<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Thu, Nov 15, 2018 at 3:21 PM Michael Still <<a href="mailto:stillwaxin@gmail.com">stillwaxin@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr">FYI 29791 isn't the only origin I'm seeing this on from one point of view:<div><div> AS path: 3257 6453 9498 4637</div><div> AS path: 3257 6453 9498 4637 10310 26085 14210</div><div> AS path: 3257 6453 9498 4637 20773 29066</div><div> AS path: 3257 6453 9498 4637 2906</div><div> AS path: 3257 6453 9498 4637 2906 40027</div><div> AS path: 3257 6453 9498 4637 29791</div><div> AS path: 3257 6453 9498 4637 30844</div><div> AS path: 3257 6453 9498 4637 30844 36991</div><div> AS path: 3257 6453 9498 4637 30844 38056 38056 38056</div><div> AS path: 3257 6453 9498 4637 37468 37230</div><div> AS path: 3257 6453 9498 4637 37468 37230 37230 37230</div><div> AS path: 3257 6453 9498 4637 47869</div><div> AS path: 3356 6453 9498 4637</div><div> AS path: 3356 6453 9498 4637 1299 2906</div><div> AS path: 3356 6453 9498 4637 1299 3491 20485 20485 4809 49209</div><div> AS path: 3356 6453 9498 4637 20773 29066</div><div> AS path: 3356 6453 9498 4637 2906</div><div> AS path: 3356 6453 9498 4637 29791</div><div> AS path: 3356 6453 9498 4637 30844</div><div> AS path: 3356 6453 9498 4637 30844 36991</div><div> AS path: 3356 6453 9498 4637 30844 38056 38056 38056</div><div> AS path: 3356 6453 9498 4637 37468 37230</div><div> AS path: 3356 6453 9498 4637 37468 37230 37230 37230</div><div> AS path: 3356 6453 9498 4637 47869</div></div><div><br></div><div>I'm not sure what is supposed to be there for 6453_9498 but I suspect not nearly as much as is currently present (only 4637 listed here for brevity).</div><div><br></div></div></div></blockquote><div><br></div><div>huh... us-carrier -> tata -> airtel -> telstra .. that seems TOTALLY PLAUSIBLE.. no.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Nov 15, 2018 at 2:53 PM John Weekes <<a href="mailto:jw@nuclearfallout.net" target="_blank">jw@nuclearfallout.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
Marcus,<br>
<br>
From route-views output, it looks like AS9498/airtel is probably
leaking your route between two of its upstreams (AS6453/Tata and
AS4637/Telstra) overseas, funneling some of your traffic through
their router.<br>
<br>
route-views>sh ip bgp 23.92.178.22 | i 9498<br>
3356 6453 9498 4637 29791<br>
1403 6453 9498 4637 29791<br>
3549 3356 6453 9498 4637 29791<br>
19214 3257 6453 9498 4637 29791<br>
1403 6453 9498 4637 29791<br>
286 6453 9498 4637 29791<br>
53364 3257 6453 9498 4637 29791<br>
3257 6453 9498 4637 29791<br>
1239 6453 9498 4637 29791<br>
2497 6453 9498 4637 29791<br>
57866 6453 9498 4637 29791<br>
7660 2516 6453 9498 4637 29791<br>
701 6453 9498 4637 29791<br>
3561 209 6453 9498 4637 29791<br>
<br>
You might try halting advertisements to your AS4637/Telstra peer
while you contact AS9498.<br>
<br>
-John<br>
<br>
<div class="m_8307513832289933127m_-5447482032659963053moz-cite-prefix">On 11/15/2018 10:43 AM, Marcus
Josephson wrote:<br>
</div>
<blockquote type="cite">
<div class="m_8307513832289933127m_-5447482032659963053WordSection1">
<p class="MsoNormal"><a name="m_8307513832289933127_m_-5447482032659963053__Hlk526847416">Anyone else seeing an odd Scenic
routing in the LAX/SJE area for tata.<u></u><u></u></a></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span><span>traceroute to 23.92.178.22 (23.92.178.22), 30
hops max, 52 byte packets<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>1 <a href="http://if-ae-13-2.tcore2.lvw-los-angeles.as6453.net" target="_blank">if-ae-13-2.tcore2.lvw-los-angeles.as6453.net</a>
(64.86.252.34) 180.698 ms 180.610 ms 181.712 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span> MPLS Label=344269 CoS=0 TTL=1 S=1<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>2 <a href="http://if-ae-7-2.tcore2.svw-singapore.as6453.net" target="_blank">if-ae-7-2.tcore2.svw-singapore.as6453.net</a>
(180.87.15.25) 189.327 ms
<a href="http://if-ae-7-2.tcore2.svw-singapore.as6453.net" target="_blank">if-ae-7-2.tcore2.svw-singapore.as6453.net</a> (64.86.252.37)
176.800 ms <a href="http://if-ae-7-2.tcore2.svw-singapore.as6453.net" target="_blank">if-ae-7-2.tcore2.svw-singapore.as6453.net</a>
(64.86.252.39) 174.631 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span> MPLS Label=609315 CoS=0 TTL=1 S=1<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>3 <a href="http://if-ae-20-2.tcore1.svq-singapore.as6453.net" target="_blank">if-ae-20-2.tcore1.svq-singapore.as6453.net</a>
(180.87.96.21) 174.287 ms 173.370 ms 173.804 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>4 120.29.215.202 (120.29.215.202) 179.104 ms
179.367 ms 179.324 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>5 182.79.152.247 (182.79.152.247) 180.164 ms
182.79.152.253 (182.79.152.253) 184.816 ms 182.79.152.247
(182.79.152.247) 250.928 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>6 <a href="http://unknown.telstraglobal.net" target="_blank">unknown.telstraglobal.net</a> (202.127.73.101)
[AS 4637] 173.974 ms 173.986 ms 173.484 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>7 <a href="http://i-93.sgpl-core02.telstraglobal.net" target="_blank">i-93.sgpl-core02.telstraglobal.net</a>
(202.84.224.189) [AS 4637] 175.094 ms 175.699 ms
174.343 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>8 <a href="http://i-10850.eqnx-core02.telstraglobal.net" target="_blank">i-10850.eqnx-core02.telstraglobal.net</a>
(202.84.140.46) [AS 4637] 280.686 ms 288.703 ms
280.836 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>9 <a href="http://i-92.eqnx03.telstraglobal.net" target="_blank">i-92.eqnx03.telstraglobal.net</a>
(202.84.247.17) [AS 4637] 278.021 ms 276.637 ms
302.249 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span>10 <a href="http://equinix-ix.sjc1.us.voxel.net" target="_blank">equinix-ix.sjc1.us.voxel.net</a>
(206.223.116.4) 174.139 ms 174.163 ms 174.067 ms<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span><span style="font-size:14.0pt;font-family:"Arial",sans-serif;color:#00afaa"><img style="width:2.2187in;height:.6041in" id="m_8307513832289933127m_-5447482032659963053Picture_x0020_8" width="213" height="58"><u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span style="font-size:14.0pt;font-family:"Arial",sans-serif;color:#00afaa">Marcus
Josephson<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">IP
Operations<u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><u></u> <u></u></span></span></p>
<p class="MsoNormal"><span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><a class="m_8307513832289933127m_-5447482032659963053moz-txt-link-abbreviated" href="mailto:mjosephson@inap.com" target="_blank">mjosephson@inap.com</a><u></u><u></u></span></span></p>
<p class="MsoNormal"><span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#192732"><u></u> <u></u></span></span></p>
<p class="MsoNormal"><span><i><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#192732">This
message is intended for the use of the intended
recipient(s) and may contain confidential and privileged
information.
</span></i></span><span><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><u></u><u></u></span></span></p>
<p class="MsoNormal"><span><i><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#192732">Any
unauthorized review, use, disclosure or distribution is
prohibited. If you are not the intended recipient,
please contact</span></i></span><span><span style="font-family:"Arial",sans-serif">
</span></span><span><i><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#192732">the
sender by reply email and destroy all copies of the
original message.</span></i></span><span></span><span style="font-family:"Arial",sans-serif"><u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</blockquote>
<br>
</div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="m_8307513832289933127gmail_signature" data-smartmail="gmail_signature">[<a href="mailto:stillwaxin@gmail.com" target="_blank">stillwaxin@gmail.com</a> ~]$ cat .signature<br>cat: .signature: No such file or directory<br>[<a href="mailto:stillwaxin@gmail.com" target="_blank">stillwaxin@gmail.com</a> ~]$<br></div>
</blockquote></div></div>