Being blackhole by some one.

Tony S. Hariman tonyh at noc.cbn.net.id
Sat Jan 24 01:44:46 UTC 1998


Blackhole here means that someone from different AS announce
our network using BGP.  So all the incoming traffic that suppose to go
to us, rerouted to this ISP.

Looking through Digex Mae-East looking glass this is what it suppose to be

202.158.0.0/19   192.41.177.181        50    100      0 3561 4787 4787 4787 i
                 192.41.177.145              100      0 4200 4787 i

But during the blackhole this is what is look like:

BGP routing table entry for 202.158.0.0/20, version 9520334
Paths: (4 available, best #3, advertised over IBGP)
  1800 1239 4003 7713
    192.41.177.240 from 192.41.177.240 (198.67.131.49)
      Origin incomplete, metric 11, localpref 100, valid, external
      Community: 2548:668
  1239 4003 7713
    165.117.1.122 (metric 28416) from 165.117.1.122
      Origin incomplete, metric 57, localpref 100, valid, internal
      Community: 2548:668
      Originator : 165.117.1.122, Cluster list: 165.117.1.122
  1239 4003 7713
    192.41.177.241 from 192.41.177.241 (144.228.107.1)
      Origin incomplete, metric 57, localpref 100, valid, external, best
      Community: 2548:668
  1239 4003 7713
    192.41.177.242 from 192.41.177.242 (144.228.101.1)
      Origin incomplete, metric 59, localpref 100, valid, external
      Community: 2548:668

To solve this problem I temporarily inject more specific route by
dividing my /19 to 4 /21

I talk to the owner of AS7713 they said during provisioning with
their upstream provider they make a mistake inadvertently announce
our ip block and few other ISP block.

I just wondering if this misshaps could be prevented, even someone make
a mistake.

Thanks,

On 23 Jan 98 at 10:35, Randy Bush wrote:

> 
> Could you please explain the issue more specifically.  "Blackhole" could
> have many meanings.
> 
Tony S. Hariman
http://www.tsh.or.id
Tel: +62(21)574-2488
Fax: +62(21)574-2481



More information about the NANOG mailing list