<div dir="ltr">According to RADB AS267759 is the correct origin.<div><br><div>route: <a href="http://45.167.18.0/23">45.167.18.0/23</a><br>origin: AS267759<br>descr: GRUPO INVERSOR EN COMUNICACIONES - Cliente de Trânsito da R-Line<br>mnt-by: MAINT-AS28145<br>changed: <a href="mailto:fabio@rline.com.br">fabio@rline.com.br</a> 20191213 #18:08:35Z<br>source: RADB<br></div></div><div><br></div><div>No ROA apparently.</div><div><br></div><div>So, not sure what the problem is.</div><div><br></div><div>.as</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Dec 19, 2019 at 4:49 PM Lucas Willian Bocchi <<a href="mailto:lucas.bocchi@gmail.com">lucas.bocchi@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:monospace,monospace">At the moment, appears.</div><div class="gmail_default" style="font-family:monospace,monospace">We will test again in other time, maybe a time that the NOC doesn't are reading the list threads.</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Em qui., 19 de dez. de 2019 às 13:47, Ariel Antigua via LACNOG <<a href="mailto:lacnog@lacnic.net" target="_blank">lacnog@lacnic.net</a>> escreveu:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div><p class="MsoNormal">Maybe is fixed already?</p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">I was looking for your prefix and is not in my routing table or being announced by 263774.</p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">bird> </p><p class="MsoNormal">bird> show route where bgp_path.last = 263774 primary</p><p class="MsoNormal"><a href="http://138.117.78.0/24" target="_blank">138.117.78.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.78.0/23" target="_blank">138.117.78.0/23</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.79.0/24" target="_blank">138.117.79.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.76.0/23" target="_blank">138.117.76.0/23</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.76.0/24" target="_blank">138.117.76.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.76.0/22" target="_blank">138.117.76.0/22</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://138.117.77.0/24" target="_blank">138.117.77.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.126.0/23" target="_blank">170.83.126.0/23</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.126.0/24" target="_blank">170.83.126.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774?]</p><p class="MsoNormal"><a href="http://170.83.127.0/24" target="_blank">170.83.127.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.124.0/23" target="_blank">170.83.124.0/23</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.124.0/22" target="_blank">170.83.124.0/22</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal"><a href="http://170.83.124.0/24" target="_blank">170.83.124.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774?]</p><p class="MsoNormal"><a href="http://170.83.125.0/24" target="_blank">170.83.125.0/24</a> via 185.1.119.40 on ens19 [t_loc_AS206499 2019-12-17 from 185.1.119.2] * (110) [AS263774i]</p><p class="MsoNormal">bird> show route where bgp_path.last = 267759 primary</p><p class="MsoNormal">bird></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">.aa</p><p class="MsoNormal"><u></u> <u></u></p><div style="border-color:rgb(225,225,225) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in"><p class="MsoNormal" style="border:medium none;padding:0in"><b>From: </b><a href="mailto:lucas.bocchi@gmail.com" target="_blank">Lucas Willian Bocchi</a><br><b>Sent: </b>Thursday, December 19, 2019 12:27 PM<br><b>To: </b><a href="mailto:lacnog@lacnic.net" target="_blank">lacnog@lacnic.net</a><br><b>Subject: </b>[lacnog] Prefix Hijacking</p></div><p class="MsoNormal"><u></u> <u></u></p><div><div><p class="MsoNormal"><span style="font-family:"Courier New"">Hello.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New""><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New"">We have entered in contact with AS263774 informing the problem but we won't provide any solution to the trouble.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New""><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New"">Our BGP session with the AS263774 are totally down and the announces don't cease to exists. We believe that these provider hijack our announces <u></u><u></u></span></p></div><div><pre>Thu Dec 19 16:08:16.916 UTC</pre><pre>BGP routing table entry for <a href="http://45.167.18.0/24" target="_blank">45.167.18.0/24</a></pre><pre>Versions:</pre><pre> Process bRIB/RIB SendTblVer</pre><pre> Speaker 497636789 497636789</pre><pre>Last Modified: Dec 19 15:36:44.535 for 00:31:32</pre><pre>Paths: (1 available, best #1)</pre><pre> Advertised IPv4 Unicast paths to peers (in unique update groups):</pre><pre> 38.5.0.99 </pre><pre> Path #1: Received by speaker 0</pre><pre> Advertised IPv4 Unicast paths to peers (in unique update groups):</pre><pre> 38.5.0.99 </pre><pre> 3356 3549 263774 263774 267759</pre><pre> 4.68.111.177 (metric 103030) from 38.28.1.83 (38.28.1.238)</pre><pre> Origin IGP, metric 4294967294, localpref 100, valid, internal, best, group-best, import-candidate</pre><pre> Received Path ID 0, Local Path ID 1, version 497636789</pre><pre> Community: 174:11401 174:20666 174:21100 174:22005</pre><pre> Originator: 38.28.1.238, Cluster list: 38.28.1.83, 38.28.1.67</pre></div><div><p class="MsoNormal"><span style="font-family:"Courier New"">How are the correct solution to the case? The NOC are already alerted about the problem but says that "all is ok on your side".<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-family:"Courier New""><u></u> <u></u></span></p></div></div><p class="MsoNormal"><span style="font-family:"Courier New"">Regards.<u></u><u></u></span></p><p class="MsoNormal"><u></u> <u></u></p></div></div>_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net" target="_blank">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a><br>
</blockquote></div>
_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net" target="_blank">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a><br>
</blockquote></div>