<div dir="ltr">Lucas, <div><br></div><div>This issue is with their transit provider, Level3/Century Link. There are another Level3 / Century Link customers that are having this issue </div><div>of stuck routes even after withdrawn or BGP session disabled with them.</div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Dec 19, 2019 at 2:01 PM Lucas Willian Bocchi <<a href="mailto:lucas.bocchi@gmail.com">lucas.bocchi@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:monospace,monospace">Arturo</div><div class="gmail_default" style="font-family:monospace,monospace">We have session with these AS. It's our transit but when I cease the session on my side, the announces continue to exists. Even when the BGP router is powered off the announces continues for 30, 40 minutes or more. It's impossible! The only way is hijacking the prefix but now appears to be OK. We are testing with our another transits to check if the problem now will solved.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Em qui., 19 de dez. de 2019 às 13:53, Arturo Servin <<a href="mailto:arturo.servin@gmail.com" target="_blank">arturo.servin@gmail.com</a>> escreveu:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">According to RADB AS267759 is the correct origin.<div><br><div>route: <a href="http://45.167.18.0/23" target="_blank">45.167.18.0/23</a><br>origin: AS267759<br>descr: GRUPO INVERSOR EN COMUNICACIONES - Cliente de Trânsito da R-Line<br>mnt-by: MAINT-AS28145<br>changed: <a href="mailto:fabio@rline.com.br" target="_blank">fabio@rline.com.br</a> 20191213 #18:08:35Z<br>source: RADB<br></div></div><div><br></div><div>No ROA apparently.</div><div><br></div><div>So, not sure what the problem is.</div><div><br></div><div>.as</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Dec 19, 2019 at 4:49 PM Lucas Willian Bocchi <<a href="mailto:lucas.bocchi@gmail.com" target="_blank">lucas.bocchi@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:monospace,monospace">At the moment, appears.</div><div class="gmail_default" style="font-family:monospace,monospace">We will test again in other time, maybe a time that the NOC doesn't are reading the list threads.</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Em qui., 19 de dez. de 2019 às 13:47, Ariel Antigua via LACNOG <<a href="mailto:lacnog@lacnic.net" target="_blank">lacnog@lacnic.net</a>> escreveu:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div><p class="MsoNormal">Maybe is fixed already?</p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">I was looking for your prefix and is not in my routing table or being announced by 263774.</p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">bird> </p><p class="MsoNormal">bird> show route where bgp_path.last = 263774 primary</p><p class="MsoNormal"><a href="http://138.117.78.0/24" target="_blank">138.117.78.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.78.0/23" target="_blank">138.117.78.0/23</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.79.0/24" target="_blank">138.117.79.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.76.0/23" target="_blank">138.117.76.0/23</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.76.0/24" target="_blank">138.117.76.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.76.0/22" target="_blank">138.117.76.0/22</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.77.0/24" target="_blank">138.117.77.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.126.0/23" target="_blank">170.83.126.0/23</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.126.0/24" target="_blank">170.83.126.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774?]</p><p class="MsoNormal"><a href="http://170.83.127.0/24" target="_blank">170.83.127.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.124.0/23" target="_blank">170.83.124.0/23</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.124.0/22" target="_blank">170.83.124.0/22</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.124.0/24" target="_blank">170.83.124.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774?]</p><p class="MsoNormal"><a href="http://170.83.125.0/24" target="_blank">170.83.125.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal">bird> show route where bgp_path.last = 267759 primary</p><p class="MsoNormal">bird></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">.aa</p><p class="MsoNormal"><u></u> <u></u></p><div style="border-color:rgb(225,225,225) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in"><p class="MsoNormal" style="border:medium none;padding:0in"><b>From: </b><a href="mailto:lucas.bocchi@gmail.com" target="_blank">Lucas Willian Bocchi</a><br><b>Sent: </b>Thursday, December 19, 2019 12:27 PM<br><b>To: </b><a href="mailto:lacnog@lacnic.net" target="_blank">lacnog@lacnic.net</a><br><b>Subject: </b>[lacnog] Prefix Hijacking</p></div><p class="MsoNormal"><u></u> <u></u></p><div><div><p class="MsoNormal"><span style="font-family:"Courier New"">Hello.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New""><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New"">We have entered in contact with AS263774 informing the problem but we won't provide any solution to the trouble.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New""><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New"">Our BGP session with the AS263774 are totally down and the announces don't cease to exists. We believe that these provider hijack our announces <u></u><u></u></span></p></div><div><pre>Thu Dec 19 16:08:16.916 UTC</pre><pre>BGP routing table entry for <a href="http://45.167.18.0/24" target="_blank">45.167.18.0/24</a></pre><pre>Versions:</pre><pre> Process bRIB/RIB SendTblVer</pre><pre> Speaker 497636789 497636789</pre><pre>Last Modified: Dec 19 15:36:44.535 for 00:31:32</pre><pre>Paths: (1 available, best #1)</pre><pre> Advertised IPv4 Unicast paths to peers (in unique update groups):</pre><pre> 38.5.0.99 </pre><pre> Path #1: Received by speaker 0</pre><pre> Advertised IPv4 Unicast paths to peers (in unique update groups):</pre><pre> 38.5.0.99 </pre><pre> 3356 3549 263774 263774 267759</pre><pre> 4.68.111.177 (metric 103030) from 38.28.1.83 (38.28.1.238)</pre><pre> Origin IGP, metric 4294967294, localpref 100, valid, internal, best, group-best, import-candidate</pre><pre> Received Path ID 0, Local Path ID 1, version 497636789</pre><pre> Community: 174:11401 174:20666 174:21100 174:22005</pre><pre> Originator: 38.28.1.238, Cluster list: 38.28.1.83, 38.28.1.67</pre></div><div><p class="MsoNormal"><span style="font-family:"Courier New"">How are the correct solution to the case? The NOC are already alerted about the problem but says that "all is ok on your side".<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New""><u></u> <u></u></span></p></div></div><p class="MsoNormal"><span style="font-family:"Courier New"">Regards.<u></u><u></u></span></p><p class="MsoNormal"><u></u> <u></u></p></div></div>_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net" target="_blank">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a><br>
</blockquote></div>
_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net" target="_blank">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a><br>
</blockquote></div>
_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net" target="_blank">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a><br>
</blockquote></div>
_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net" target="_blank">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a><br>
</blockquote></div>