I have shared about this leak with known contacts in their NOC.
Thanks. On Fri, Nov 16, 2018 at 4:05 AM Tom Beecher <[email protected]> wrote: > I don't know what's less surprising, Tata making sure you see the entire > internet (wink wink), or Airtel leaking routes... :) > > On Thu, Nov 15, 2018 at 4:13 PM Lotia, Pratik M <[email protected]> > wrote: > >> 9498/Airtel seems to be leaking a lot of routes. >> >> >> >> Source: https://bgpstream.com/ >> >> >> >> All Events for BGP Stream. >> >> *Event type* >> >> *Country* >> >> *ASN* >> >> *Start time (UTC)* >> >> *End time (UTC)* >> >> *More info* >> >> BGP Leak >> >> *Origin AS:* Etisalat Lanka (Pvt) Ltd. (AS 17470) >> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498) >> >> 2018-11-15 19:41:26 >> >> More detail <https://bgpstream.com/event/159847> >> >> BGP Leak >> >> *Origin AS:* Bharti Airtel Lanka Pvt. Limited (AS 132045) >> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498) >> >> 2018-11-15 19:41:26 >> >> More detail <https://bgpstream.com/event/159848> >> >> BGP Leak >> >> *Origin AS:* Antena3 S.A. (AS 47220) >> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498) >> >> 2018-11-15 19:22:39 >> >> More detail <https://bgpstream.com/event/159845> >> >> BGP Leak >> >> *Origin AS:* INDOSATM2 ASN (AS 4795) >> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498) >> >> 2018-11-15 18:46:59 >> >> More detail <https://bgpstream.com/event/159790> >> >> BGP Leak >> >> *Origin AS:* KANARTEL (AS 33788) >> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498) >> >> 2018-11-15 18:33:09 >> >> More detail <https://bgpstream.com/event/159784> >> >> BGP Leak >> >> *Origin AS:* FranTech Solutions (AS 53667) >> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498) >> >> 2018-11-15 18:04:47 >> >> More detail <https://bgpstream.com/event/159841> >> >> BGP Leak >> >> *Origin AS:* Pure Line Co. For Telecommunications & Internet Ltd. (AS >> 59458) >> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498) >> >> 2018-11-15 18:04:05 >> >> More detail <https://bgpstream.com/event/159839> >> >> BGP Leak >> >> *Origin AS:* Sepehr Ava Data Processing Company (LTD) (AS 51541) >> *Leaker AS: *BHARTI Airtel Ltd. (AS 9498) >> >> 2018-11-15 18:01:09 >> >> More detail <https://bgpstream.com/event/159840> >> >> >> >> >> >> >> >> ~Pratik Lotia >> >> >> >> “Improvement begins with I.” >> >> >> >> >> >> *From: *NANOG <[email protected]> on behalf of Marcus Josephson < >> [email protected]> >> *Date: *Thursday, November 15, 2018 at 13:48 >> *To: *Christopher Morrow <[email protected]>, "[email protected]" >> <[email protected]> >> *Cc: *nanog list <[email protected]> >> *Subject: *RE: Tata Scenic routing in LAX area? >> >> >> >> I have tried to reach out to Airtel, no response yet, but yah I could see >> my issue being due to them leaking routes. >> >> >> >> >> >> -Marcus >> >> >> >> *From:* NANOG <[email protected]> *On Behalf Of *Christopher Morrow >> *Sent:* Thursday, November 15, 2018 3:30 PM >> *To:* [email protected] >> *Cc:* nanog list <[email protected]> >> *Subject:* Re: Tata Scenic routing in LAX area? >> >> >> >> >> >> On Thu, Nov 15, 2018 at 3:21 PM Michael Still <[email protected]> >> wrote: >> >> FYI 29791 isn't the only origin I'm seeing this on from one point of view: >> >> AS path: 3257 6453 9498 4637 >> >> AS path: 3257 6453 9498 4637 10310 26085 14210 >> >> AS path: 3257 6453 9498 4637 20773 29066 >> >> AS path: 3257 6453 9498 4637 2906 >> >> AS path: 3257 6453 9498 4637 2906 40027 >> >> AS path: 3257 6453 9498 4637 29791 >> >> AS path: 3257 6453 9498 4637 30844 >> >> AS path: 3257 6453 9498 4637 30844 36991 >> >> AS path: 3257 6453 9498 4637 30844 38056 38056 38056 >> >> AS path: 3257 6453 9498 4637 37468 37230 >> >> AS path: 3257 6453 9498 4637 37468 37230 37230 37230 >> >> AS path: 3257 6453 9498 4637 47869 >> >> AS path: 3356 6453 9498 4637 >> >> AS path: 3356 6453 9498 4637 1299 2906 >> >> AS path: 3356 6453 9498 4637 1299 3491 20485 20485 >> 4809 49209 >> >> AS path: 3356 6453 9498 4637 20773 29066 >> >> AS path: 3356 6453 9498 4637 2906 >> >> AS path: 3356 6453 9498 4637 29791 >> >> AS path: 3356 6453 9498 4637 30844 >> >> AS path: 3356 6453 9498 4637 30844 36991 >> >> AS path: 3356 6453 9498 4637 30844 38056 38056 38056 >> >> AS path: 3356 6453 9498 4637 37468 37230 >> >> AS path: 3356 6453 9498 4637 37468 37230 37230 37230 >> >> AS path: 3356 6453 9498 4637 47869 >> >> >> >> I'm not sure what is supposed to be there for 6453_9498 but I suspect not >> nearly as much as is currently present (only 4637 listed here for brevity). >> >> >> >> >> >> huh... us-carrier -> tata -> airtel -> telstra .. that seems TOTALLY >> PLAUSIBLE.. no. >> >> >> >> >> >> >> >> On Thu, Nov 15, 2018 at 2:53 PM John Weekes <[email protected]> >> wrote: >> >> Marcus, >> >> From route-views output, it looks like AS9498/airtel is probably leaking >> your route between two of its upstreams (AS6453/Tata and AS4637/Telstra) >> overseas, funneling some of your traffic through their router. >> >> route-views>sh ip bgp 23.92.178.22 | i 9498 >> 3356 6453 9498 4637 29791 >> 1403 6453 9498 4637 29791 >> 3549 3356 6453 9498 4637 29791 >> 19214 3257 6453 9498 4637 29791 >> 1403 6453 9498 4637 29791 >> 286 6453 9498 4637 29791 >> 53364 3257 6453 9498 4637 29791 >> 3257 6453 9498 4637 29791 >> 1239 6453 9498 4637 29791 >> 2497 6453 9498 4637 29791 >> 57866 6453 9498 4637 29791 >> 7660 2516 6453 9498 4637 29791 >> 701 6453 9498 4637 29791 >> 3561 209 6453 9498 4637 29791 >> >> You might try halting advertisements to your AS4637/Telstra peer while >> you contact AS9498. >> >> -John >> >> On 11/15/2018 10:43 AM, Marcus Josephson wrote: >> >> Anyone else seeing an odd Scenic routing in the LAX/SJE area for tata. >> >> >> >> traceroute to 23.92.178.22 (23.92.178.22), 30 hops max, 52 byte packets >> >> 1 if-ae-13-2.tcore2.lvw-los-angeles.as6453.net (64.86.252.34) 180.698 >> ms 180.610 ms 181.712 ms >> >> MPLS Label=344269 CoS=0 TTL=1 S=1 >> >> 2 if-ae-7-2.tcore2.svw-singapore.as6453.net (180.87.15.25) 189.327 ms >> if-ae-7-2.tcore2.svw-singapore.as6453.net (64.86.252.37) 176.800 ms >> if-ae-7-2.tcore2.svw-singapore.as6453.net (64.86.252.39) 174.631 ms >> >> MPLS Label=609315 CoS=0 TTL=1 S=1 >> >> 3 if-ae-20-2.tcore1.svq-singapore.as6453.net (180.87.96.21) 174.287 >> ms 173.370 ms 173.804 ms >> >> 4 120.29.215.202 (120.29.215.202) 179.104 ms 179.367 ms 179.324 ms >> >> 5 182.79.152.247 (182.79.152.247) 180.164 ms 182.79.152.253 >> (182.79.152.253) 184.816 ms 182.79.152.247 (182.79.152.247) 250.928 ms >> >> 6 unknown.telstraglobal.net (202.127.73.101) [AS 4637] 173.974 ms >> 173.986 ms 173.484 ms >> >> 7 i-93.sgpl-core02.telstraglobal.net (202.84.224.189) [AS 4637] >> 175.094 ms 175.699 ms 174.343 ms >> >> 8 i-10850.eqnx-core02.telstraglobal.net (202.84.140.46) [AS 4637] >> 280.686 ms 288.703 ms 280.836 ms >> >> 9 i-92.eqnx03.telstraglobal.net (202.84.247.17) [AS 4637] 278.021 ms >> 276.637 ms 302.249 ms >> >> 10 equinix-ix.sjc1.us.voxel.net (206.223.116.4) 174.139 ms 174.163 >> ms 174.067 ms >> >> >> >> >> >> Marcus Josephson >> >> IP Operations >> >> >> >> [email protected] >> >> >> >> *This message is intended for the use of the intended recipient(s) and >> may contain confidential and privileged information. * >> >> *Any unauthorized review, use, disclosure or distribution is prohibited. >> If you are not the intended recipient, please contact* *the sender by >> reply email and destroy all copies of the original message.* >> >> >> >> >> >> >> >> >> -- >> >> [[email protected] ~]$ cat .signature >> cat: .signature: No such file or directory >> [[email protected] ~]$ >> >> The contents of this e-mail message and >> any attachments are intended solely for the >> addressee(s) and may contain confidential >> and/or legally privileged information. If you >> are not the intended recipient of this message >> or if this message has been addressed to you >> in error, please immediately alert the sender >> by reply e-mail and then delete this message >> and any attachments. If you are not the >> intended recipient, you are notified that >> any use, dissemination, distribution, copying, >> or storage of this message or any attachment >> is strictly prohibited. >> > -- Anurag Bhatia anuragbhatia.com
