RE: Net-24 top prefix generating bogus RFC-1918 queries
guys.. I have a thought... I am a charter fiber customer.. AND they use lots of 1918 address for management even some customer links. I have seen this on all the cable providers.. unlike Sprint/MCI/ATT they don't use 100% RW on all their equipment.. then they leak because the BGP is not filtering properly.. -----Original Message----- From: John Brown [mailto:jmbrown@chagresventures.com] Sent: Sunday, June 01, 2003 1:55 AM To: Roland Verlander Cc: nanog@merit.edu Subject: Re: Net-24 top prefix generating bogus RFC-1918 queries
Why does 65/8 generate almost as many queries as 24/8?
because there are lots of cable and DSL users in those prefix's My cable at home is net-65
lol either they deliberately announce rfc1918 via network 10.0.0.0 or redisting igp into bgp... priceless. -hc On Sun, Jun 01, 2003 at 09:20:30PM -0400, McBurnett, Jim wrote:
guys.. I have a thought... I am a charter fiber customer.. AND they use lots of 1918 address for management even some customer links. I have seen this on all the cable providers.. unlike Sprint/MCI/ATT they don't use 100% RW on all their equipment..
then they leak because the BGP is not filtering properly..
-----Original Message----- From: John Brown [mailto:jmbrown@chagresventures.com] Sent: Sunday, June 01, 2003 1:55 AM To: Roland Verlander Cc: nanog@merit.edu Subject: Re: Net-24 top prefix generating bogus RFC-1918 queries
Why does 65/8 generate almost as many queries as 24/8?
because there are lots of cable and DSL users in those prefix's
My cable at home is net-65
-- Sincerely, Haesu C. TowardEX Technologies, Inc WWW: http://www.towardex.com E-mail: haesu@towardex.com Cell: (978) 394-2867
On Sun, 1 Jun 2003, McBurnett, Jim wrote:
guys.. I have a thought... I am a charter fiber customer.. AND they use lots of 1918 address for management even some customer links. I have seen this on all the cable providers.. unlike Sprint/MCI/ATT they don't use 100% RW on all their equipment..
then they leak because the BGP is not filtering properly..
Uhm, incorrect. A DNS lookup for a RFC1918 in-addr.arpa record is unrelated to BGP or BGP filters. If you want to generate an RFC1918 in-addr.arpa query to the AS112 servers do the following
nslookup Default Server: localhost Address: 127.0.0.1
set querytype=any 10.in-addr.arpa Server: localhost Address: 127.0.0.1
Non-authoritative answer: 10.in-addr.arpa origin = prisoner.iana.org mail addr = hostmaster.root-servers.org serial = 2002040800 refresh = 1800 (30M) retry = 900 (15M) expire = 604800 (1W) minimum ttl = 604800 (1W) Authoritative answers can be found from: 10.in-addr.arpa nameserver = BLACKHOLE-1.iana.org 10.in-addr.arpa nameserver = BLACKHOLE-2.iana.org BLACKHOLE-1.iana.org internet address = 192.175.48.6 BLACKHOLE-2.iana.org internet address = 192.175.48.42
Your query will then be included in John's statistics. You BGP filters will not stop it.
participants (3)
-
Haesu -
McBurnett, Jim -
Sean Donelan