2

I got this from bgpmon.

Detected new prefix:  121.66.128.0/17
Update time:          2015-11-12 07:18 (UTC)
Detected by #peers:   16
Announced by:         AS3786 (LG DACOM Corporation)
Upstream AS:          AS2914 (NTT America, Inc.)
ASpath:               18356 38794 45796 23947 38753 45300 7713 2914 3786

Detected new prefix:  121.66.0.0/17
Update time:          2015-11-12 07:18 (UTC)
Detected by #peers:   16
Announced by:         AS3786 (LG DACOM Corporation)
Upstream AS:          AS2914 (NTT America, Inc.)
ASpath:               133165 23947 38753 45300 7713 2914 3786

Why is the as-path so long here? Several ASNs in the path are just 1-2 hops away from AS3786. And that's what they did in traceroute originated from those ASNs. For example, AS23947 can reach AS3786 via AS3491.

It appears to me that this is some kind of traffic engineering effort to mitigate attacks (the prefix in question seems to have been null routed at the edge), possibly using BGP community to restrict the announcement to certain (geographical) peers. This particular prefix was never globally visible according to RIPE RIS (121.64.0.0/14 is globally visible).

And how did AS3786 make it happen? imo this is very difficult with BGP if other ASNs aren't cooperating.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 7 '17 at 14:24
2

I'm not sure why you would think this is difficult. There are a few ways this could happen. You have no insight into what the administration of another AS is doing. The AS can receive a route from multiple sources (different ASes), and it is up to the administration of that AS which of those routes, if any, to advertise to peer ASes. It can even advertise different routes to different peer ASes. Your AS can only know what other ASes tell it about any routes outside the control of your AS. The other AS could well have a better route which it uses itself when routing traffic, but it doesn't choose to tell your AS about the better route.

2
  • How common is a route 5+ ASNs away? Why would anyone buy transit that announces routes 5+ ASNs away deliberately? It looks like most ASNs in this as-path have a transit relationship, not peering (or else why would the significantly smaller ASNs annouce prefixes from AS2914's customer). My point is it only makes sense if AS3786 wants this route to be installed. – sdaffa23fdsf Nov 13 '15 at 23:45
  • This is something you need to take up with the AS administration. Anything anybody else tells you is speculation. Another AS can advertise, or not, whatever it wants to your AS. You have no say or control in another AS. You certainly wouldn't want that AS administration telling you how to run your AS. BGP and the Internet are cooperative, and you are free to not peer with any other AS if you don't like how that AS is run. An AS could have a 12 hop route from one peer, and a 2 hop route from another, and that AS chooses to advertise the 12 hop route to you, but not the 2 hop route. – Ron Maupin Nov 13 '15 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.