<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<a href="https://bgp.he.net/AS2764#_whois" id="LPlnk660511">https://bgp.he.net/AS2764#_whois</a><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Regards,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
CH</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> AusNOG <ausnog-bounces@ausnog.net> on behalf of James Bensley <jwbensley+ausnog@gmail.com><br>
<b>Sent:</b> Monday, June 6, 2022 11:12 PM<br>
<b>To:</b> ausnog@lists.ausnog.net <ausnog@lists.ausnog.net><br>
<b>Subject:</b> [AusNOG] Any AS2764 / AAPT Around? You're leaking bogon ASNs.</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Any AS2764?<br>
<br>
No contact details in peeringdb so trying here instead.<br>
<br>
See this example route in your looking glass with a bogon origin ASN:<br>
<br>
<a href="http://looking-glass.connect.com.au/lg/">http://looking-glass.connect.com.au/lg/</a><br>
<br>
Router: AAPT Sydney<br>
Command: show ip bgp regex _4294901881_<br>
<br>
BGP table version is 645867563, local router ID is 203.63.80.155<br>
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,<br>
r RIB-failure, S Stale, m multipath, b backup-path, x<br>
best-external<br>
Origin codes: i - IGP, e - EGP, ? - incomplete<br>
<br>
Network Next Hop Metric LocPrf Weight Path<br>
* i59.101.15.0/24 203.131.60.253 0 100 0 65334 4294901881 i<br>
*>i 203.131.60.253 0 100 0 65334 4294901881 i<br>
<br>
<br>
This is just one of many bogon ASNs you're leaking.<br>
<br>
I am parsing data from the RouteViews collector node in the Equinix IX<br>
in Sydney. The MRT archives of received BGP UPDATE messages are<br>
publically available here:<br>
<a href="http://archive.routeviews.org/route-views.sydney/bgpdata/2022.06/UPDATES/">http://archive.routeviews.org/route-views.sydney/bgpdata/2022.06/UPDATES/</a><br>
<br>
You see how most updates are less than 1MB but every 2 hours on the<br>
round 2 hour interval, there is a 30+MB update file? That's<br>
(partially) you AS2764! In the smaller files, there are no<br>
announcements from AS2764 with bogon ASNs downstream. In the larger<br>
update files there are loads of UPDATE messages from AS2764 with bogon<br>
downstream ASNs.<br>
<br>
Here are examples (encoded in JSON):<br>
<br>
{"as_path": ["63956", "2764", "4294901906"], "comm_set": ["2764:7",<br>
"2764:65200", "2764:65211", "2764:65290", "2764:65357", "2764:65408",<br>
"2764:65473", "63956:500", "63956:30000", "63956:32000",<br>
"63956:32030"] "next_hop": "45.127.172.2", "origin_asns":<br>
["4294901906"], peer_asn": "63956", "prefix": "59.101.10.0/24",<br>
"timestamp": "20220524.0603"}<br>
<br>
"{"as_path": ["63956", "2764", "4294901906"], "comm_set": ["2764:7",<br>
"2764:65200", "2764:65211", "2764:65290", "2764:65357", "2764:65408",<br>
"2764:65473", "63956:500", "63956:30000", "63956:32000",<br>
"63956:32030"] "next_hop": "45.127.172.2", "origin_asns":<br>
["4294901906"], "peer_asn": "63956", "prefix": "59.101.6.0/24",<br>
"timestamp": "20220524.0603"}<br>
<br>
{"as_path": ["63956", "2764", "4294901906"], "comm_set": ["2764:7",<br>
"2764:65200", "2764:65211", "2764:65290", "2764:65357", "2764:65408",<br>
"2764:65473", "63956:500", "63956:30000", "63956:32000",<br>
"63956:32030"] "next_hop": "45.127.172.2", "origin_asns":<br>
["4294901906"], "peer_asn": "63956", "prefix": "59.101.3.0/24",<br>
"timestamp": "20220524.0603"}<br>
<br>
{"as_path": ["63956", "2764", "4294901906"], "comm_set": ["2764:7",<br>
"2764:65200", "2764:65211", "2764:65290", "2764:65357", "2764:65408",<br>
"2764:65473", "63956:500", "63956:30000", "63956:32000",<br>
"63956:32030"] "next_hop": "45.127.172.2", "origin_asns":<br>
["4294901906"], "peer_asn": "63956", "prefix": "59.101.2.0/24",<br>
"timestamp": "20220524.0603"}<br>
<br>
{"as_path": ["63956", "2764", "4294901906"], "comm_set": ["2764:7",<br>
"2764:65200", "2764:65211", "2764:65290", "2764:65357", "2764:65408",<br>
"2764:65473", "63956:500", "63956:30000", "63956:32000",<br>
"63956:32030"] "next_hop": "45.127.172.2", "origin_asns":<br>
["4294901906"], "peer_asn": "63956", "prefix": "59.101.9.0/24",<br>
"timestamp": "20220524.0603"}<br>
<br>
I guess AS2764 announces prefixes with a bogon ASN to AS63956, AS2764<br>
is not striping these outbound and AS63956 is not striping them<br>
inbound. I guess that AS63956 then announces them up to the IX.<br>
<br>
This has been going on for over a month now I think. I only had time<br>
to update my code, to start reporting on this, over the weekend gone.<br>
The day report is here:<br>
<a href="https://github.com/DFZ-Name-and-Shame/dnas_stats/blob/eaaefb3426f94ecae530f6c9b2b7af2e826fa6b2/2022/06/05/20220605.txt#L16-L17">https://github.com/DFZ-Name-and-Shame/dnas_stats/blob/eaaefb3426f94ecae530f6c9b2b7af2e826fa6b2/2022/06/05/20220605.txt#L16-L17</a><br>
<br>
Please fix this AS2764.<br>
<br>
Cheer,<br>
James.<br>
_______________________________________________<br>
AusNOG mailing list<br>
AusNOG@ausnog.net<br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div>
</span></font></div>
</body>
</html>