Strange entries from AS1 in global table
Hello everyone I was looking at global IPv4 table and saw some strange entries from AS1. As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of Brazil based ISP - Netvip http://bgp.he.net/AS1#_prefixes Looking at any prefix in detail, it seems like there are multiple ASNs announcing same prefix. E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931 (Netvip's allocated ASN). Same is true with 177.185.98.0/24, 177.185.98.0/24and so on. http://bgp.he.net/net/177.185.96.0/24 So seems like AS1 acting like a mirror for all announcements of AS52931. To see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon and noticed these routes: 3356 3549 16735 52931 1 i Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which seems like a backbone ISP in Brazil) is not filtering these routes further passing to Level3 (AS3549+AS3356). I am curious to know what could be possible reason for an ASN like AS1 acting in exact mirror of AS52931? Could it be a case of internal use of AS1 (assuming it to be private ASN)? May be it's a case of leaked internal routes? Appreciate your time & answer. Thanks. -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com
Looking at our routers I can see this: 3549 3356 26114 1 i 12956 1239 23520 23383 1 ? but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s probably leaked routes or even use of AS 1 as private one (I don´t think level3 guys are using this AS anymore...). Cheers, Humberto Galiza 2013/8/4 Anurag Bhatia <me@anuragbhatia.com>:
Hello everyone
I was looking at global IPv4 table and saw some strange entries from AS1. As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of Brazil based ISP - Netvip
http://bgp.he.net/AS1#_prefixes
Looking at any prefix in detail, it seems like there are multiple ASNs announcing same prefix.
E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931 (Netvip's allocated ASN). Same is true with 177.185.98.0/24, 177.185.98.0/24and so on. http://bgp.he.net/net/177.185.96.0/24
So seems like AS1 acting like a mirror for all announcements of AS52931. To see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon and noticed these routes:
3356 3549 16735 52931 1 i
Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which seems like a backbone ISP in Brazil) is not filtering these routes further passing to Level3 (AS3549+AS3356).
I am curious to know what could be possible reason for an ASN like AS1 acting in exact mirror of AS52931? Could it be a case of internal use of AS1 (assuming it to be private ASN)? May be it's a case of leaked internal routes?
Appreciate your time & answer.
Thanks.
--
Anurag Bhatia anuragbhatia.com
Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com
Level 3 currently uses AS 1 in their MPLS network. I'm unsure if it's used elsewhere, but AS 1 could get into the AS paths of prefixes in the global routing table this way. I wouldn't expect to see it originating routes outside of the WAN interface for customers though and those are typically way too small to make it into the global routing table. -Vinny -----Original Message----- From: Humberto Galiza [mailto:humbertogaliza@gmail.com] Sent: Thursday, August 08, 2013 6:25 AM To: Anurag Bhatia Cc: NANOG Mailing List Subject: Re: Strange entries from AS1 in global table Looking at our routers I can see this: 3549 3356 26114 1 i 12956 1239 23520 23383 1 ? but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s probably leaked routes or even use of AS 1 as private one (I don´t think level3 guys are using this AS anymore...). Cheers, Humberto Galiza 2013/8/4 Anurag Bhatia <me@anuragbhatia.com>:
Hello everyone
I was looking at global IPv4 table and saw some strange entries from AS1. As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of Brazil based ISP - Netvip
http://bgp.he.net/AS1#_prefixes
Looking at any prefix in detail, it seems like there are multiple ASNs announcing same prefix.
E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931 (Netvip's allocated ASN). Same is true with 177.185.98.0/24, 177.185.98.0/24and so on. http://bgp.he.net/net/177.185.96.0/24
So seems like AS1 acting like a mirror for all announcements of AS52931. To see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon and noticed these routes:
3356 3549 16735 52931 1 i
Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which seems like a backbone ISP in Brazil) is not filtering these routes further passing to Level3 (AS3549+AS3356).
I am curious to know what could be possible reason for an ASN like AS1 acting in exact mirror of AS52931? Could it be a case of internal use of AS1 (assuming it to be private ASN)? May be it's a case of leaked internal routes?
Appreciate your time & answer.
Thanks.
--
Anurag Bhatia anuragbhatia.com
Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com
I think Level(3) uses it for at least some L3 MPLS VPN stuff. We peer with that AS for dedicated SIP service transport for example. On Aug 8, 2013, at 5:25 AM, Humberto Galiza <humbertogaliza@gmail.com> wrote:
Looking at our routers I can see this: 3549 3356 26114 1 i 12956 1239 23520 23383 1 ?
but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s probably leaked routes or even use of AS 1 as private one (I don´t think level3 guys are using this AS anymore...).
Cheers, Humberto Galiza
2013/8/4 Anurag Bhatia <me@anuragbhatia.com>:
Hello everyone
I was looking at global IPv4 table and saw some strange entries from AS1. As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of Brazil based ISP - Netvip
http://bgp.he.net/AS1#_prefixes
Looking at any prefix in detail, it seems like there are multiple ASNs announcing same prefix.
E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931 (Netvip's allocated ASN). Same is true with 177.185.98.0/24, 177.185.98.0/24and so on. http://bgp.he.net/net/177.185.96.0/24
So seems like AS1 acting like a mirror for all announcements of AS52931. To see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon and noticed these routes:
3356 3549 16735 52931 1 i
Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which seems like a backbone ISP in Brazil) is not filtering these routes further passing to Level3 (AS3549+AS3356).
I am curious to know what could be possible reason for an ASN like AS1 acting in exact mirror of AS52931? Could it be a case of internal use of AS1 (assuming it to be private ASN)? May be it's a case of leaked internal routes?
Appreciate your time & answer.
Thanks.
--
Anurag Bhatia anuragbhatia.com
Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com
That's correct, I have seen L3 use that for MPLS as recently as a few months ago. -James -----Original Message----- From: Brad Fleming [mailto:bdflemin@gmail.com] Sent: Thursday, August 08, 2013 7:49 AM To: Humberto Galiza Cc: NANOG Mailing List Subject: Re: Strange entries from AS1 in global table I think Level(3) uses it for at least some L3 MPLS VPN stuff. We peer with that AS for dedicated SIP service transport for example. On Aug 8, 2013, at 5:25 AM, Humberto Galiza <humbertogaliza@gmail.com> wrote:
Looking at our routers I can see this: 3549 3356 26114 1 i 12956 1239 23520 23383 1 ?
but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s probably leaked routes or even use of AS 1 as private one (I don´t think level3 guys are using this AS anymore...).
Cheers, Humberto Galiza
2013/8/4 Anurag Bhatia <me@anuragbhatia.com>:
Hello everyone
I was looking at global IPv4 table and saw some strange entries from AS1. As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of Brazil based ISP - Netvip
http://bgp.he.net/AS1#_prefixes
Looking at any prefix in detail, it seems like there are multiple ASNs announcing same prefix.
E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931 (Netvip's allocated ASN). Same is true with 177.185.98.0/24, 177.185.98.0/24and so on. http://bgp.he.net/net/177.185.96.0/24
So seems like AS1 acting like a mirror for all announcements of AS52931. To see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon and noticed these routes:
3356 3549 16735 52931 1 i
Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which seems like a backbone ISP in Brazil) is not filtering these routes further passing to Level3 (AS3549+AS3356).
I am curious to know what could be possible reason for an ASN like AS1 acting in exact mirror of AS52931? Could it be a case of internal use of AS1 (assuming it to be private ASN)? May be it's a case of leaked internal routes?
Appreciate your time & answer.
Thanks.
--
Anurag Bhatia anuragbhatia.com
Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com
participants (5)
-
Anurag Bhatia -
Brad Fleming -
Humberto Galiza -
James Sink -
Vinny_Abello＠Dell.com