Saudi Telecom sending route with invalid attributes 212.118.142.0/24

Sat Sep 10 22:49:17 UTC 2011

with in the span of couple of hours this prefix was originated from 3 ASN
i.e. AS3561 (Savvis), AS8866 (BTC) and AS25019 (STC original custodians).

As per the STC it was orginated by one of their customer having Juniper
router. but I still don't understand why/how they are adv this prefix with
unrecog transitive attributes.

Can any one suggest.

Regards,

Aftab A. Siddiqui

On Sun, Sep 11, 2011 at 3:26 AM, Richard Barnes <richard.barnes at gmail.com>wrote:

> Looks like the RIS collectors are seeing it originating mostly from
> STC and KACST ASNs:
> <http://stat.ripe.net/212.118.142.0/24>
>
> Some of the "show ip bgp" reports on that screen are also showing
> AS8866 "BTC-AS Bulgarian Telecommunication Company".  Not sure what's
> up with that.
>
> --Richard
>
>
>
> On Sat, Sep 10, 2011 at 2:01 PM, Christopher Morrow
> <morrowc.lists at gmail.com> wrote:
> > On Fri, Sep 9, 2011 at 9:26 PM, Kyle Duren <pixitha.kyle at gmail.com>
> wrote:
> >> Is this announcement still showing up this way (no easy way to check
> >> myself).
> >
> > ripe ris?
> >
> >> -Kyle
> >>
> >> On Thu, Sep 8, 2011 at 4:20 PM, Clay Haynes <chaynes at centracomm.net>
> wrote:
> >>
> >>> On Thu, Sep 8, 2011 at 7:11 PM, Jonas Frey (Probe Networks) <
> >>> jf at probe-networks.de> wrote:
> >>>
> >>> > Hello,
> >>> >
> >>> > anyone else getting a route for 212.118.142.0/24 with invalid
> >>> > attributes? Seems this is (again) causing problems with some (older)
> >>> > routers/software.
> >>> >
> >>> >               Announcement bits (4): 0-KRT 3-KRT 5-Resolve tree 1
> >>> > 6-Resolve tree 2
> >>> >                AS path: 6453 39386 25019 I Unrecognized Attributes:
> 39
> >>> > bytes
> >>> >                AS path:  Attr flags e0 code 80: 00 00 fd 88 40 01 01
> 02
> >>> > 40 02 04 02 01 5b a0 c0 11 04 02 01 fc da 80 04 04 00 00 00 01 40 05
> 04
> >>> > 00 00 00 64
> >>> >                Accepted Multipath
> >>> >
> >>> >
> >>> > -Jonas
> >>> >
> >>> >
> >>> Yup! We're seeing the same thing too, and we're filtering it out.
> >>> Originating AS is 25019
> >>>
> >>> -Clay
> >>>
> >>
> >
> >
>
>