Tell me about AS19111

Thu Feb 6 09:34:24 UTC 2020

In message <CAJ_LqoEjvu3F02aNVrtsXStJumjiwK4UtX4v4n0RNf-rEmCjog at mail.gmail.com>, 
Shane Ronan <shane at ronan-online.com> wrote:

>It's not clear to me that HE having reserved AS numbers in THEIR routing
>table is actually a problem. These AS numbers are actually reserved for
>private use. Perhaps they have a customer who wants to do BGP but doesn't
>want to register their own AS number and is single-homed to HE. In this
>case, HE can assign them a reserved AS number to use for the session and as
>long as HE strips that AS number when it leaves THEIR network, things are
>working as intended.

It is not in the least bit clear that such stripping is in fact occuring,
and if anything the available evidence seems to suggest that it may not be.

The key point is accountability.  In the case of bogon ASNs, no one is
responsible, and an aggreived or offended party cannot easily find out
even who to discuss the matter with if they are being hacked, attacked,
or spammed from a range of IPs being routed by a bogon ASN.

Regards,
rfg

P.S.  It does not seem to be the case that only HE internal sensors
are the only ones seeing some of these routes.  Here is what RIPEstat
is telling me right now about routes being announced by AS65000, just
to name one bogon ASN out of many:

46.102.148.0/22
212.93.181.0/24
168.205.156.0/24
93.118.40.0/22
2806:288:800::/40
190.15.126.0/23
197.6.0.0/16
31.207.16.0/20
188.240.32.0/22
89.36.232.0/22
89.42.48.0/23
89.40.108.0/23
188.210.94.0/23
197.5.0.0/18
31.207.8.0/21
82.97.196.0/23
84.247.32.0/22
82.97.192.0/23
213.150.187.0/24
193.124.240.0/22
89.35.164.0/22
197.9.0.0/16
197.4.0.0/16
194.58.24.0/22
93.115.102.0/23
212.93.182.0/24
185.125.64.0/22
81.91.16.0/21
197.7.0.0/16
89.38.106.0/23
186.32.9.0/24
109.232.251.0/24
93.115.48.0/22
31.219.177.0/24
194.135.48.0/22
86.105.160.0/22
89.46.132.0/22
195.122.244.0/24
89.43.68.0/23
2803:ea80::/36
80.240.108.0/23
197.8.0.0/16
188.214.40.0/21
194.58.216.0/22
213.150.185.0/24