[caiu] Fwd: Strange entries from AS1 in global table

Rubens Kuhl rubensk em gmail.com
Domingo Agosto 4 17:26:14 BRT 2013


Se alguém tiver um contato com o pessoal da Netvip, poderia passar o alerta
disto aqui para eles ? Devem estar AS público (1) como se fosse AS interno,
talvez em algum tipo de teste, e está vazando.

A Algar (16735) também poderia olhar isto que indica falta de filtro de AS
Path nessa sessão...


---------- Forwarded message ----------
From: Anurag Bhatia <me at anuragbhatia.com>
Date: Sun, Aug 4, 2013 at 2:15 AM
Subject: Strange entries from AS1 in global table
To: NANOG Mailing List <nanog at nanog.org>

Hello everyone

I was looking at global IPv4 table and saw some strange entries from AS1.
As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of
Brazil based ISP - Netvip


Looking at any prefix in detail, it seems like there are multiple ASNs
announcing same prefix.

E.g - is being announced by AS1 as well as AS52931
(Netvip's allocated ASN). Same is true with, so on.

So seems like AS1 acting like a mirror for all announcements of AS52931. To
see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon
and noticed these routes:

3356 3549 16735 52931 1 i

Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which
seems like a backbone ISP in Brazil) is not filtering these routes further
passing to Level3 (AS3549+AS3356).

I am curious to know what could be possible reason for an ASN like AS1
acting in exact mirror of AS52931? Could it be a case of internal use of
AS1 (assuming it to be private ASN)? May be it's a case of leaked internal

Appreciate your time & answer.



Anurag Bhatia

Linkedin <http://in.linkedin.com/in/anuragbhatia21> |
Skype: anuragbhatia.com

More information about the caiu mailing list