[caiu] Fwd: Strange entries from AS1 in global table

[Sergio Ferreira]

Rubens, 

	Eu tenho...Vou alertá-los.

	[]'s

Sérgio Ferreira
WGO Telecom
64 3411 3000
64 8119 1840



Em 04/08/2013, às 17:26, Rubens Kuhl escreveu:

> Pessoal,
> 
> Se alguém tiver um contato com o pessoal da Netvip, poderia passar o alerta
> disto aqui para eles ? Devem estar AS público (1) como se fosse AS interno,
> talvez em algum tipo de teste, e está vazando.
> 
> A Algar (16735) também poderia olhar isto que indica falta de filtro de AS
> Path nessa sessão...
> 
> 
> Rubens
> 
> 
> ---------- Forwarded message ----------
> From: Anurag Bhatia <me at anuragbhatia.com>
> Date: Sun, Aug 4, 2013 at 2:15 AM
> Subject: Strange entries from AS1 in global table
> To: NANOG Mailing List <nanog at nanog.org>
> 
> 
> Hello everyone
> 
> 
> I was looking at global IPv4 table and saw some strange entries from AS1.
> As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of
> Brazil based ISP - Netvip
> 
> 
> http://bgp.he.net/AS1#_prefixes
> 
> 
> 
> Looking at any prefix in detail, it seems like there are multiple ASNs
> announcing same prefix.
> 
> E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931
> (Netvip's allocated ASN). Same is true with 177.185.98.0/24,
> 177.185.98.0/24and so on.
> http://bgp.he.net/net/177.185.96.0/24
> 
> So seems like AS1 acting like a mirror for all announcements of AS52931. To
> see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon
> and noticed these routes:
> 
> 3356 3549 16735 52931 1 i
> 
> 
> 
> Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which
> seems like a backbone ISP in Brazil) is not filtering these routes further
> passing to Level3 (AS3549+AS3356).
> 
> 
> 
> I am curious to know what could be possible reason for an ASN like AS1
> acting in exact mirror of AS52931? Could it be a case of internal use of
> AS1 (assuming it to be private ASN)? May be it's a case of leaked internal
> routes?
> 
> 
> 
> Appreciate your time & answer.
> 
> 
> 
> Thanks.
> 
> --
> 
> Anurag Bhatia
> anuragbhatia.com
> 
> Linkedin <http://in.linkedin.com/in/anuragbhatia21> |
> Twitter<https://twitter.com/anurag_bhatia>
> Skype: anuragbhatia.com
> _______________________________________________
> caiu mailing list
> caiu at eng.registro.br
> https://eng.registro.br/mailman/listinfo/caiu
> 
> 
> --> PARA SAIR DA LISTA SIGA AS INSTRUÇÕES em:
> 
> https://eng.registro.br/mailman/options/caiu