Subject: RE: [6bone] Ghost Route Hunter

From: "Jeroen Massar" <[email-masked]>
Date: Mon, 2 Dec 2002 17:46:23 +0100

Christian Schild [mailto:[email-masked]] wrote:

> Hi Jeroen, all,
> 
> Am Sonntag, 1. Dezember 2002 17:34 schrieb Jeroen Massar:
> > Also DFN (JOIN) which appears in about 90%+ of all the ghost routes
> > should check up their equipment. Another possible important player
> 
> we are aware of this fact for quite some time now and it did not pass
> us unconcerned. Still, JOIN is one of the largest POPs in 
> 6bone, so the high value might just be a consequence of this fact. We
discussed the 
> route withdrawal problem with most of our peering partners and we are 
> quite sure that we do not orginate them. 

That's also the case for VBNS, HURRICANE, UUNET and ABILENE who pass
along many routes over their native connections. At this moment (17:20)
UUNET, GBLX, DFN, Caladan and VERAT carry all ghost routes. That's the
'problem' of being a transit :) Their equipment could be perfect but
apparently somebody downstream or upstream could peep it up.

> Anyway, as we are not certain of this, please note that we decided to 
> exchange the equipment we use (no, it's currently _not_ a software
> router :-). This will happen this week. 
> 
> So please take this message also as an announcement that 
> there will be 
> an outage of the JOIN POP (involving/including all our leaf 
> sites with prefix 3ffe:400::/24) on Wednesday, 4th December, hopefully

> only in the morning (CET). 

Perfect! I like the fact that you respond and give a notice of the
fact that your actively pursuing the problems with ofcourse the target
to solve it.

Also 2 ghost routes have vanished already:

3ffe:100::/24 now only has a short path to 3263 (TELEBIT-DK).
Which was last seen at 2002-12-02 08:40.

3ffe:8010::/28 now only has a short path to 8664 (ICM-PL).
Which was last seen at 2002-12-02 15:10.

I due hope to hear comments from the concerned parties if they have
any relevant information about the disappearance of these ghosts.

Left are of which I heared nothing (yet, I hope):
3ffe:1400::/24 
3ffe:1e00::/24 

Greets,
 Jeroen

---

From: "Jeroen Massar" <[email-masked]>
Date: Tue, 3 Dec 2002 14:06:41 +0100

Hahn, Ch [mailto:[email-masked]] wrote:
> Hi Jeron,

s/Jeron/Jeroen/ :)

> > -----Ursprungliche Nachricht-----
> > Von: Jeroen Massar [mailto:[email-masked]]

> Have this route in table.

Quote from other reply:

8<------------

------------->8

In the mean time there have been a couple of odd ones popping in and
out, from the current report (2002-12-03 13:50)
8<-----------
The following routes are currently ghosted and thus are not reachable
from many places on the internet.
- 2001:270::/35 - 1 ghosted paths 
- 3ffe:1400::/24 - 24 ghosted paths 
- 3ffe:1e00::/24 - 10 ghosted paths 
- 3ffe:400c::/32 - 1 ghosted paths 
- 3ffe:400d::/32 - 15 ghosted paths 
----------->8

> > - 3ffe:1400::/24
> > netname:      UNI-C
> > descr:        pTLA delegation for the 6bone
> > remarks:      ***************************************
> > remarks:      * * * *  no longer operational  * * * *
> > remarks:      ***************************************
> > 
> > But still visible and ghosted and not officially retracted!
> > 
> > Last changed line:
> > changed:      [email-masked] 20010420
> > 
> > This would mean that the route would have been gone for over 
> > a year and
> > a half!
> > This route is currently announced by VERAT and Deutsche 
> > Telekom though.
> 
> From my point of view it looks a little bit different. I see 
> this route in my table via two paths with a number of >25 
> ASes in path and still incomplete. Last AS before 
> incompletness in both cases is 15982 (VERAT). We have a 
> peering with VERAT but don't receiving this route from them. 
> Instead we announing the route to them.
> I've checked the FUBAR, STBEN-BE looking glass and saw the 
> route with our AS appended. Currently I have no idea how and 
> where in the path our AS# is appended, but I'm shure that we 
> are not originating this route. 
> 
> At first step I will filter this route and then lets see if 
> it will vanish or change its path.

3ffe:1400::/24 has 24 ghosted paths. We are thinking that there
is an implemention being used somewhere that has a maximum number
of ASn's per path which is now 'shortcutting' the ASpath which
leaves VERAT at the front. The VERAT router is now included in the
report and it doesn't have the route itself. Which clears them from
blame ;)

> > - 3ffe:1e00::/24
> > ipv6-site:    SWISSCOM
> > origin:       AS3303
> > descr:        Swisscom Innovations
> > 
> > No netname available apparently. But it is currently announced by:
> > source: APNIC  
> > aut-num: AS4697  
> > as-name: NTTV6NET  
> > descr: NTT Software Laboratories  
> > 
> > I have already contacted these people seperatly, no response as yet.
> > Nothing in their 6bone object seems reachable.
> 
> The routing entry looks similar to the one above. Long AS 
> path and still incomplete.

They haven't replied yet either. Going for the CC again.
Would the owners of this pTLA please speak up ?

> > - 3ffe:8010::/28
> > ipv6-site:    ICM-PL
> > origin:       AS8664
> > descr:        Interdisciplinary Centre for Mathematical and
> > Computational Modelling
> >               Warsaw University, Poland
> > 
> > Origin is currently ICM-PL and ICP-AS.
> > 6bone-gw.6bone.pl is unreachable over IPv4 and IPv6
> 
> Have this route in table, seams still ok at this point. 
> 6bone-gw.6bone.pl is reachable via IPv4.

See at the top.
Apparently those where resurrected and the ghosts
went away, fortunatly (for them ;)

GReets,
 Jeroen