<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><base href="x-msg://109/"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Arial Narrow";
panose-1:2 11 6 6 2 2 2 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I’ll be honest here and share an experience.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>(All beit an embarrassing one, but I’m willing to admit it, I’m sure there are many others on the list who have done it who may not admit it).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>In my early days learning live BGP, (There is no testing with Internet BGP, it’s always live, all the time).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>There’s no putting your feet into the water to learn it, it’s head first sink or swim.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>When I turned on our second multi homed connection, and started taking full global routing tables, I had no AS path filtering in place, and no Prefix filtering in place. I didn’t even know what they were, really, back then.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I was advertising OPTUS’s entire global routing table to AAPT, and AAPT’s entire global routing table to OPTUS.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I was advertising every piece of private address space known to man (10.0.0.0/8, 192.168, 172, etc etc) into BOTH of them.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Did I know what was going on in the early days of BGP? Yes, I saw the advertisments, but, thankfully, AAPT and OPTUS had seen clients like me before (at that stage, without a clue). Did I know what effect it would have? Heck no.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Did everything work? Yes, perfectly and absolutely, because there were controls in place to prevent any issues.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thankfully, these days, I know better.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>ROUTE-MAP’s and AS-PATH filters and prefix lists and policy based routing, community based routing, come later, after you figure out how BGP works in the first place.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Fast forward to now.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>We now perform at least one or two new BGP based interconnections per week, and unless *<b>we</b>* have our policies absolutely perfect, weird weird routing can and does occur.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I expect my downstreams to have no idea what AS path filtering or prefix filtering is about. I expect them to advertise 0.0.0.0/0 to me. (and some do </span><span style='font-size:11.0pt;font-family:Wingdings;color:#1F497D'>J</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> )<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Even then, even with appropriate route-filters and AS path filters in place, strangeness can occur.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I’ve even seen a client’s network, that we were YET to physically connect to, but had setup AS path and Prefix list filtering internally and with our upstreams, bring traffic in through Optus, through our network, and out through AAPT to reach its final destination. This occurred because we’re a client of both Optus and AAPT and the route through us was seen as the shortest path. (Amazing, I know).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>This happened because we were learning their routes from AAPT, it was passing through our filtering, and then being re-advertised through to OPTUS.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>There’s no standard single way of setting up this filtering, either, every network is different.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>In some networks, filters are done manually by the network ops technicians.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Other networks, its policy based, determining where to advertise routes to based on where the routes were learnt from.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>In others, like the IX’s, there’s automated systems that generate policy and route-maps and prefix-lists based on what you punch into them, and push the configs out to the routers that matter at various intervals.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>It’s so damn easy to make a mistake with any of these systems when bringing on a new peer (Transit peer, upstream peer, peer peer, or client peer).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Maybe a good topic for this year’s AusNOG, on different ways to do AS-Path-Filtering and Prefix-List Filtering.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Does anybody else care to share their experiences?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Burt Mascareigne [mailto:burt@prioritycomputer.com.au] <br><b>Sent:</b> Friday, February 24, 2012 10:42 AM<br><b>To:</b> James Spenceley; Sean K. Finn<br><b>Cc:</b> 'ausnog@ausnog.net'<br><b>Subject:</b> RE: [AusNOG] International link issue<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>/Agree<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Now let’s get the jurnos to understand that and to pass that onto the public,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Ready, Set, Go!<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>James Spenceley<br><b>Sent:</b> Friday, 24 February 2012 11:39 AM<br><b>To:</b> Sean K. Finn<br><b>Cc:</b> 'ausnog@ausnog.net'<br><b>Subject:</b> Re: [AusNOG] International link issue<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU>Well said Sean.<o:p></o:p></span></p><div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p></div><div><p class=MsoNormal><span lang=EN-AU>If anyone thinks this is Dodo's fault, think again. Customers make configuration errors like this regularly. <o:p></o:p></span></p></div><div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p></div><div><p class=MsoNormal><span lang=EN-AU>I understand Telstra's position in some cases, to prefix filter us is something like 2500 entires with lots of updates, that can be hard to maintain, *at a prefix level*<o:p></o:p></span></p></div><div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p></div><div><p class=MsoNormal><span lang=EN-AU>Telstra not having a generic AS-PATH or even max-prefix put the fault entirely with Telstra. <o:p></o:p></span></p></div><div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p></div><div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><div><div><p class=MsoNormal><span lang=EN-AU>On 24/02/2012, at 11:29 AM, Sean K. Finn wrote:<o:p></o:p></span></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-AU><o:p> </o:p></span></p><div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Telstra should have had an Inbound route filter in any case.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>(Both an AS Path filter, and a prefix-list filter).</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>The amount of people I’ve seen TRYING to advertise 0.0.0.0/0 over an IX, or even leaking private address space into carrier links, is common place. Thankfully most carriers don’t trust their clients advertisments by default.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>PIPE IX have a fairly complex (but not complicated) portal to use to ensure that your AS PATH LIST and PREFIX LISTS are added to their server manually before adding them to their route filters.Even better, every day there’s a mailout with the filters that you can put on your OWN routers to match their routers, just-in-case.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I’ve seen some providers be extremely strict on even the manual ranges that get added to portals, checking each and every IP assignment to ensure that I’m allowed to advertise the ranges, and AS’s, in question. (And in some cases making me jump through silly hurdles to PROVE it).</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>The very definition of UPSTREAM means it’s their responsibility to not trust the DOWNSTREAM.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Fair enough, Dodo had to leak the routes, and Telstra had to accept them, there was a mutual mis-configuration, that part is self evident.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>It’s easy enough to make the mistake.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>S</span><o:p></o:p></p></div><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;border-width:initial;border-color:initial'><div><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span class=apple-converted-space><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> </span></span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a><span class=apple-converted-space> </span>[mailto:ausnog-bounces@lists.ausnog.net]<span class=apple-converted-space> </span><b>On Behalf Of<span class=apple-converted-space> </span></b>Aaron Swayn<br><b>Sent:</b><span class=apple-converted-space> </span>Friday, February 24, 2012 10:20 AM<br><b>To:</b><span class=apple-converted-space> </span><a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a><br><b>Subject:</b><span class=apple-converted-space> </span>Re: [AusNOG] International link issue</span><o:p></o:p></p></div></div></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I think the spin was from Dodo to blame the vendor, but me thinks the fault went down something like this…</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div style='margin-left:.5in'><p class=MsoNormal style='text-indent:-.25in'><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>-</span><span lang=EN-AU style='font-size:7.0pt;color:#1F497D'> <span class=apple-converted-space> </span></span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Dodo engineer troubleshooting BGP advertisement issue</span><o:p></o:p></p></div><div style='margin-left:.5in'><p class=MsoNormal style='text-indent:-.25in'><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>-</span><span lang=EN-AU style='font-size:7.0pt;color:#1F497D'> <span class=apple-converted-space> </span></span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Can’t figure it out (can’t see why, these things do work properly and you can debug them easily enough without having to take risks)</span><o:p></o:p></p></div><div style='margin-left:.5in'><p class=MsoNormal style='text-indent:-.25in'><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>-</span><span lang=EN-AU style='font-size:7.0pt;color:#1F497D'> <span class=apple-converted-space> </span></span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Removed outbound route filter from BGP session to Telstra to see if that fixes the problem</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>And we know the rest…</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;border-width:initial;border-color:initial'><div><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span class=apple-converted-space><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> </span></span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a><span class=apple-converted-space> </span>[mailto:ausnog-bounces@lists.ausnog.net]<span class=apple-converted-space> </span><b>On Behalf Of<span class=apple-converted-space> </span></b>Evan Weston<br><b>Sent:</b><span class=apple-converted-space> </span>Friday, 24 February 2012 10:55 AM<br><b>To:</b><span class=apple-converted-space> </span><a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a><br><b>Subject:</b><span class=apple-converted-space> </span>Re: [AusNOG] International link issue</span><o:p></o:p></p></div></div></div><div><p class=MsoNormal><span lang=EN-AU> </span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Nice spin from Telstra. Blame the hardware vendor, blame the customer but never admit that it was actually *<b>our fault</b>* for not filtering properly.</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span class=apple-converted-space><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> </span></span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a><span class=apple-converted-space> </span><a href="mailto:[mailto:ausnog-bounces@lists.ausnog.net]">[mailto:ausnog-bounces@lists.ausnog.net]</a><span class=apple-converted-space> </span><b>On Behalf Of<span class=apple-converted-space> </span></b>Will Tardy<br><b>Sent:</b><span class=apple-converted-space> </span>Friday, 24 February 2012 10:30 AM<br><b>To:</b><span class=apple-converted-space> </span><a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a><br><b>Subject:</b><span class=apple-converted-space> </span>Re: [AusNOG] International link issue</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU> </span><o:p></o:p></p></div><div><div><p class=MsoNormal><span lang=EN-AU>Telstra claims they had an international link down:</span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU> </span><o:p></o:p></p></div></div><div><p class=MsoNormal><span lang=EN-AU><a href="http://www.zdnet.com.au/telstra-hit-by-nationwide-data-outage-339332310.htm">http://www.zdnet.com.au/telstra-hit-by-nationwide-data-outage-339332310.htm</a></span><o:p></o:p></p></div><div><div><p class=MsoNormal><span lang=EN-AU> </span><o:p></o:p></p></div></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-AU>If that happened at the same time as DODO incorrectly sending Telstra the full BGP table, could that explain why Telstra black-holed all-routes plus pumped all of it's own traffic via dodo?</span><o:p></o:p></p><div><div><p class=MsoNormal><span lang=EN-AU>On 24 February 2012 10:02, Wade Millican <<a href="mailto:Wade.Millican@echoent.com.au">Wade.Millican@echoent.com.au</a>> wrote:</span><o:p></o:p></p></div><div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>Hi All,</span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>What I'm yet to understand about this outage is why DODO's AS_PATH was seen as shorter than anything Telstra already had.</span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>An earlier posted look at routes(below), thanks Gavin, shows all routes from Telstra taking hops to DODO, then Optus or PIPE before moving to the destination. Surely Telstra would have had better routes than pushing all traffic 2 hops out of it's way.</span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>AS_PATH does not explain how Telstra accepted these as the active routes. Even if all routes were accepted, Telstra still has better routes.</span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>Can anyone explain what BGP Metric was modified/used that pushed traffic over longer AS_PATHs? </span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p></div></div><div><pre style='text-align:-webkit-auto;white-space:pre-wrap;word-spacing:0px'><span lang=EN-AU> </span><o:p></o:p></pre><pre><span lang=EN-AU>*> <a href="http://1.22.161.0/24" target="_blank">1.22.161.0/24</a> 165.228.157.73 100 80 0 1221 38285 7474 7473 55410 45528 i</span><o:p></o:p></pre><pre><span lang=EN-AU>*> <a href="http://1.22.162.0/24" target="_blank">1.22.162.0/24</a> 165.228.157.73 100 80 0 1221 38285 7474 7473 55410 45528 i</span><o:p></o:p></pre><pre><span lang=EN-AU>*> <a href="http://1.22.163.0/24" target="_blank">1.22.163.0/24</a> 165.228.157.73 100 80 0 1221 38285 7474 7473 55410 45528 i</span><o:p></o:p></pre><pre><span lang=EN-AU>*> <a href="http://1.22.167.0/24" target="_blank">1.22.167.0/24</a> 165.228.157.73 100 80 0 1221 38285 7474 7473 6453 4755 45528 i</span><o:p></o:p></pre><pre><span lang=EN-AU>*> <a href="http://1.22.168.0/24" target="_blank">1.22.168.0/24</a> 165.228.157.73 100 80 0 1221 38285 7474 7473 6453 4755 45528 i</span><o:p></o:p></pre><pre><span lang=EN-AU>..</span><o:p></o:p></pre><pre><span lang=EN-AU>* <a href="http://14.201.64.0/24" target="_blank">14.201.64.0/24</a> 165.228.157.73 100 80 0 1221 38285 18398 7545 7545 i</span><o:p></o:p></pre></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>Thanks,</span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>Wade</span><o:p></o:p></p></div></div><div><div><div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>-- </span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:9.0pt;font-family:"Georgia","serif";color:#959595'>Wade Millican <br>Technical Consultant Team Lead<br></span><span lang=EN-AU style='font-size:9.0pt;font-family:"Georgia","serif";color:#989898'>Hemisphere Infrastructure Support<br></span><span lang=EN-AU style='font-size:9.0pt;font-family:"Georgia","serif";color:#959595'>Information Technology<br><b>Echo Entertainment Group Limited</b> <br><br>2 Edward St<br>Pyrmont NSW 2009 <br><br>T:<span class=apple-converted-space> </span><a href="tel:%2B61%202%209657%207460" target="_blank">+61 2 9657 7460</a><br>M:<span class=apple-converted-space> </span><a href="tel:%2B61%20%280%29%20400%20192%20485" target="_blank">+61 (0) 400 192 485</a><br></span><u><span lang=EN-AU style='font-size:9.0pt;color:blue'><a href="mailto:wade.millican@echoent.com.au">wade.millican@echoent.com.au</a><br></span></u><span lang=EN-AU style='font-size:9.0pt;color:#959595'><a href="http://www.echoentertainment.com.au" target="_blank">www.echoentertainment.com.au</a><br></span><span lang=EN-AU style='font-size:10.0pt;font-family:"Arial Narrow","sans-serif";color:#7F7F7F'><image001.png></span><o:p></o:p></p></div></div></div></div></div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;border-width:initial;border-color:initial'><div><p class=MsoNormal><b><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:<span class=apple-converted-space> </span></span></b><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>"Ramsay, Paul" <<a href="mailto:pramsay@uecomm.com.au" target="_blank">pramsay@uecomm.com.au</a>><br><b>Date:<span class=apple-converted-space> </span></b>Wed, 22 Feb 2012 22:20:41 -0800<br><b>To:<span class=apple-converted-space> </span></b>"<a href="mailto:ausnog@ausnog.net" target="_blank">ausnog@ausnog.net</a>" <<a href="mailto:ausnog@ausnog.net" target="_blank">ausnog@ausnog.net</a>><br><b>Subject:<span class=apple-converted-space> </span></b>Re: [AusNOG] International link issue</span><o:p></o:p></p></div></div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p></div></div><div><div><div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Yes, this reinforces the Rule of Trust. Don’t trust your BGP peers and ensure your filters are in place, configured correctly and working, you can’t transfer blame.</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>It can cost you big $$ and pain if you inadvertently turn yourself into a transit peer because your upstreams may prefer to send traffic where they can make $$ from.</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;border-width:initial;border-color:initial'><div><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span class=apple-converted-space><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> </span></span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><a href="mailto:ausnog-bounces@lists.ausnog.net" target="_blank">ausnog-bounces@lists.ausnog.net</a><span class=apple-converted-space> </span>[<a href="mailto:ausnog-bounces@lists.ausnog.net" target="_blank">mailto:ausnog-bounces@lists.ausnog.net</a>]<span class=apple-converted-space> </span><b>On Behalf Of<span class=apple-converted-space> </span></b>Sean K. Finn<br><b>Sent:</b><span class=apple-converted-space> </span>Thursday, 23 February 2012 5:09 PM<br><b>To:</b><span class=apple-converted-space> </span><a href="mailto:'ausnog@ausnog.net" target="_blank">'ausnog@ausnog.net</a>'<br><b>Subject:</b><span class=apple-converted-space> </span>Re: [AusNOG] International link issue</span><o:p></o:p></p></div></div></div><div><p class=MsoNormal><span lang=EN-AU> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>It’s easy to describe for all the media types watching..</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>(And I’m not sure why its not being put out there in Laymans terms).</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>From the routes seen at various points, and reported on the WAIX mailing list earlier..</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Dodo told Telstra that Dodo was the rest of the Internet.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Telstra Believed Dodo.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Telstra entire system tried to use DODO as their ISP instead of everyone else Telstra is connected to.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Needless to say this didn’t work, the pipes got Jammed.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Telstra should have filtered the announcement from Dodo, butdidn’t.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Filtering is in place as a form of control (which is used instead of trust).</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Filtering obviously wasn’t in place, or didn’t work, so anything that Dodo told Telstra about where to find the Internet, Telstra believed.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>This happens quite often, I’ve heard of this happening on peering exchanges within Australia, too. Just never at an organizational level as big as Telstra.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Over and Out.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p></div></div><div style='border:none;border-top:solid windowtext 1.0pt;padding:1.0pt 0in 0in 0in;border-width:initial;border-color:initial'><div><p class=MsoNormal><span style='font-size:9.0pt'> </span><o:p></o:p></p></div></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>This message and its attachments may contain legally privileged or confidential information. It is for the intended addressee(s) only.</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:9.0pt;font-family:"Arial","sans-serif"'>If you are not the intended recipient you must not disclose or use the information contained in it. If you have received this email in error please notify us immediately by return email and delete the document.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Any views expressed in this message are those of the individual sender, except where the sender specifies and with authority, states them to be the views of the Company.</span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Uecomm accepts no liability for any damage caused by this email or its attachments due to viruses, interference, interception, corruption or unauthorised access.</span><o:p></o:p></p></div><div class=MsoNormal align=center style='text-align:center'><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'><hr size=2 width="100%" align=center></span></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'>This e-mail message has been scanned for Viruses and Content and cleared by<span class=apple-converted-space> </span><strong><span style='font-family:"Calibri","sans-serif";color:#FF8000'>NetIQ MailMarshal</span></strong></span><o:p></o:p></p></div><div class=MsoNormal align=center style='text-align:center'><span lang=EN-AU style='font-size:10.5pt;font-family:"Calibri","sans-serif"'><hr size=2 width="100%" align=center></span></div></div></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-AU><br>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a></span><o:p></o:p></p></div><div><p class=MsoNormal><span lang=EN-AU> </span><o:p></o:p></p></div></div><div><p class=MsoNormal><span lang=EN-AU> </span><o:p></o:p></p></div><div class=MsoNormal align=center style='text-align:center'><span lang=EN-AU><hr size=2 width="100%" align=center></span></div><div><p class=MsoNormal><span lang=EN-AU style='font-size:7.5pt;font-family:"Arial","sans-serif";color:black'>Stockland Notice: If this communication has been sent to you by mistake, please delete and notify us. If it has been sent to you by mistake, legal privilege is not waived or lost and you are not entitled to use it in any way. Stockland and its subsidiaries reserve the right to monitor e-mail communication through its networks.</span><o:p></o:p></p></div><p class=MsoNormal><span style='font-size:13.5pt;font-family:"Helvetica","sans-serif"'>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p></div></div></body></html>