<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<tt style="box-sizing:border-box">I think one of the reason is LL-IX strips their own ASN (59947) from the path and feed it to the route server. I see it as junk routes, and lots of people forgot(or intentionally not) to add 59947 back.<br>
I scanned all <a href="https://ixp.ll-ix.com/api/v4/member-export/ixf/1.0" title="https://ixp.ll-ix.com/api/v4/member-export/ixf/1.0">
LLIX members</a> this morning(<a href="https://i.imgur.com/CsB8I1M.png">https://i.imgur.com/CsB8I1M.png</a>), only AS140731 is still feeding junk routes generated by LL-IX to the RIS and bgp.tools, I think it's fine to remove AS141011/AS141237/AS147028 from
the filter list.<br>
</tt></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<tt style="box-sizing:border-box"><br>
</tt></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<pre style="box-sizing:border-box;overflow-x:auto;margin:0em">On Wed, Jul 13, 2022 at 6:22 AM Mike Leber wrote:
</pre>
<blockquote style="box-sizing:border-box;font-family:"Times New Roman";font-size:medium;border-left:0.2em solid rgb(85, 85, 238);margin:0em;padding-left:0.85em">
<pre style="box-sizing:border-box;overflow-x:auto;margin:0em">This kind of thing is a problem from time to time with the data we get
from route collectors.
When we see it we have to add the culprit ASN to a filter list we keep
in bgp.he.net.
It tends to be a repeat problem with some collectors and some ASNs.
We haven't really figured out why people send junk routes to route
collectors.
The things we've seen aren't just route leaks. We've seen a variety of
AS path spoofing.
We've already added this specific ASN to the filter list and pushed an
update for bgp.he.net.
Note, this email is specifically talking about routes received from
route collectors and not routes operationally received by he.net via BGP
sessions with actual networks.
Mike.
On 7/12/22 12:49 PM, Eric Dugas via NANOG wrote:
</pre>
<blockquote style="box-sizing:border-box;border-left:0.2em solid rgb(85, 85, 238);margin:0em;padding-left:0.85em">
<pre style="box-sizing:border-box;overflow-x:auto;margin:0em">A friend of mine mentioned that both our Canadian ASNs were listed in
AS147028's peer list on <a rel="noreferrer" href="https://bgp.he.net/AS147028" data-ss1657954378="1" style="box-sizing:border-box">https://bgp.he.net/AS147028</a> but we have no
adjacency to this network.
Their peer count jumped from 1 in May 2022 to 1,800 and just a few
days ago jumped to 8,800. Beside NL-IX, all the IX they are listed on
are virtual IX with a few dozen "hobby networks".
The only lead I have is they use HE as transit and they're pumping
back BGP feed to route collectors like RIPE RIS or Route Views with
routes stripped of HE's ASN.
Eric
</pre>
</blockquote>
<pre style="box-sizing:border-box;overflow-x:auto;margin:0em"></pre>
</blockquote>
<br class="Apple-interchange-newline">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
</body>
</html>