Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-15 Thread Ronald F. Guilmette
In message Siyuan Miao wrote: >It's a quite simple issue and it's absolutely irrelevant to any historical >or political reasons. Who said anything about politics? I merely offered the observation, in my own rather backhanded way, that Lithuania is not exactly geographically close to either

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-15 Thread Gert Doering
Hi, On Mon, Apr 15, 2019 at 04:15:39PM +0800, Siyuan Miao wrote: > It's a quite simple issue and it's absolutely irrelevant to any historical > or political reasons. > > Someone from AS56630 forgot to enable remove-private-as for eBGP peers. And someone from their upstreams forgot to install

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-15 Thread Siyuan Miao
Hi Ronald, It's a quite simple issue and it's absolutely irrelevant to any historical or political reasons. Someone from AS56630 forgot to enable remove-private-as for eBGP peers. Regards, Siyuan Miao On Mon, Apr 15, 2019 at 4:06 PM Ronald F. Guilmette wrote: > > In message , >

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-15 Thread Ronald F. Guilmette
In message , =?ISO-8859-15?Q?Carlos_Fria=E7as?= wrote: >> P.S. I'm not entirely sure that I understand why a Lithuanian ASN (AS56630) >> would be called upon to provide routing for an alleged telecom company locat >ed >> in Tbilisi, Georgia (i.e. GE-RAILWAYTELECOM-20120605). > >It's only

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-15 Thread Carlos Friaças via anti-abuse-wg
Hi Ronald, All, On Sun, 14 Apr 2019, Ronald F. Guilmette wrote: (...) It would appear that the mysterious AS65000 has been sort of shadowing the movements of AS56630 for some time now... over six months, I guess, at least since 2018-08-17, according to the RIPE data on that last route shown

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-15 Thread Carlos Friaças via anti-abuse-wg
On Sun, 14 Apr 2019, Ronald F. Guilmette wrote: (...) I will save all further comment until someone offers me some kind of an explanation of this apparently strange stuff. For now, I will only add that whereas bgp.he.net is showing there as being a total of 66 IPv4 prefixes announced by this

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-15 Thread Ronald F. Guilmette
In message , Suresh Ramasubramanian wrote: >Given that it is RFG raising this, I think it is a pretty safe bet that this >ASN is associated with some abusive activity that he has seen. Well, let's just say that some things that are relavant to AS65000 do appear to be to be a bit, um,

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Suresh Ramasubramanian
Let us put it this way. There might be several simultaneous leaks of this same private asn because multiple country netblocks are being announced. Or this is actually malicious. I have no way to tell without checking what abuse is coming from there. I'm sure RFG is researching that part of

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Suresh Ramasubramanian
On 15/04/19, 9:26 AM, "anti-abuse-wg on behalf of ac" wrote: >Sorry for top posting, but I fail to see how any of this is abuse related? Given that it is RFG raising this, I think it is a pretty safe bet that this ASN is associated with some abusive activity that he has seen.

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread ac
Sorry for top posting, but I fail to see how any of this is abuse related? On Mon, 15 Apr 2019 04:39:10 +0100 "Sascha Luck [ml]" wrote: > On Sun, Apr 14, 2019 at 06:30:50PM -0700, Ronald F. Guilmette wrote: > >Even if I accept that one of these explanation is accurate and > >correct, I am

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Sascha Luck [ml]
On Sun, Apr 14, 2019 at 06:30:50PM -0700, Ronald F. Guilmette wrote: Even if I accept that one of these explanation is accurate and correct, I am still left with one question: Who is "they" in this context? If it's a leaked internal private ASN, the next ASN upstream in the path should be the

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Ronald F. Guilmette
In message , Richard Clayton wrote: >Hurricane Electric is seeing announcements from other ASs some of which >have AS65000 declared to be origin of the prefix I understand. The announcements are, in effect, mislabled. >Best practice is to remove internal use AS's from announcements -- not

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Ronald F. Guilmette
In message <5c95b9d5-58b4-4a86-8052-e928f1d8a...@incibe.es>, =?utf-8?B?w4FuZ2VsIEdvbnrDoWxleiBCZXJkYXNjbw==?= wrote: >Well, someone is announcing those prefixes as linked to AS65000... Yes. Who?

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Ronald F. Guilmette
In message <20190415010759.ga51...@cilantro.c4inet.net>, "Sascha Luck [ml]" wrote: >Most likely this is either used in error as an advertising ASN by >someone who doesn't know what they are doing (like the RFC1918 >space that crops up in the DFZ now and again) or it's used >internally in

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Richard Clayton
In message <44806.1555289...@segfault.tristatelogic.com>, Ronald F. Guilmette writes >Here is what I am hoping some actual expert can explain to me: > >https://bgp.he.net/AS65000#_asinfo >https://bgp.he.net/AS65000#_prefixes >https://bgp.he.net/AS65000#_prefixes6

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Ángel González Berdasco
Well, someone is announcing those prefixes as linked to AS65000. If he itself was using AS65000 internally with those prefixes, and that leaked to their public interface, it would be a false positive, but lacking some agreement between the receiver and their peer involving AS65000, imho those

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Ronald F. Guilmette
Apologies for following up on myself, but I did just ant to mention that in addition to the very limited "snapshots" of thw routes being announced by AS65000 that can be obtained from bgp.he.net, I am also looking at this page: https://stat.ripe.net/AS65000#tabId=routing which shows that in

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Sascha Luck [ml]
On Sun, Apr 14, 2019 at 05:43:55PM -0700, Ronald F. Guilmette wrote: https://bgp.he.net/AS65000#_asinfo https://bgp.he.net/AS65000#_prefixes https://bgp.he.net/AS65000#_prefixes6 https://bgp.he.net/AS65000#_peers https://bgp.he.net/AS65000#_peers6 The only other thing I feel compelled to say,

[anti-abuse-wg] Mysteries of the Internet: AS65000

2019-04-14 Thread Ronald F. Guilmette
As I believe I have made abundantly clear, I am in favor of the proposal 2019-03, and more generally, I am supportive of the notion that order is preferable to chaos, particularly when it comes to routing on the Internet. The reasons for this preference of mine are so manifest that they do not