Tata Scenic routing in LAX area?

Lotia, Pratik M Pratik.Lotia at charter.com
Thu Nov 15 21:10:37 UTC 2018


9498/Airtel seems to be leaking a lot of routes.

Source: https://bgpstream.com/

All Events for BGP Stream.
Event type

Country

ASN

Start time (UTC)

End time (UTC)

More info

BGP Leak

Origin AS: Etisalat Lanka (Pvt) Ltd. (AS 17470)
Leaker AS: BHARTI Airtel Ltd. (AS 9498)

2018-11-15 19:41:26

More detail<https://bgpstream.com/event/159847>

BGP Leak

Origin AS: Bharti Airtel Lanka Pvt. Limited (AS 132045)
Leaker AS: BHARTI Airtel Ltd. (AS 9498)

2018-11-15 19:41:26

More detail<https://bgpstream.com/event/159848>

BGP Leak

Origin AS: Antena3 S.A. (AS 47220)
Leaker AS: BHARTI Airtel Ltd. (AS 9498)

2018-11-15 19:22:39

More detail<https://bgpstream.com/event/159845>

BGP Leak

Origin AS: INDOSATM2 ASN (AS 4795)
Leaker AS: BHARTI Airtel Ltd. (AS 9498)

2018-11-15 18:46:59

More detail<https://bgpstream.com/event/159790>

BGP Leak

Origin AS: KANARTEL (AS 33788)
Leaker AS: BHARTI Airtel Ltd. (AS 9498)

2018-11-15 18:33:09

More detail<https://bgpstream.com/event/159784>

BGP Leak

Origin AS: FranTech Solutions (AS 53667)
Leaker AS: BHARTI Airtel Ltd. (AS 9498)

2018-11-15 18:04:47

More detail<https://bgpstream.com/event/159841>

BGP Leak

Origin AS: Pure Line Co. For Telecommunications & Internet Ltd. (AS 59458)
Leaker AS: BHARTI Airtel Ltd. (AS 9498)

2018-11-15 18:04:05

More detail<https://bgpstream.com/event/159839>

BGP Leak

Origin AS: Sepehr Ava Data Processing Company (LTD) (AS 51541)
Leaker AS: BHARTI Airtel Ltd. (AS 9498)

2018-11-15 18:01:09

More detail<https://bgpstream.com/event/159840>




~Pratik Lotia

“Improvement begins with I.”


From: NANOG <nanog-bounces at nanog.org> on behalf of Marcus Josephson <mjosephson at inap.com>
Date: Thursday, November 15, 2018 at 13:48
To: Christopher Morrow <morrowc.lists at gmail.com>, "stillwaxin at gmail.com" <stillwaxin at gmail.com>
Cc: nanog list <nanog at nanog.org>
Subject: RE: Tata Scenic routing in LAX area?

I have tried to reach out to Airtel, no response yet, but yah I could see my issue being due to them leaking routes.


-Marcus

From: NANOG <nanog-bounces at nanog.org> On Behalf Of Christopher Morrow
Sent: Thursday, November 15, 2018 3:30 PM
To: stillwaxin at gmail.com
Cc: nanog list <nanog at nanog.org>
Subject: Re: Tata Scenic routing in LAX area?


On Thu, Nov 15, 2018 at 3:21 PM Michael Still <stillwaxin at gmail.com<mailto:stillwaxin at gmail.com>> wrote:
FYI 29791 isn't the only origin I'm seeing this on from one point of view:
                      AS path: 3257 6453 9498 4637
                      AS path: 3257 6453 9498 4637 10310 26085 14210
                      AS path: 3257 6453 9498 4637 20773 29066
                      AS path: 3257 6453 9498 4637 2906
                      AS path: 3257 6453 9498 4637 2906 40027
                      AS path: 3257 6453 9498 4637 29791
                      AS path: 3257 6453 9498 4637 30844
                      AS path: 3257 6453 9498 4637 30844 36991
                      AS path: 3257 6453 9498 4637 30844 38056 38056 38056
                      AS path: 3257 6453 9498 4637 37468 37230
                      AS path: 3257 6453 9498 4637 37468 37230 37230 37230
                      AS path: 3257 6453 9498 4637 47869
                      AS path: 3356 6453 9498 4637
                      AS path: 3356 6453 9498 4637 1299 2906
                      AS path: 3356 6453 9498 4637 1299 3491 20485 20485 4809 49209
                      AS path: 3356 6453 9498 4637 20773 29066
                      AS path: 3356 6453 9498 4637 2906
                      AS path: 3356 6453 9498 4637 29791
                      AS path: 3356 6453 9498 4637 30844
                      AS path: 3356 6453 9498 4637 30844 36991
                      AS path: 3356 6453 9498 4637 30844 38056 38056 38056
                      AS path: 3356 6453 9498 4637 37468 37230
                      AS path: 3356 6453 9498 4637 37468 37230 37230 37230
                      AS path: 3356 6453 9498 4637 47869

I'm not sure what is supposed to be there for 6453_9498 but I suspect not nearly as much as is currently present (only 4637 listed here for brevity).


huh... us-carrier -> tata -> airtel -> telstra .. that seems TOTALLY PLAUSIBLE.. no.



On Thu, Nov 15, 2018 at 2:53 PM John Weekes <jw at nuclearfallout.net<mailto:jw at nuclearfallout.net>> wrote:
Marcus,

From route-views output, it looks like AS9498/airtel is probably leaking your route between two of its upstreams (AS6453/Tata and AS4637/Telstra) overseas, funneling some of your traffic through their router.

route-views>sh ip bgp 23.92.178.22 | i 9498
  3356 6453 9498 4637 29791
  1403 6453 9498 4637 29791
  3549 3356 6453 9498 4637 29791
  19214 3257 6453 9498 4637 29791
  1403 6453 9498 4637 29791
  286 6453 9498 4637 29791
  53364 3257 6453 9498 4637 29791
  3257 6453 9498 4637 29791
  1239 6453 9498 4637 29791
  2497 6453 9498 4637 29791
  57866 6453 9498 4637 29791
  7660 2516 6453 9498 4637 29791
  701 6453 9498 4637 29791
  3561 209 6453 9498 4637 29791

You might try halting advertisements to your AS4637/Telstra peer while you contact AS9498.

-John
On 11/15/2018 10:43 AM, Marcus Josephson wrote:
Anyone else seeing an odd Scenic routing in the LAX/SJE area for tata.

traceroute to 23.92.178.22 (23.92.178.22), 30 hops max, 52 byte packets
1  if-ae-13-2.tcore2.lvw-los-angeles.as6453.net<http://if-ae-13-2.tcore2.lvw-los-angeles.as6453.net> (64.86.252.34)  180.698 ms  180.610 ms  181.712 ms
     MPLS Label=344269 CoS=0 TTL=1 S=1
2  if-ae-7-2.tcore2.svw-singapore.as6453.net<http://if-ae-7-2.tcore2.svw-singapore.as6453.net> (180.87.15.25)  189.327 ms if-ae-7-2.tcore2.svw-singapore.as6453.net<http://if-ae-7-2.tcore2.svw-singapore.as6453.net> (64.86.252.37)  176.800 ms if-ae-7-2.tcore2.svw-singapore.as6453.net<http://if-ae-7-2.tcore2.svw-singapore.as6453.net> (64.86.252.39)  174.631 ms
     MPLS Label=609315 CoS=0 TTL=1 S=1
3  if-ae-20-2.tcore1.svq-singapore.as6453.net<http://if-ae-20-2.tcore1.svq-singapore.as6453.net> (180.87.96.21)  174.287 ms  173.370 ms  173.804 ms
4  120.29.215.202 (120.29.215.202)  179.104 ms  179.367 ms  179.324 ms
5  182.79.152.247 (182.79.152.247)  180.164 ms 182.79.152.253 (182.79.152.253)  184.816 ms 182.79.152.247 (182.79.152.247)  250.928 ms
6  unknown.telstraglobal.net<http://unknown.telstraglobal.net> (202.127.73.101) [AS  4637]  173.974 ms  173.986 ms  173.484 ms
7  i-93.sgpl-core02.telstraglobal.net<http://i-93.sgpl-core02.telstraglobal.net> (202.84.224.189) [AS  4637]  175.094 ms  175.699 ms  174.343 ms
8  i-10850.eqnx-core02.telstraglobal.net<http://i-10850.eqnx-core02.telstraglobal.net> (202.84.140.46) [AS  4637]  280.686 ms  288.703 ms  280.836 ms
9  i-92.eqnx03.telstraglobal.net<http://i-92.eqnx03.telstraglobal.net> (202.84.247.17) [AS  4637]  278.021 ms  276.637 ms  302.249 ms
10  equinix-ix.sjc1.us.voxel.net<http://equinix-ix.sjc1.us.voxel.net> (206.223.116.4)  174.139 ms  174.163 ms  174.067 ms


Marcus Josephson
IP Operations

mjosephson at inap.com<mailto:mjosephson at inap.com>

This message is intended for the use of the intended recipient(s) and may contain confidential and privileged information.
Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.




--
[stillwaxin at gmail.com<mailto:stillwaxin at gmail.com> ~]$ cat .signature
cat: .signature: No such file or directory
[stillwaxin at gmail.com<mailto:stillwaxin at gmail.com> ~]$
E-MAIL CONFIDENTIALITY NOTICE: 
The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20181115/726fda4e/attachment.html>


More information about the NANOG mailing list