Re: someone is using my AS number

On Thu, Jun 13, 2019 at 5:18 PM Joe Provo wrote: > The last "major" provider who failed to provide BGP community-based > TE was 3549, and with their absorbtion into 3356 no one should have > any tolerance for this garbage, IMNSHO. as near as I can tell, you can't get per-neighbor or other TE

Re: someone is using my AS number

On Sat, 15 Jun 2019 05:38:23 -0700, Owen DeLong said: > What I heard you say is: “I’m not going to offer a solution to your > problem, > but you shouldn’t use the one you have that currently works because some > things > my friends and I are doing react poorly to it and you may suffer

Re: someone is using my AS number

On Sat, 15 Jun 2019, Job Snijders wrote: The moment they mangle the AS_PATH on their announcement and insert 2914 in their announcement towards NSP, the following can happen: When ISP A would want to poison the path, ISP A may expect the following paths to be visible from the ATT and NTT

Re: someone is using my AS number

On Sat, Jun 15, 2019 at 4:45 PM Owen DeLong wrote: > > On Jun 15, 2019, at 5:43 AM, Job Snijders wrote: > >> On Sat, Jun 15, 2019 at 2:38 PM Owen DeLong wrote: > > owen> >> What I heard you say is: “I’m not going to offer a solution to your problem, but you shouldn’t use the one you have that

Re: someone is using my AS number

> On Jun 15, 2019, at 6:03 AM, Job Snijders wrote: > > On Sat, Jun 15, 2019 at 05:32:21AM -0700, Owen DeLong wrote: >>> What is the principal harm of doing this? Honest question. I'm not >>> advocating for anything, just curious. >>> >>> Excellent question. >>> >>> 1/ We can’t really

Re: someone is using my AS number

> On Jun 15, 2019, at 5:43 AM, Job Snijders wrote: > > On Sat, Jun 15, 2019 at 2:38 PM Owen DeLong wrote: >> Job, >> >> Permit me to apply some reflective listening to your statement: >> >> What I heard you say is: “I’m not going to offer a solution to your problem, >> but you shouldn’t

Re: someone is using my AS number

On Sat, Jun 15, 2019 at 09:31:03AM -0400, Jon Lewis wrote: > On Sat, 15 Jun 2019, Job Snijders wrote: > > There is no signal from the remote ASN (the one that receive the > > route announcement) to the Originator ASN about the remote ASN's > > loop detection policies. Therefor, since you can't

Re: someone is using my AS number

> On Jun 14, 2019, at 4:22 AM, Jared Mauch wrote: > > > >> On Jun 14, 2019, at 4:02 AM, Filip Hruska wrote: >> >> HE doesn't provide any community based TE and I would say they're a pretty >> major network. > > With all respect to my friends at HE, this is a major gap for a network in

Re: someone is using my AS number

On Sat, 15 Jun 2019, Job Snijders wrote: There is no signal from the remote ASN (the one that receive the route announcement) to the Originator ASN about the remote ASN's loop detection policies. Therefor, since you can't know what the remote side will do ahead of time. The only recourse left

Re: someone is using my AS number

On Sat, 15 Jun 2019, Filip Hruska wrote: In other words, if I have an upstream that uses 6939 for transit, I'm free to permanently prepend 6939 to stop propagation to that network? Isn't using a community that says "do not export to 6939" a better and much cleaner solution? Sure,

Re: someone is using my AS number

On Sat, Jun 15, 2019 at 05:32:21AM -0700, Owen DeLong wrote: > > What is the principal harm of doing this? Honest question. I'm not > > advocating for anything, just curious. > > > > Excellent question. > > > > 1/ We can’t really expect on the loop detection to work that way at > > the “jacked”

Re: someone is using my AS number

On 15 June 2019 2:32:21 pm GMT+02:00, Owen DeLong wrote: > > >> On Jun 13, 2019, at 7:06 AM, Job Snijders wrote: >> >> Hi Joe, >> >> On Thu, Jun 13, 2019 at 9:59 Joe Abley > wrote: >> Hey Joe, >> >> On 12 Jun 2019, at 12:37, Joe Provo

Re: someone is using my AS number

On Sat, Jun 15, 2019 at 2:38 PM Owen DeLong wrote: > Job, > > Permit me to apply some reflective listening to your statement: > > What I heard you say is: “I’m not going to offer a solution to your problem, > but you shouldn’t use the one you have that currently works because some > things my

Re: someone is using my AS number

> On Jun 13, 2019, at 8:24 AM, Job Snijders wrote: > > On Thu, Jun 13, 2019 at 11:18 Warren Kumari > wrote: > On Thu, Jun 13, 2019 at 9:59 AM Joe Abley > wrote: > > > > Hey Joe, > > > > On 12 Jun 2019, at 12:37, Joe Provo >

Re: someone is using my AS number

> On Jun 13, 2019, at 7:06 AM, Job Snijders wrote: > > Hi Joe, > > On Thu, Jun 13, 2019 at 9:59 Joe Abley > wrote: > Hey Joe, > > On 12 Jun 2019, at 12:37, Joe Provo > wrote: > > > On Wed, Jun 12, 2019 at 04:10:00PM +, David

Re: someone is using my AS number

> On Jun 14, 2019, at 4:02 AM, Filip Hruska wrote: > > HE doesn't provide any community based TE and I would say they're a pretty > major network. With all respect to my friends at HE, this is a major gap for a network in 2019. I know this has lost them business over time with customers

Re: someone is using my AS number

HE doesn't provide any community based TE and I would say they're a pretty major network. Filip On 14 June 2019 2:17:43 am GMT+02:00, Joe Provo wrote: >On Thu, Jun 13, 2019 at 09:58:20AM -0400, Joe Abley wrote: >> Hey Joe, >> >> On 12 Jun 2019, at 12:37, Joe Provo >wrote: >> >> > On Wed,

Re: someone is using my AS number

On Thu, Jun 13, 2019 at 09:58:20AM -0400, Joe Abley wrote: > Hey Joe, > > On 12 Jun 2019, at 12:37, Joe Provo wrote: > > > On Wed, Jun 12, 2019 at 04:10:00PM +, David Guo via NANOG wrote: > >> Send abuse complaint to the upstreams > > > > ...and then name & shame publicly. AS-path forgery

Re: someone is using my AS number

other than the possibility of the stuffed AS being associated with behavior, no harm if nothing malicious is happening. if something malicious is happening, we probably have bigger problems. have used path poisoning for a notable research experiment; where we credit the first major poisoner,

Re: someone is using my AS number

On Thu, Jun 13, 2019 at 11:37 AM Jared Mauch wrote: > > You also may not know who allows their own ASN inbound as well. It certainly > is a mixed bag. > > I do consider poisoning at best horrible hygiene and at worst evidence of > malicious intent. Yes, I fully agree it it bletcherous -- which

Re: someone is using my AS number

I don't think the number of networks with disabled loop prevention is that small. For example, let's say you're a hosting provider who has 3 locations... no reason to do cold potato routing and you don't have dedicated links between sites, yet you still want ranges announced at DC A to be

Re: someone is using my AS number

I've used it in the distant past for TE purposes. Assuming you're poisoning one ASN via one transit it's not exactly rocket science to figure out if "it worked" or not. As Warren mentioned, sometimes your transits just don't provide all the knobs you need. I suspect the number of networks

Re: someone is using my AS number

You also may not know who allows their own ASN inbound as well. It certainly is a mixed bag. I do consider poisoning at best horrible hygiene and at worst evidence of malicious intent. Good filtering isn’t just prefix or AS path based it’s both. Best filtering is pinning the prefix to a

Re: someone is using my AS number

On Thu, Jun 13, 2019 at 11:18 Warren Kumari wrote: > On Thu, Jun 13, 2019 at 9:59 AM Joe Abley wrote: > > > > Hey Joe, > > > > On 12 Jun 2019, at 12:37, Joe Provo wrote: > > > > > On Wed, Jun 12, 2019 at 04:10:00PM +, David Guo via NANOG wrote: > > >> Send abuse complaint to the upstreams

Re: someone is using my AS number

On Thu, Jun 13, 2019 at 9:59 AM Joe Abley wrote: > > Hey Joe, > > On 12 Jun 2019, at 12:37, Joe Provo wrote: > > > On Wed, Jun 12, 2019 at 04:10:00PM +, David Guo via NANOG wrote: > >> Send abuse complaint to the upstreams > > > > ...and then name & shame publicly. AS-path forgery "for TE"

Re: someone is using my AS number

On 13 Jun 2019, at 10:06, Job Snijders wrote: > 1/ We can’t really expect on the loop detection to work that way at the > “jacked” side. So if this is innocent traffic engineering, it is unreliable > at best. > > 2/ Attribution. The moment you stuff AS 2914 anywhere in the path, we may get >

Re: someone is using my AS number

Hi Joe, On Thu, Jun 13, 2019 at 9:59 Joe Abley wrote: > Hey Joe, > > On 12 Jun 2019, at 12:37, Joe Provo wrote: > > > On Wed, Jun 12, 2019 at 04:10:00PM +, David Guo via NANOG wrote: > >> Send abuse complaint to the upstreams > > > > ...and then name & shame publicly. AS-path forgery "for

Re: someone is using my AS number

Hey Joe, On 12 Jun 2019, at 12:37, Joe Provo wrote: > On Wed, Jun 12, 2019 at 04:10:00PM +, David Guo via NANOG wrote: >> Send abuse complaint to the upstreams > > ...and then name & shame publicly. AS-path forgery "for TE" was > never a good idea. Sharing the affected prefix[es]/path[s]

Re: someone is using my AS number

AS15001 ? (IT Convergence Inc.) MSP in India: did they have any slightest idea about the issue? :-) Cheers, Carlos On Wed, 12 Jun 2019, Philip Lavine via NANOG wrote: I talked to the upstream provider on AS 1500. I called the telephone number on the abuse record on ARIN and it went to a

Re: someone is using my AS number

On Wed, 12 Jun 2019 16:10:00 -, David Guo via NANOG said: > Get Outlook for iOS Does it work better on XE or XR versions? /ducks ;) pgpCxfGZJGXxT.pgp Description: PGP signature

Re: someone is using my AS number

Proper filtering from the upstream providers. .as On Wed, Jun 12, 2019 at 9:25 PM Alejandro Acosta < alejandroacostaal...@gmail.com> wrote: > Unfortunately RPKI is not useful in this case. > > Question: What else could be done to prevent this? > > > Alejandro, > > > > On 6/12/19 12:05 PM,

Re: someone is using my AS number

>On 12 June 2019 6:05:58 pm GMT+02:00, Philip Lavine via NANOG >What is the procedure to have another party to cease and desist >in using my AS number? On 12 June 2019 7:57:52 pm GMT+02:00, Philip Lavine wrote: > Here is what I got from BGPMon- MY AS is 15053 > >Detected new prefix:

Re: someone is using my AS number

Unfortunately RPKI is not useful in this case. Question: What else could be done to prevent this? Alejandro, On 6/12/19 12:05 PM, Philip Lavine via NANOG wrote: > What is the procedure to have another party to cease and desist in > using my AS number? > > Thx pEpkey.asc Description:

Re: someone is using my AS number

Seems the issue was on AS25213 side. They don't provide transit to AS15001 at all. Regards, Filip On 12 June 2019 7:57:52 pm GMT+02:00, Philip Lavine wrote: > Here is what I got from BGPMon- MY AS is 15053 > >Detected new prefix: 134.37.2.0/23 >Update time: 2019-06-11 17:58 (UTC) >Detected

Re: someone is using my AS number

I talked to the upstream provider on AS 1500. I called the telephone number on the abuse record on ARIN and it went to a MSP in India. On Wednesday, June 12, 2019, 11:06:13 AM PDT, Töma Gavrichenkov wrote: Our records show this happened yesterday and lasted before 2019-06-11

Re: someone is using my AS number

Indeed, I do not see this in the our current version of the Default-Free Zone, so there may not be a problem for us to solve at this moment. I think your reaching out to NANOG or other operator forums is the correct action. Someone is bound to know someone who knows someone who can help. Kind

Re: someone is using my AS number

Our records show this happened yesterday and lasted before 2019-06-11 20:24:00, for 2.5 hours total. Maybe that was just by accident. I'm sort of confused why you're speaking of some ISPs in India. The incident was more or less local to Finland, wasn't it? -- Töma

Re: someone is using my AS number

Here is what I got from BGPMon- MY AS is 15053 Detected new prefix: 134.37.2.0/23 Update time: 2019-06-11 17:58 (UTC) Detected by #peers: 70 Announced by: AS15053 (ROLL-GLOBAL-LLC - Roll Global LLC, US) Upstream AS: AS15001 (ITCONVERGENCE-COM - IT Convergence Inc., US) ASpath: 394256 174 702

Re: someone is using my AS number

What is your ASN? On Wed, Jun 12, 2019 at 12:08 PM Philip Lavine via NANOG wrote: > What is the procedure to have another party to cease and desist in using > my AS number? > > Thx >

Re: someone is using my AS number

On Wed, Jun 12, 2019 at 11:46 AM Carsten Bormann wrote: > On Jun 12, 2019, at 18:10, David Guo via NANOG wrote: > > > > Send abuse complaint to the upstreams > > > > Get Outlook for iOS > > Yes, but which of these is more effective? > With some upstreams, I wonder if getting Outlook for iOS

Re: someone is using my AS number

On Jun 12, 2019, at 18:10, David Guo via NANOG wrote: > > Send abuse complaint to the upstreams > > Get Outlook for iOS Yes, but which of these is more effective? SCNR Grüße, Carsten

Re: someone is using my AS number

On Wed, Jun 12, 2019 at 04:10:00PM +, David Guo via NANOG wrote: > Send abuse complaint to the upstreams ...and then name & shame publicly. AS-path forgery "for TE" was never a good idea. Sharing the affected prefix[es]/path[s] would be good. -- Posted from my personal account - see

Re: someone is using my AS number

Can you share more details? Perhaps we can put the human social network to good use. Other than that this is annoying - are right now operationally impacted? Kind regards, Job On Wed, Jun 12, 2019 at 12:24 Filip Hruska wrote: > I would contact upstreams of the upstream then. This is quite a

Re: someone is using my AS number

details help here, and perhaps folk who peer with the upstreams can just reject routes with your as in them... if, you know, we knew what that was :) On Wed, Jun 12, 2019 at 9:21 AM Philip Lavine via NANOG wrote: > > yeah I did they are some MSP in India. No help. > > On Wednesday, June 12,

Re: someone is using my AS number

Maybe try contacting the RIR? On Wed, Jun 12, 2019, 12:23 PM Philip Lavine via NANOG wrote: > yeah I did they are some MSP in India. No help. > > On Wednesday, June 12, 2019, 9:15:51 AM PDT, Filip Hruska > wrote: > > > Contact the offending upstreams. > > Filip > > On 12 June 2019 6:05:58 pm

Re: someone is using my AS number

I would contact upstreams of the upstream then. This is quite a serious offence and they should help you. Regards, Filip On 12 June 2019 6:20:42 pm GMT+02:00, Philip Lavine wrote: > yeah I did they are some MSP in India. No help. > >On Wednesday, June 12, 2019, 9:15:51 AM PDT, Filip Hruska >

Re: someone is using my AS number

yeah I did they are some MSP in India. No help. On Wednesday, June 12, 2019, 9:15:51 AM PDT, Filip Hruska wrote: Contact the offending upstreams. Filip On 12 June 2019 6:05:58 pm GMT+02:00, Philip Lavine via NANOG wrote: What is the procedure to have another party to cease and

Re: someone is using my AS number

Contact the offending upstreams. Filip On 12 June 2019 6:05:58 pm GMT+02:00, Philip Lavine via NANOG wrote: >What is the procedure to have another party to cease and desist in >using my AS number? >Thx -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

Re: someone is using my AS number

Send abuse complaint to the upstreams Get Outlook for iOS<https://aka.ms/o0ukef> From: NANOG on behalf of Philip Lavine via NANOG Sent: Thursday, June 13, 2019 12:05:58 AM To: NANOG List Subject: someone is using my AS number What is the procedure t

someone is using my AS number

What is the procedure to have another party to cease and desist in using my AS number? Thx