On Thu, Nov 15, 2018 at 3:21 PM Michael Still <[email protected]> wrote:
> FYI 29791 isn't the only origin I'm seeing this on from one point of view: > AS path: 3257 6453 9498 4637 > AS path: 3257 6453 9498 4637 10310 26085 14210 > AS path: 3257 6453 9498 4637 20773 29066 > AS path: 3257 6453 9498 4637 2906 > AS path: 3257 6453 9498 4637 2906 40027 > AS path: 3257 6453 9498 4637 29791 > AS path: 3257 6453 9498 4637 30844 > AS path: 3257 6453 9498 4637 30844 36991 > AS path: 3257 6453 9498 4637 30844 38056 38056 38056 > AS path: 3257 6453 9498 4637 37468 37230 > AS path: 3257 6453 9498 4637 37468 37230 37230 37230 > AS path: 3257 6453 9498 4637 47869 > AS path: 3356 6453 9498 4637 > AS path: 3356 6453 9498 4637 1299 2906 > AS path: 3356 6453 9498 4637 1299 3491 20485 20485 > 4809 49209 > AS path: 3356 6453 9498 4637 20773 29066 > AS path: 3356 6453 9498 4637 2906 > AS path: 3356 6453 9498 4637 29791 > AS path: 3356 6453 9498 4637 30844 > AS path: 3356 6453 9498 4637 30844 36991 > AS path: 3356 6453 9498 4637 30844 38056 38056 38056 > AS path: 3356 6453 9498 4637 37468 37230 > AS path: 3356 6453 9498 4637 37468 37230 37230 37230 > AS path: 3356 6453 9498 4637 47869 > > I'm not sure what is supposed to be there for 6453_9498 but I suspect not > nearly as much as is currently present (only 4637 listed here for brevity). > > huh... us-carrier -> tata -> airtel -> telstra .. that seems TOTALLY PLAUSIBLE.. no. > > > On Thu, Nov 15, 2018 at 2:53 PM John Weekes <[email protected]> wrote: > >> Marcus, >> >> From route-views output, it looks like AS9498/airtel is probably leaking >> your route between two of its upstreams (AS6453/Tata and AS4637/Telstra) >> overseas, funneling some of your traffic through their router. >> >> route-views>sh ip bgp 23.92.178.22 | i 9498 >> 3356 6453 9498 4637 29791 >> 1403 6453 9498 4637 29791 >> 3549 3356 6453 9498 4637 29791 >> 19214 3257 6453 9498 4637 29791 >> 1403 6453 9498 4637 29791 >> 286 6453 9498 4637 29791 >> 53364 3257 6453 9498 4637 29791 >> 3257 6453 9498 4637 29791 >> 1239 6453 9498 4637 29791 >> 2497 6453 9498 4637 29791 >> 57866 6453 9498 4637 29791 >> 7660 2516 6453 9498 4637 29791 >> 701 6453 9498 4637 29791 >> 3561 209 6453 9498 4637 29791 >> >> You might try halting advertisements to your AS4637/Telstra peer while >> you contact AS9498. >> >> -John >> >> On 11/15/2018 10:43 AM, Marcus Josephson wrote: >> >> Anyone else seeing an odd Scenic routing in the LAX/SJE area for tata. >> >> >> >> traceroute to 23.92.178.22 (23.92.178.22), 30 hops max, 52 byte packets >> >> 1 if-ae-13-2.tcore2.lvw-los-angeles.as6453.net (64.86.252.34) 180.698 >> ms 180.610 ms 181.712 ms >> >> MPLS Label=344269 CoS=0 TTL=1 S=1 >> >> 2 if-ae-7-2.tcore2.svw-singapore.as6453.net (180.87.15.25) 189.327 ms >> if-ae-7-2.tcore2.svw-singapore.as6453.net (64.86.252.37) 176.800 ms >> if-ae-7-2.tcore2.svw-singapore.as6453.net (64.86.252.39) 174.631 ms >> >> MPLS Label=609315 CoS=0 TTL=1 S=1 >> >> 3 if-ae-20-2.tcore1.svq-singapore.as6453.net (180.87.96.21) 174.287 >> ms 173.370 ms 173.804 ms >> >> 4 120.29.215.202 (120.29.215.202) 179.104 ms 179.367 ms 179.324 ms >> >> 5 182.79.152.247 (182.79.152.247) 180.164 ms 182.79.152.253 >> (182.79.152.253) 184.816 ms 182.79.152.247 (182.79.152.247) 250.928 ms >> >> 6 unknown.telstraglobal.net (202.127.73.101) [AS 4637] 173.974 ms >> 173.986 ms 173.484 ms >> >> 7 i-93.sgpl-core02.telstraglobal.net (202.84.224.189) [AS 4637] >> 175.094 ms 175.699 ms 174.343 ms >> >> 8 i-10850.eqnx-core02.telstraglobal.net (202.84.140.46) [AS 4637] >> 280.686 ms 288.703 ms 280.836 ms >> >> 9 i-92.eqnx03.telstraglobal.net (202.84.247.17) [AS 4637] 278.021 ms >> 276.637 ms 302.249 ms >> >> 10 equinix-ix.sjc1.us.voxel.net (206.223.116.4) 174.139 ms 174.163 >> ms 174.067 ms >> >> >> >> >> >> Marcus Josephson >> >> IP Operations >> >> >> >> [email protected] >> >> >> >> *This message is intended for the use of the intended recipient(s) and >> may contain confidential and privileged information. * >> >> *Any unauthorized review, use, disclosure or distribution is prohibited. >> If you are not the intended recipient, please contact* *the sender by >> reply email and destroy all copies of the original message.* >> >> >> >> >> > > -- > [[email protected] ~]$ cat .signature > cat: .signature: No such file or directory > [[email protected] ~]$ >
