What's going on with AS147028?

August Yang ayang at august.tw
Tue Jul 12 20:15:10 UTC 2022

Indeed the network feeds some of the major route collectors.

One known cause is LL-IX <https://ll-ix.com/en/services> which operates in a topology that partially transits routes from physical exchanges to its participants and strips their ASN in path. 
> Possibility to peer with a large number of AMS-IX (Netherlands, Haarlem), DE-CIX (Germany, Frankfurt), MSK-IX (Russia, Moscow), SIX (USA, Seattle) and PLIX (Poland, Warsaw) participants

The network operator might have intentionally or unintentionally forgot to prepend his own ASN before exporting to the collectors. Chances are misconfigured route reflector or the eager of more visible peers on those toolkits.

The issue is widely observed on a number of hobby networks.

Best regards
August Yang

> On Jul 12, 2022, at 3:49 PM, Eric Dugas via NANOG <nanog at nanog.org> wrote:
> A friend of mine mentioned that both our Canadian ASNs were listed in AS147028's peer list on https://bgp.he.net/AS147028 but we have no adjacency to this network.
> Their peer count jumped from 1 in May 2022 to 1,800 and just a few days ago jumped to 8,800. Beside NL-IX, all the IX they are listed on are virtual IX with a few dozen "hobby networks".
> The only lead I have is they use HE as transit and they're pumping back BGP feed to route collectors like RIPE RIS or Route Views with routes stripped of HE's ASN.
> Eric

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20220712/587ab0c5/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4372 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20220712/587ab0c5/attachment.bin>

More information about the NANOG mailing list