Mailing List Archive

Michelle,

On Tue, Apr 12, 2005 at 04:21:54AM +0000, Michelle Myers wrote:
> We are not seeing this route announced accross our network or being
> received from 2514 ... do you have any more information on this?

Thanks for looking into the issue. It's most probably a ghost route,
produced by a known Cisco IOS bug (IOS "sometimes" forgets to send BGP
withdrawls for routes), see http://www.sixxs.net/tools/grh/what/

Looking at the tail of the AS_PATH "5609 6762 2914 2514" and confirming
that 6762 doesn't have the 2001::/32 anymore
(http://bassotto.noc.seabone.net/ASpath/bgp-table-snapshot.txt), it's
definately not Verio experiencing the bug.

Nevertheless, the announcement WAS done by 2514 and you forwaded it at
least to 6762, so you do/did have a filter problem with 2514 as you
shouldn't have accepted this prefix from them.


Best regards,
Daniel

--
CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0

On Tue, 2005-04-12 at 04:21 +0000, Michelle Myers wrote:
> Daniel,
>
> We are not seeing this route announced accross our network or being
> received from 2514 ... do you have any more information on this?

IMHO it does not exist, if one looks at:
http://www.sixxs.net/tools/grh/lg/?find=2001::/21

I guess it just started to disappear from the routing tables.
The Green ASN's are providing GRH with routes, and both 6939 (HE.net)
nor 13944 are providing this route to GRH. Thus apparently they don't
have it. 3257 (Tiscali) does not have it either. 28747 (Realroot)
doesn't have it either, but 3344 (Kewlio), 16034 (KeConnect) and 16034
(NFSI) report they have it.

Apparently it was first seen yesterday around 21:00
http://www.sixxs.net/tools/grh/lg/?when=selected&year=2005&month=04&day=11&hour=21&find=2001::/32

maybe it has since then been taken off the announcement list though.

According to RIS: http://www.ris.ripe.net/perl-risapp/risearch.html

it was first seen in LINX@RIS
A 2001::/32 2005-04-11 18:58:05Z 2001:7f8:4::cb9:1

2001:7f8:4::cb9:1 150 IGP

3257 6175 6830 1299 3320 5609 6762 2914 2514

Withdrawals started at:

W 2001::/32 2005-04-11 19:05:35Z 2001:7f8:30:0:1:1:0:1853 0 IGP - - VIX

But some boxes apparently still have it and it is lingering as a ghost.

Nevertheless, AS2514 should never been able to announce that prefix in
the first place.

Greets,
Jeroen

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: This is a digitally signed message part
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20050412/da6fa949/attachment.bin

Hi Jeroen,

Jeroen Massar wrote:
> On Tue, 2005-04-12 at 04:21 +0000, Michelle Myers wrote:
>
>>Daniel,
>>
>> We are not seeing this route announced accross our network or being
>>received from 2514 ... do you have any more information on this?
>
>
> IMHO it does not exist, if one looks at:
> http://www.sixxs.net/tools/grh/lg/?find=2001::/21
>
> I guess it just started to disappear from the routing tables.
> The Green ASN's are providing GRH with routes, and both 6939 (HE.net)
> nor 13944 are providing this route to GRH. Thus apparently they don't
> have it. 3257 (Tiscali) does not have it either. 28747 (Realroot)
> doesn't have it either, but 3344 (Kewlio), 16034 (KeConnect) and 16034
> (NFSI) report they have it.

We only see 2001::/32 from realroot(AS28747), i cleared our session with
them (the prefix went away) and it came back once the session restored.
realroot show it being received from tiscali, however we don't see it
via our tiscali transit. This could be a ghost route at realroot?

Michiel on this list?


Thanks,

--

Daniel Austin,
Managing Director,
Kewlio.net Limited.
<daniel@kewlio.net>

On Tue, Apr 12, 2005 at 10:39:50AM +0100, Daniel Austin wrote:

> We only see 2001::/32 from realroot(AS28747), i cleared our session with
> them (the prefix went away) and it came back once the session restored.
> realroot show it being received from tiscali, however we don't see it
> via our tiscali transit. This could be a ghost route at realroot?

We were having ghosts on visit on our london node, running 12.2.14S13.
Routes are gone now in our IBGP. ghost should be hunted ;)

Could you guys confirm this ?

>
> Michiel on this list?
>
Yes I am ;)




>
> Thanks,
>
> --
>
> Daniel Austin,
> Managing Director,
> Kewlio.net Limited.
> <daniel@kewlio.net>


Cheers,
Michiel


--
Michiel Van Opstal

Network engineer Phone: +32 3 288 00 87
RealROOT FAX : +32 3 293 33 43
Borkelstraat 2/4
B-2900 Schoten
http://www.RealROOT.be info@realroot.be
----

On Tue, Apr 12, 2005 at 11:50:26AM +0200, Michiel Van Opstal wrote:
> On Tue, Apr 12, 2005 at 10:39:50AM +0100, Daniel Austin wrote:
>
> > We only see 2001::/32 from realroot(AS28747), i cleared our session with
> > them (the prefix went away) and it came back once the session restored.
> > realroot show it being received from tiscali, however we don't see it
> > via our tiscali transit. This could be a ghost route at realroot?
>
> We were having ghosts on visit on our london node, running 12.2.14S13.
> Routes are gone now in our IBGP. ghost should be hunted ;)
>
Correction, I suspect our router facing our tiscali transit, its a 3660
running 12.3(11)T2.

Sessions are cleared on this box; and software upgrade will be planned.

Cheers,
Michiel

> Could you guys confirm this ?
>
> >
> > Michiel on this list?
> >
> Yes I am ;)
>
>
>
>
> >
> > Thanks,
> >
> > --
> >
> > Daniel Austin,
> > Managing Director,
> > Kewlio.net Limited.
> > <daniel@kewlio.net>
>
>
> Cheers,
> Michiel
>
>
> --
> Michiel Van Opstal
>
> Network engineer Phone: +32 3 288 00 87
> RealROOT FAX : +32 3 293 33 43
> Borkelstraat 2/4
> B-2900 Schoten
> http://www.RealROOT.be info@realroot.be
> ----

--
Michiel Van Opstal

Network engineer Phone: +32 3 288 00 87
RealROOT FAX : +32 3 293 33 43
Borkelstraat 2/4
B-2900 Schoten
http://www.RealROOT.be info@realroot.be
----

Hello,

From what I can tell our config wasn't changed, and we've
only accepted 2514's two ip blocks as announcements from them.

I'm not sure how this occured, but luckily everything
is now in proper order.

-Michelle

According to Jeroen Massar (jeroen@unfix.org) on Tue, Apr 12, 2005 at 11:31:33AM +0200 To Michelle Myers :
# On Tue, 2005-04-12 at 04:21 +0000, Michelle Myers wrote:
# > Daniel,
# >
# > We are not seeing this route announced accross our network or being
# > received from 2514 ... do you have any more information on this?
#
# IMHO it does not exist, if one looks at:
# http://www.sixxs.net/tools/grh/lg/?find=2001::/21
#
# I guess it just started to disappear from the routing tables.
# The Green ASN's are providing GRH with routes, and both 6939 (HE.net)
# nor 13944 are providing this route to GRH. Thus apparently they don't
# have it. 3257 (Tiscali) does not have it either. 28747 (Realroot)
# doesn't have it either, but 3344 (Kewlio), 16034 (KeConnect) and 16034
# (NFSI) report they have it.
#
# Apparently it was first seen yesterday around 21:00
# http://www.sixxs.net/tools/grh/lg/?when=selected&year=2005&month=04&day=11&hour=21&find=2001::/32
#
# maybe it has since then been taken off the announcement list though.
#
# According to RIS: http://www.ris.ripe.net/perl-risapp/risearch.html
#
# it was first seen in LINX@RIS
# A 2001::/32 2005-04-11 18:58:05Z 2001:7f8:4::cb9:1
#
# 2001:7f8:4::cb9:1 150 IGP
#
# 3257 6175 6830 1299 3320 5609 6762 2914 2514
#
# Withdrawals started at:
#
# W 2001::/32 2005-04-11 19:05:35Z 2001:7f8:30:0:1:1:0:1853 0 IGP - - VIX
#
# But some boxes apparently still have it and it is lingering as a ghost.
#
# Nevertheless, AS2514 should never been able to announce that prefix in
# the first place.
#
# Greets,
# Jeroen
#


>>That's the end of quoted material.

--
Michelle Myers
NTT Communications Global NOC

Hi Michelle,

On Tue, Apr 12, 2005 at 10:09:02AM +0000, Michelle Myers wrote:
> From what I can tell our config wasn't changed, and we've
> only accepted 2514's two ip blocks as announcements from them.

Hm, perhaps a well-hidden typo somewhere which makes the filter
ineffective?

> I'm not sure how this occured, but luckily everything
> is now in proper order.

Thanks for looking into it!


Best regards,
Daniel

--
CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0