Saudi Telecom sending route with invalid attributes 212.118.142.0/24 - Redux

Mon Sep 19 21:24:48 UTC 2011

On Mon, Sep 19, 2011 at 5:17 PM, Erik Bais <ebais at a2b-internet.com> wrote:
> Hi Chris,
>
> I've send an email to the person I know within STC responsible for
> international transit.
>
> Let's hope he can assist.

excellent! :)

>> -----Original Message-----
>> From: Christopher Morrow [mailto:morrowc.lists at gmail.com]
>> Sent: Monday, September 19, 2011 10:58 PM
>> To: Schiller, Heather A; info at irnetco.net
>> Cc: Jonas Frey (Probe Networks); nanog at nanog.org
>> Subject: Re: Saudi Telecom sending route with invalid attributes
>> 212.118.142.0/24 - Redux
>>
>> suliman.alzain at saudi.net.sa - bounces :( Ripe folks (if listening)
>> perhaps you could ping the other live POC's there and request an
>> update? :)
>>
>> On Mon, Sep 19, 2011 at 4:54 PM, Christopher Morrow
>> <morrowc.lists at gmail.com> wrote:
>> > In the off chance that no one already attempted an email to the folks
>> > nominally in charge there:
>> >
>> > person:         Hejji almazroua
>> > address:        SaudiNet
>> > address:        P.O.Box: 295997, Riyadh 11351, Saudi Arabia.
>> > phone:          +9661 218 0300
>> > fax-no:         +9661 218 0311
>> > e-mail:         info at irnetco.net
>> > nic-hdl:        Ha125-RIPE
>> > mnt-by:         irnetco-ripe-mnt
>> > source:         RIPE # Filtered
>> >
>> > person:       Suliman I. Al-Zain
>> > address:      Saudi Telecom Co. (SaudiNet)
>> > address:      P.O.Box: 295997, Riyadh 11351, Saudi Arabia.
>> > phone:        +9661 218 2034
>> > fax-no:       +9661 218 0311
>> > e-mail:       suliman.alzain at saudi.net.sa
>> > nic-hdl:      SA702-RIPE
>> > source:       RIPE # Filtered
>> >
>> >
>> > Do the Saudi-Telecom folks have a method to suppress the /24
>> > (212.118.142.0/24) which is also covered by: 212.118.128.0/19
>> >
>> > it'd really help lots of other Internet folk if you'd suppress this
>> /24 ...
>> >
>> > -chris
>> >
>> > On Mon, Sep 19, 2011 at 3:26 PM, Schiller, Heather A
>> > <heather.schiller at verizon.com> wrote:
>> >>
>> >> Seeing it again here too.. Has anyone contacted them?
>> >>
>> >> ..and for folks who are choosing to blackhole the prefix in order to
>> supress the route, please remember not to export it!
>> >>
>> >> AS25019 SAUDINETSTC-AS Autonomus System Number for SaudiNet
>> 2011-09-08 18:23:53 UTC 2011-09-19 19:16:27 UTC
>> >> AS8866  BTC-AS Bulgarian Telecommunication Company Plc. 2011-09-08
>> 18:35:14 UTC 2011-09-19 19:15:42 UTC
>> >> AS10026 PACNET Pacnet Global Ltd        2011-09-11 02:41:40 UTC
>> 2011-09-19 16:00:00 UTC
>> >> AS8767  MNET-AS M-net AS        2011-09-14 12:13:01 UTC 2011-09-14
>> 12:14:00 UTC
>> >> AS3561  SAVVIS - Savvis 2011-09-09 19:42:15 UTC 2011-09-10 16:27:18
>> UTC
>> >> AS3549  GBLX Global Crossing Ltd.       2011-09-09 16:13:15 UTC
>> 2011-09-09 17:05:38 UTC
>> >> AS1239  SPRINTLINK - Sprint     2011-09-09 03:18:28 UTC 2011-09-09
>> 15:56:41 UTC
>> >> AS65000 -Private Use AS-        2011-09-08 18:34:28 UTC 2011-09-08
>> 18:34:29 UTC
>> >>
>> >>  --heather
>> >>
>> >> -----Original Message-----
>> >> From: Ryan Gray [mailto:ryan at longlines.com]
>> >> Sent: Monday, September 19, 2011 3:09 PM
>> >> To: Schiller, Heather A
>> >> Cc: Aftab Siddiqui; Richard Barnes; Jonas Frey (Probe Networks);
>> nanog at nanog.org
>> >> Subject: Re: Saudi Telecom sending route with invalid attributes
>> 212.118.142.0/24
>> >>
>> >> Actually just started seeing these problems again today.  Is anyone
>> else seeing this today from something other than 212.118.142.0/24?
>>  Looks like it started about two hours ago.
>> >>
>> >>
>> >> Regards,
>> >> Ryan Gray
>> >> Long Lines
>> >> www.longlines.com
>> >>
>> >>
>> >>
>> >>
>> >>
>> >> On Sep 12, 2011, at 8:18 PM, Schiller, Heather A wrote:
>> >>
>> >>>
>> >>> Could be this..?
>> >>>
>> >>>
>> http://www.juniper.net/techpubs/en_US/junos11.2/topics/reference/confi
>> >>> guration-statement/independent-domain-edit-routing-options.html
>> >>>
>> >>> "unrecognized transitive attributes" depend on whatever code
>> version you are running... What's more important is how the
>> unrecoginized attribute is handled.  Ideally you accept and pass the
>> route and log it.  The problem is with devices that aren't so
>> graceful.. dropping sessions and wreaking havoc:
>> >>>
>> >>> http://www.cisco.com/warp/public/707/cisco-sa-20100827-bgp.shtml
>> >>>
>> >>> --Heather
>> >>>
>> >>> -----Original Message-----
>> >>> From: Aftab Siddiqui [mailto:aftab.siddiqui at gmail.com]
>> >>> Sent: Saturday, September 10, 2011 6:49 PM
>> >>> To: Richard Barnes
>> >>> Cc: Jonas Frey (Probe Networks); nanog at nanog.org
>> >>> Subject: Re: Saudi Telecom sending route with invalid attributes
>> >>> 212.118.142.0/24
>> >>>
>> >>> with in the span of couple of hours this prefix was originated from
>> 3 ASN i.e. AS3561 (Savvis), AS8866 (BTC) and AS25019 (STC original
>> custodians).
>> >>>
>> >>> As per the STC it was orginated by one of their customer having
>> Juniper router. but I still don't understand why/how they are adv this
>> prefix with unrecog transitive attributes.
>> >>>
>> >>> Can any one suggest.
>> >>>
>> >>> Regards,
>> >>>
>> >>> Aftab A. Siddiqui
>> >>>
>> >>>
>> >>> On Sun, Sep 11, 2011 at 3:26 AM, Richard Barnes
>> <richard.barnes at gmail.com>wrote:
>> >>>
>> >>>> Looks like the RIS collectors are seeing it originating mostly
>> from
>> >>>> STC and KACST ASNs:
>> >>>> <http://stat.ripe.net/212.118.142.0/24>
>> >>>>
>> >>>> Some of the "show ip bgp" reports on that screen are also showing
>> >>>> AS8866 "BTC-AS Bulgarian Telecommunication Company".  Not sure
>> what's
>> >>>> up with that.
>> >>>>
>> >>>> --Richard
>> >>>>
>> >>>>
>> >>>>
>> >>>> On Sat, Sep 10, 2011 at 2:01 PM, Christopher Morrow
>> >>>> <morrowc.lists at gmail.com> wrote:
>> >>>>> On Fri, Sep 9, 2011 at 9:26 PM, Kyle Duren
>> <pixitha.kyle at gmail.com>
>> >>>> wrote:
>> >>>>>> Is this announcement still showing up this way (no easy way to
>> >>>>>> check myself).
>> >>>>>
>> >>>>> ripe ris?
>> >>>>>
>> >>>>>> -Kyle
>> >>>>>>
>> >>>>>> On Thu, Sep 8, 2011 at 4:20 PM, Clay Haynes
>> >>>>>> <chaynes at centracomm.net>
>> >>>> wrote:
>> >>>>>>
>> >>>>>>> On Thu, Sep 8, 2011 at 7:11 PM, Jonas Frey (Probe Networks) <
>> >>>>>>> jf at probe-networks.de> wrote:
>> >>>>>>>
>> >>>>>>>> Hello,
>> >>>>>>>>
>> >>>>>>>> anyone else getting a route for 212.118.142.0/24 with invalid
>> >>>>>>>> attributes? Seems this is (again) causing problems with some
>> >>>>>>>> (older) routers/software.
>> >>>>>>>>
>> >>>>>>>>              Announcement bits (4): 0-KRT 3-KRT 5-Resolve tree
>> >>>>>>>> 1 6-Resolve tree 2
>> >>>>>>>>               AS path: 6453 39386 25019 I Unrecognized
>> Attributes:
>> >>>> 39
>> >>>>>>>> bytes
>> >>>>>>>>               AS path:  Attr flags e0 code 80: 00 00 fd 88 40
>> >>>>>>>> 01 01
>> >>>> 02
>> >>>>>>>> 40 02 04 02 01 5b a0 c0 11 04 02 01 fc da 80 04 04 00 00 00 01
>> 40
>> >>>>>>>> 05
>> >>>> 04
>> >>>>>>>> 00 00 00 64
>> >>>>>>>>               Accepted Multipath
>> >>>>>>>>
>> >>>>>>>>
>> >>>>>>>> -Jonas
>> >>>>>>>>
>> >>>>>>>>
>> >>>>>>> Yup! We're seeing the same thing too, and we're filtering it
>> out.
>> >>>>>>> Originating AS is 25019
>> >>>>>>>
>> >>>>>>> -Clay
>> >>>>>>>
>> >>>>>>
>> >>>>>
>> >>>>>
>> >>>>
>> >>>>
>> >>>
>> >>>
>> >>
>> >>
>> >>
>> >
>>
>> -----
>> No virus found in this message.
>> Checked by AVG - www.avg.com
>> Version: 10.0.1410 / Virus Database: 1520/3906 - Release Date: 09/19/11
>
>