Tata Scenic routing in LAX area?
Tom Beecher
beecher at beecher.cc
Thu Nov 15 22:33:56 UTC 2018
I don't know what's less surprising, Tata making sure you see the entire
internet (wink wink), or Airtel leaking routes... :)
On Thu, Nov 15, 2018 at 4:13 PM Lotia, Pratik M <Pratik.Lotia at charter.com>
wrote:
> 9498/Airtel seems to be leaking a lot of routes.
>
>
>
> Source: https://bgpstream.com/
>
>
>
> All Events for BGP Stream.
>
> *Event type*
>
> *Country*
>
> *ASN*
>
> *Start time (UTC)*
>
> *End time (UTC)*
>
> *More info*
>
> BGP Leak
>
> *Origin AS:* Etisalat Lanka (Pvt) Ltd. (AS 17470)
> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>
> 2018-11-15 19:41:26
>
> More detail <https://bgpstream.com/event/159847>
>
> BGP Leak
>
> *Origin AS:* Bharti Airtel Lanka Pvt. Limited (AS 132045)
> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>
> 2018-11-15 19:41:26
>
> More detail <https://bgpstream.com/event/159848>
>
> BGP Leak
>
> *Origin AS:* Antena3 S.A. (AS 47220)
> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>
> 2018-11-15 19:22:39
>
> More detail <https://bgpstream.com/event/159845>
>
> BGP Leak
>
> *Origin AS:* INDOSATM2 ASN (AS 4795)
> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>
> 2018-11-15 18:46:59
>
> More detail <https://bgpstream.com/event/159790>
>
> BGP Leak
>
> *Origin AS:* KANARTEL (AS 33788)
> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>
> 2018-11-15 18:33:09
>
> More detail <https://bgpstream.com/event/159784>
>
> BGP Leak
>
> *Origin AS:* FranTech Solutions (AS 53667)
> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>
> 2018-11-15 18:04:47
>
> More detail <https://bgpstream.com/event/159841>
>
> BGP Leak
>
> *Origin AS:* Pure Line Co. For Telecommunications & Internet Ltd. (AS
> 59458)
> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>
> 2018-11-15 18:04:05
>
> More detail <https://bgpstream.com/event/159839>
>
> BGP Leak
>
> *Origin AS:* Sepehr Ava Data Processing Company (LTD) (AS 51541)
> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>
> 2018-11-15 18:01:09
>
> More detail <https://bgpstream.com/event/159840>
>
>
>
>
>
>
>
> ~Pratik Lotia
>
>
>
> “Improvement begins with I.”
>
>
>
>
>
> *From: *NANOG <nanog-bounces at nanog.org> on behalf of Marcus Josephson <
> mjosephson at inap.com>
> *Date: *Thursday, November 15, 2018 at 13:48
> *To: *Christopher Morrow <morrowc.lists at gmail.com>, "stillwaxin at gmail.com"
> <stillwaxin at gmail.com>
> *Cc: *nanog list <nanog at nanog.org>
> *Subject: *RE: Tata Scenic routing in LAX area?
>
>
>
> I have tried to reach out to Airtel, no response yet, but yah I could see
> my issue being due to them leaking routes.
>
>
>
>
>
> -Marcus
>
>
>
> *From:* NANOG <nanog-bounces at nanog.org> *On Behalf Of *Christopher Morrow
> *Sent:* Thursday, November 15, 2018 3:30 PM
> *To:* stillwaxin at gmail.com
> *Cc:* nanog list <nanog at nanog.org>
> *Subject:* Re: Tata Scenic routing in LAX area?
>
>
>
>
>
> On Thu, Nov 15, 2018 at 3:21 PM Michael Still <stillwaxin at gmail.com>
> wrote:
>
> FYI 29791 isn't the only origin I'm seeing this on from one point of view:
>
> AS path: 3257 6453 9498 4637
>
> AS path: 3257 6453 9498 4637 10310 26085 14210
>
> AS path: 3257 6453 9498 4637 20773 29066
>
> AS path: 3257 6453 9498 4637 2906
>
> AS path: 3257 6453 9498 4637 2906 40027
>
> AS path: 3257 6453 9498 4637 29791
>
> AS path: 3257 6453 9498 4637 30844
>
> AS path: 3257 6453 9498 4637 30844 36991
>
> AS path: 3257 6453 9498 4637 30844 38056 38056 38056
>
> AS path: 3257 6453 9498 4637 37468 37230
>
> AS path: 3257 6453 9498 4637 37468 37230 37230 37230
>
> AS path: 3257 6453 9498 4637 47869
>
> AS path: 3356 6453 9498 4637
>
> AS path: 3356 6453 9498 4637 1299 2906
>
> AS path: 3356 6453 9498 4637 1299 3491 20485 20485
> 4809 49209
>
> AS path: 3356 6453 9498 4637 20773 29066
>
> AS path: 3356 6453 9498 4637 2906
>
> AS path: 3356 6453 9498 4637 29791
>
> AS path: 3356 6453 9498 4637 30844
>
> AS path: 3356 6453 9498 4637 30844 36991
>
> AS path: 3356 6453 9498 4637 30844 38056 38056 38056
>
> AS path: 3356 6453 9498 4637 37468 37230
>
> AS path: 3356 6453 9498 4637 37468 37230 37230 37230
>
> AS path: 3356 6453 9498 4637 47869
>
>
>
> I'm not sure what is supposed to be there for 6453_9498 but I suspect not
> nearly as much as is currently present (only 4637 listed here for brevity).
>
>
>
>
>
> huh... us-carrier -> tata -> airtel -> telstra .. that seems TOTALLY
> PLAUSIBLE.. no.
>
>
>
>
>
>
>
> On Thu, Nov 15, 2018 at 2:53 PM John Weekes <jw at nuclearfallout.net> wrote:
>
> Marcus,
>
> From route-views output, it looks like AS9498/airtel is probably leaking
> your route between two of its upstreams (AS6453/Tata and AS4637/Telstra)
> overseas, funneling some of your traffic through their router.
>
> route-views>sh ip bgp 23.92.178.22 | i 9498
> 3356 6453 9498 4637 29791
> 1403 6453 9498 4637 29791
> 3549 3356 6453 9498 4637 29791
> 19214 3257 6453 9498 4637 29791
> 1403 6453 9498 4637 29791
> 286 6453 9498 4637 29791
> 53364 3257 6453 9498 4637 29791
> 3257 6453 9498 4637 29791
> 1239 6453 9498 4637 29791
> 2497 6453 9498 4637 29791
> 57866 6453 9498 4637 29791
> 7660 2516 6453 9498 4637 29791
> 701 6453 9498 4637 29791
> 3561 209 6453 9498 4637 29791
>
> You might try halting advertisements to your AS4637/Telstra peer while you
> contact AS9498.
>
> -John
>
> On 11/15/2018 10:43 AM, Marcus Josephson wrote:
>
> Anyone else seeing an odd Scenic routing in the LAX/SJE area for tata.
>
>
>
> traceroute to 23.92.178.22 (23.92.178.22), 30 hops max, 52 byte packets
>
> 1 if-ae-13-2.tcore2.lvw-los-angeles.as6453.net (64.86.252.34) 180.698
> ms 180.610 ms 181.712 ms
>
> MPLS Label=344269 CoS=0 TTL=1 S=1
>
> 2 if-ae-7-2.tcore2.svw-singapore.as6453.net (180.87.15.25) 189.327 ms
> if-ae-7-2.tcore2.svw-singapore.as6453.net (64.86.252.37) 176.800 ms
> if-ae-7-2.tcore2.svw-singapore.as6453.net (64.86.252.39) 174.631 ms
>
> MPLS Label=609315 CoS=0 TTL=1 S=1
>
> 3 if-ae-20-2.tcore1.svq-singapore.as6453.net (180.87.96.21) 174.287 ms
> 173.370 ms 173.804 ms
>
> 4 120.29.215.202 (120.29.215.202) 179.104 ms 179.367 ms 179.324 ms
>
> 5 182.79.152.247 (182.79.152.247) 180.164 ms 182.79.152.253
> (182.79.152.253) 184.816 ms 182.79.152.247 (182.79.152.247) 250.928 ms
>
> 6 unknown.telstraglobal.net (202.127.73.101) [AS 4637] 173.974 ms
> 173.986 ms 173.484 ms
>
> 7 i-93.sgpl-core02.telstraglobal.net (202.84.224.189) [AS 4637]
> 175.094 ms 175.699 ms 174.343 ms
>
> 8 i-10850.eqnx-core02.telstraglobal.net (202.84.140.46) [AS 4637]
> 280.686 ms 288.703 ms 280.836 ms
>
> 9 i-92.eqnx03.telstraglobal.net (202.84.247.17) [AS 4637] 278.021 ms
> 276.637 ms 302.249 ms
>
> 10 equinix-ix.sjc1.us.voxel.net (206.223.116.4) 174.139 ms 174.163 ms
> 174.067 ms
>
>
>
>
>
> Marcus Josephson
>
> IP Operations
>
>
>
> mjosephson at inap.com
>
>
>
> *This message is intended for the use of the intended recipient(s) and may
> contain confidential and privileged information. *
>
> *Any unauthorized review, use, disclosure or distribution is prohibited.
> If you are not the intended recipient, please contact* *the sender by
> reply email and destroy all copies of the original message.*
>
>
>
>
>
>
>
>
> --
>
> [stillwaxin at gmail.com ~]$ cat .signature
> cat: .signature: No such file or directory
> [stillwaxin at gmail.com ~]$
>
> The contents of this e-mail message and
> any attachments are intended solely for the
> addressee(s) and may contain confidential
> and/or legally privileged information. If you
> are not the intended recipient of this message
> or if this message has been addressed to you
> in error, please immediately alert the sender
> by reply e-mail and then delete this message
> and any attachments. If you are not the
> intended recipient, you are notified that
> any use, dissemination, distribution, copying,
> or storage of this message or any attachment
> is strictly prohibited.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20181115/9d3f553e/attachment.html>
More information about the NANOG
mailing list