Tata Scenic routing in LAX area?

Anurag Bhatia me at anuragbhatia.com
Thu Nov 15 23:37:50 UTC 2018


I have shared about this leak with known contacts in their NOC.


Thanks.

On Fri, Nov 16, 2018 at 4:05 AM Tom Beecher <beecher at beecher.cc> wrote:

> I don't know what's less surprising, Tata making sure you see the entire
> internet (wink wink), or Airtel leaking routes... :)
>
> On Thu, Nov 15, 2018 at 4:13 PM Lotia, Pratik M <Pratik.Lotia at charter.com>
> wrote:
>
>> 9498/Airtel seems to be leaking a lot of routes.
>>
>>
>>
>> Source: https://bgpstream.com/
>>
>>
>>
>> All Events for BGP Stream.
>>
>> *Event type*
>>
>> *Country*
>>
>> *ASN*
>>
>> *Start time (UTC)*
>>
>> *End time (UTC)*
>>
>> *More info*
>>
>> BGP Leak
>>
>> *Origin AS:* Etisalat Lanka (Pvt) Ltd. (AS 17470)
>> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>>
>> 2018-11-15 19:41:26
>>
>> More detail <https://bgpstream.com/event/159847>
>>
>> BGP Leak
>>
>> *Origin AS:* Bharti Airtel Lanka Pvt. Limited (AS 132045)
>> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>>
>> 2018-11-15 19:41:26
>>
>> More detail <https://bgpstream.com/event/159848>
>>
>> BGP Leak
>>
>> *Origin AS:* Antena3 S.A. (AS 47220)
>> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>>
>> 2018-11-15 19:22:39
>>
>> More detail <https://bgpstream.com/event/159845>
>>
>> BGP Leak
>>
>> *Origin AS:* INDOSATM2 ASN (AS 4795)
>> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>>
>> 2018-11-15 18:46:59
>>
>> More detail <https://bgpstream.com/event/159790>
>>
>> BGP Leak
>>
>> *Origin AS:* KANARTEL (AS 33788)
>> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>>
>> 2018-11-15 18:33:09
>>
>> More detail <https://bgpstream.com/event/159784>
>>
>> BGP Leak
>>
>> *Origin AS:* FranTech Solutions (AS 53667)
>> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>>
>> 2018-11-15 18:04:47
>>
>> More detail <https://bgpstream.com/event/159841>
>>
>> BGP Leak
>>
>> *Origin AS:* Pure Line Co. For Telecommunications & Internet Ltd. (AS
>> 59458)
>> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>>
>> 2018-11-15 18:04:05
>>
>> More detail <https://bgpstream.com/event/159839>
>>
>> BGP Leak
>>
>> *Origin AS:* Sepehr Ava Data Processing Company (LTD) (AS 51541)
>> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498)
>>
>> 2018-11-15 18:01:09
>>
>> More detail <https://bgpstream.com/event/159840>
>>
>>
>>
>>
>>
>>
>>
>> ~Pratik Lotia
>>
>>
>>
>> “Improvement begins with I.”
>>
>>
>>
>>
>>
>> *From: *NANOG <nanog-bounces at nanog.org> on behalf of Marcus Josephson <
>> mjosephson at inap.com>
>> *Date: *Thursday, November 15, 2018 at 13:48
>> *To: *Christopher Morrow <morrowc.lists at gmail.com>, "stillwaxin at gmail.com"
>> <stillwaxin at gmail.com>
>> *Cc: *nanog list <nanog at nanog.org>
>> *Subject: *RE: Tata Scenic routing in LAX area?
>>
>>
>>
>> I have tried to reach out to Airtel, no response yet, but yah I could see
>> my issue being due to them leaking routes.
>>
>>
>>
>>
>>
>> -Marcus
>>
>>
>>
>> *From:* NANOG <nanog-bounces at nanog.org> *On Behalf Of *Christopher Morrow
>> *Sent:* Thursday, November 15, 2018 3:30 PM
>> *To:* stillwaxin at gmail.com
>> *Cc:* nanog list <nanog at nanog.org>
>> *Subject:* Re: Tata Scenic routing in LAX area?
>>
>>
>>
>>
>>
>> On Thu, Nov 15, 2018 at 3:21 PM Michael Still <stillwaxin at gmail.com>
>> wrote:
>>
>> FYI 29791 isn't the only origin I'm seeing this on from one point of view:
>>
>>                       AS path: 3257 6453 9498 4637
>>
>>                       AS path: 3257 6453 9498 4637 10310 26085 14210
>>
>>                       AS path: 3257 6453 9498 4637 20773 29066
>>
>>                       AS path: 3257 6453 9498 4637 2906
>>
>>                       AS path: 3257 6453 9498 4637 2906 40027
>>
>>                       AS path: 3257 6453 9498 4637 29791
>>
>>                       AS path: 3257 6453 9498 4637 30844
>>
>>                       AS path: 3257 6453 9498 4637 30844 36991
>>
>>                       AS path: 3257 6453 9498 4637 30844 38056 38056 38056
>>
>>                       AS path: 3257 6453 9498 4637 37468 37230
>>
>>                       AS path: 3257 6453 9498 4637 37468 37230 37230 37230
>>
>>                       AS path: 3257 6453 9498 4637 47869
>>
>>                       AS path: 3356 6453 9498 4637
>>
>>                       AS path: 3356 6453 9498 4637 1299 2906
>>
>>                       AS path: 3356 6453 9498 4637 1299 3491 20485 20485
>> 4809 49209
>>
>>                       AS path: 3356 6453 9498 4637 20773 29066
>>
>>                       AS path: 3356 6453 9498 4637 2906
>>
>>                       AS path: 3356 6453 9498 4637 29791
>>
>>                       AS path: 3356 6453 9498 4637 30844
>>
>>                       AS path: 3356 6453 9498 4637 30844 36991
>>
>>                       AS path: 3356 6453 9498 4637 30844 38056 38056 38056
>>
>>                       AS path: 3356 6453 9498 4637 37468 37230
>>
>>                       AS path: 3356 6453 9498 4637 37468 37230 37230 37230
>>
>>                       AS path: 3356 6453 9498 4637 47869
>>
>>
>>
>> I'm not sure what is supposed to be there for 6453_9498 but I suspect not
>> nearly as much as is currently present (only 4637 listed here for brevity).
>>
>>
>>
>>
>>
>> huh... us-carrier -> tata -> airtel -> telstra .. that seems TOTALLY
>> PLAUSIBLE.. no.
>>
>>
>>
>>
>>
>>
>>
>> On Thu, Nov 15, 2018 at 2:53 PM John Weekes <jw at nuclearfallout.net>
>> wrote:
>>
>> Marcus,
>>
>> From route-views output, it looks like AS9498/airtel is probably leaking
>> your route between two of its upstreams (AS6453/Tata and AS4637/Telstra)
>> overseas, funneling some of your traffic through their router.
>>
>> route-views>sh ip bgp 23.92.178.22 | i 9498
>>   3356 6453 9498 4637 29791
>>   1403 6453 9498 4637 29791
>>   3549 3356 6453 9498 4637 29791
>>   19214 3257 6453 9498 4637 29791
>>   1403 6453 9498 4637 29791
>>   286 6453 9498 4637 29791
>>   53364 3257 6453 9498 4637 29791
>>   3257 6453 9498 4637 29791
>>   1239 6453 9498 4637 29791
>>   2497 6453 9498 4637 29791
>>   57866 6453 9498 4637 29791
>>   7660 2516 6453 9498 4637 29791
>>   701 6453 9498 4637 29791
>>   3561 209 6453 9498 4637 29791
>>
>> You might try halting advertisements to your AS4637/Telstra peer while
>> you contact AS9498.
>>
>> -John
>>
>> On 11/15/2018 10:43 AM, Marcus Josephson wrote:
>>
>> Anyone else seeing an odd Scenic routing in the LAX/SJE area for tata.
>>
>>
>>
>> traceroute to 23.92.178.22 (23.92.178.22), 30 hops max, 52 byte packets
>>
>> 1  if-ae-13-2.tcore2.lvw-los-angeles.as6453.net (64.86.252.34)  180.698
>> ms  180.610 ms  181.712 ms
>>
>>      MPLS Label=344269 CoS=0 TTL=1 S=1
>>
>> 2  if-ae-7-2.tcore2.svw-singapore.as6453.net (180.87.15.25)  189.327 ms
>> if-ae-7-2.tcore2.svw-singapore.as6453.net (64.86.252.37)  176.800 ms
>> if-ae-7-2.tcore2.svw-singapore.as6453.net (64.86.252.39)  174.631 ms
>>
>>      MPLS Label=609315 CoS=0 TTL=1 S=1
>>
>> 3  if-ae-20-2.tcore1.svq-singapore.as6453.net (180.87.96.21)  174.287
>> ms  173.370 ms  173.804 ms
>>
>> 4  120.29.215.202 (120.29.215.202)  179.104 ms  179.367 ms  179.324 ms
>>
>> 5  182.79.152.247 (182.79.152.247)  180.164 ms 182.79.152.253
>> (182.79.152.253)  184.816 ms 182.79.152.247 (182.79.152.247)  250.928 ms
>>
>> 6  unknown.telstraglobal.net (202.127.73.101) [AS  4637]  173.974 ms
>> 173.986 ms  173.484 ms
>>
>> 7  i-93.sgpl-core02.telstraglobal.net (202.84.224.189) [AS  4637]
>> 175.094 ms  175.699 ms  174.343 ms
>>
>> 8  i-10850.eqnx-core02.telstraglobal.net (202.84.140.46) [AS  4637]
>> 280.686 ms  288.703 ms  280.836 ms
>>
>> 9  i-92.eqnx03.telstraglobal.net (202.84.247.17) [AS  4637]  278.021 ms
>> 276.637 ms  302.249 ms
>>
>> 10  equinix-ix.sjc1.us.voxel.net (206.223.116.4)  174.139 ms  174.163
>> ms  174.067 ms
>>
>>
>>
>>
>>
>> Marcus Josephson
>>
>> IP Operations
>>
>>
>>
>> mjosephson at inap.com
>>
>>
>>
>> *This message is intended for the use of the intended recipient(s) and
>> may contain confidential and privileged information. *
>>
>> *Any unauthorized review, use, disclosure or distribution is prohibited.
>> If you are not the intended recipient, please contact* *the sender by
>> reply email and destroy all copies of the original message.*
>>
>>
>>
>>
>>
>>
>>
>>
>> --
>>
>> [stillwaxin at gmail.com ~]$ cat .signature
>> cat: .signature: No such file or directory
>> [stillwaxin at gmail.com ~]$
>>
>> The contents of this e-mail message and
>> any attachments are intended solely for the
>> addressee(s) and may contain confidential
>> and/or legally privileged information. If you
>> are not the intended recipient of this message
>> or if this message has been addressed to you
>> in error, please immediately alert the sender
>> by reply e-mail and then delete this message
>> and any attachments. If you are not the
>> intended recipient, you are notified that
>> any use, dissemination, distribution, copying,
>> or storage of this message or any attachment
>> is strictly prohibited.
>>
>

-- 


Anurag Bhatia
anuragbhatia.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20181116/7ebffd95/attachment.html>


More information about the NANOG mailing list