RE: Strange entries from AS1 in global table

2013-08-08 Thread James Sink 
That's correct, I have seen L3 use that for MPLS as recently as a few months 
ago. 
-James

-Original Message-
From: Brad Fleming [mailto:bdfle...@gmail.com] 
Sent: Thursday, August 08, 2013 7:49 AM
To: Humberto Galiza
Cc: NANOG Mailing List
Subject: Re: Strange entries from AS1 in global table

I think Level(3) uses it for at least some L3 MPLS VPN stuff. We peer with that 
AS for dedicated SIP service transport for example.


On Aug 8, 2013, at 5:25 AM, Humberto Galiza  wrote:

> Looking at our routers I can see this:
> 3549 3356 26114 1 i
> 12956 1239 23520 23383 1 ?
> 
> but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s 
> probably leaked routes or even use of AS 1 as private one (I don´t 
> think level3 guys are using this AS anymore...).
> 
> Cheers,
> Humberto Galiza
> 
> 
> 2013/8/4 Anurag Bhatia :
>> Hello everyone
>> 
>> 
>> I was looking at global IPv4 table and saw some strange entries from AS1.
>> As per ARIN whois AS1 seems to be with Level3 but I noticed few 
>> prefixes of Brazil based ISP - Netvip
>> 
>> 
>> http://bgp.he.net/AS1#_prefixes
>> 
>> 
>> 
>> Looking at any prefix in detail, it seems like there are multiple 
>> ASNs announcing same prefix.
>> 
>> E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931 
>> (Netvip's allocated ASN). Same is true with 177.185.98.0/24, 
>> 177.185.98.0/24and so on.
>> http://bgp.he.net/net/177.185.96.0/24
>> 
>> So seems like AS1 acting like a mirror for all announcements of 
>> AS52931. To see who exactly gave "transit" to AS1 by Netvip in 
>> Brazil, I checked Oregon and noticed these routes:
>> 
>> 3356 3549 16735 52931 1 i
>> 
>> 
>> 
>> Seems like AS52931 itself is acting as transit for AS1 (and AS16735 
>> which seems like a backbone ISP in Brazil) is not filtering these 
>> routes further passing to Level3 (AS3549+AS3356).
>> 
>> 
>> 
>> I am curious to know what could be possible reason for an ASN like 
>> AS1 acting in exact mirror of AS52931? Could it be a case of internal 
>> use of
>> AS1 (assuming it to be private ASN)? May be it's a case of leaked 
>> internal routes?
>> 
>> 
>> 
>> Appreciate your time & answer.
>> 
>> 
>> 
>> Thanks.
>> 
>> --
>> 
>> Anurag Bhatia
>> anuragbhatia.com
>> 
>> Linkedin <http://in.linkedin.com/in/anuragbhatia21> | 
>> Twitter<https://twitter.com/anurag_bhatia>
>> Skype: anuragbhatia.com
>

Re: Strange entries from AS1 in global table

2013-08-08 Thread Brad Fleming 
I think Level(3) uses it for at least some L3 MPLS VPN stuff. We peer with that 
AS for dedicated SIP service transport for example.


On Aug 8, 2013, at 5:25 AM, Humberto Galiza  wrote:

> Looking at our routers I can see this:
> 3549 3356 26114 1 i
> 12956 1239 23520 23383 1 ?
> 
> but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s
> probably leaked routes or even use of AS 1 as private one (I don´t
> think level3 guys are using this AS anymore...).
> 
> Cheers,
> Humberto Galiza
> 
> 
> 2013/8/4 Anurag Bhatia :
>> Hello everyone
>> 
>> 
>> I was looking at global IPv4 table and saw some strange entries from AS1.
>> As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of
>> Brazil based ISP - Netvip
>> 
>> 
>> http://bgp.he.net/AS1#_prefixes
>> 
>> 
>> 
>> Looking at any prefix in detail, it seems like there are multiple ASNs
>> announcing same prefix.
>> 
>> E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931
>> (Netvip's allocated ASN). Same is true with 177.185.98.0/24,
>> 177.185.98.0/24and so on.
>> http://bgp.he.net/net/177.185.96.0/24
>> 
>> So seems like AS1 acting like a mirror for all announcements of AS52931. To
>> see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon
>> and noticed these routes:
>> 
>> 3356 3549 16735 52931 1 i
>> 
>> 
>> 
>> Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which
>> seems like a backbone ISP in Brazil) is not filtering these routes further
>> passing to Level3 (AS3549+AS3356).
>> 
>> 
>> 
>> I am curious to know what could be possible reason for an ASN like AS1
>> acting in exact mirror of AS52931? Could it be a case of internal use of
>> AS1 (assuming it to be private ASN)? May be it's a case of leaked internal
>> routes?
>> 
>> 
>> 
>> Appreciate your time & answer.
>> 
>> 
>> 
>> Thanks.
>> 
>> --
>> 
>> Anurag Bhatia
>> anuragbhatia.com
>> 
>> Linkedin  |
>> Twitter
>> Skype: anuragbhatia.com
>

RE: Strange entries from AS1 in global table

2013-08-08 Thread Vinny_Abello 
Level 3 currently uses AS 1 in their MPLS network. I'm unsure if it's used 
elsewhere, but AS 1 could get into the AS paths of prefixes in the global 
routing table this way. I wouldn't expect to see it originating routes outside 
of the WAN interface for customers though and those are typically way too small 
to make it into the global routing table.

-Vinny

-Original Message-
From: Humberto Galiza [mailto:humbertogal...@gmail.com] 
Sent: Thursday, August 08, 2013 6:25 AM
To: Anurag Bhatia
Cc: NANOG Mailing List
Subject: Re: Strange entries from AS1 in global table

Looking at our routers I can see this:
3549 3356 26114 1 i
12956 1239 23520 23383 1 ?

but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s
probably leaked routes or even use of AS 1 as private one (I don´t
think level3 guys are using this AS anymore...).

Cheers,
Humberto Galiza


2013/8/4 Anurag Bhatia :
> Hello everyone
>
>
> I was looking at global IPv4 table and saw some strange entries from AS1.
> As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of
> Brazil based ISP - Netvip
>
>
> http://bgp.he.net/AS1#_prefixes
>
>
>
> Looking at any prefix in detail, it seems like there are multiple ASNs
> announcing same prefix.
>
> E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931
> (Netvip's allocated ASN). Same is true with 177.185.98.0/24,
> 177.185.98.0/24and so on.
> http://bgp.he.net/net/177.185.96.0/24
>
> So seems like AS1 acting like a mirror for all announcements of AS52931. To
> see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon
> and noticed these routes:
>
> 3356 3549 16735 52931 1 i
>
>
>
> Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which
> seems like a backbone ISP in Brazil) is not filtering these routes further
> passing to Level3 (AS3549+AS3356).
>
>
>
> I am curious to know what could be possible reason for an ASN like AS1
> acting in exact mirror of AS52931? Could it be a case of internal use of
> AS1 (assuming it to be private ASN)? May be it's a case of leaked internal
> routes?
>
>
>
> Appreciate your time & answer.
>
>
>
> Thanks.
>
> --
>
> Anurag Bhatia
> anuragbhatia.com
>
> Linkedin <http://in.linkedin.com/in/anuragbhatia21> |
> Twitter<https://twitter.com/anurag_bhatia>
> Skype: anuragbhatia.com

Re: Strange entries from AS1 in global table

2013-08-08 Thread Humberto Galiza 
Looking at our routers I can see this:
3549 3356 26114 1 i
12956 1239 23520 23383 1 ?

but neither 26114 or 23383 are Brazilian ISP´s. Anyway, I guess it´s
probably leaked routes or even use of AS 1 as private one (I don´t
think level3 guys are using this AS anymore...).

Cheers,
Humberto Galiza


2013/8/4 Anurag Bhatia :
> Hello everyone
>
>
> I was looking at global IPv4 table and saw some strange entries from AS1.
> As per ARIN whois AS1 seems to be with Level3 but I noticed few prefixes of
> Brazil based ISP - Netvip
>
>
> http://bgp.he.net/AS1#_prefixes
>
>
>
> Looking at any prefix in detail, it seems like there are multiple ASNs
> announcing same prefix.
>
> E.g 177.185.96.0/24 - is being announced by AS1 as well as AS52931
> (Netvip's allocated ASN). Same is true with 177.185.98.0/24,
> 177.185.98.0/24and so on.
> http://bgp.he.net/net/177.185.96.0/24
>
> So seems like AS1 acting like a mirror for all announcements of AS52931. To
> see who exactly gave "transit" to AS1 by Netvip in Brazil, I checked Oregon
> and noticed these routes:
>
> 3356 3549 16735 52931 1 i
>
>
>
> Seems like AS52931 itself is acting as transit for AS1 (and AS16735 which
> seems like a backbone ISP in Brazil) is not filtering these routes further
> passing to Level3 (AS3549+AS3356).
>
>
>
> I am curious to know what could be possible reason for an ASN like AS1
> acting in exact mirror of AS52931? Could it be a case of internal use of
> AS1 (assuming it to be private ASN)? May be it's a case of leaked internal
> routes?
>
>
>
> Appreciate your time & answer.
>
>
>
> Thanks.
>
> --
>
> Anurag Bhatia
> anuragbhatia.com
>
> Linkedin  |
> Twitter
> Skype: anuragbhatia.com