Cogent and Level3 will tell you that you are not their customer ...HE and XO will react.
Jürgen Jaritsch Head of Network & Infrastructure ANEXIA Internetdienstleistungs GmbH Telefon: +43-5-0556-300 Telefax: +43-5-0556-500 E-Mail: j...@anexia.at Web: http://www.anexia.at Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601 -----Original Message----- From: Paul S. [cont...@winterei.se] Received: Dienstag, 29 Sep. 2015, 6:57 To: nanog@nanog.org [nanog@nanog.org] Subject: Re: Prefix hijacking by AS20115 +1, this is the only sensible advice here. NSPs actually do seem to care about not letting things like these happen. On 2015/09/29 01:24 PM, Hank Nussbacher wrote: > At 23:11 28/09/2015 -0400, Josh Luthman wrote: > >> Start announcing their prefixes? > > Contact the upstreams of AS20115 - Cogent, Level3, HE and XO. > > -Hank > > >> Josh Luthman >> Office: 937-552-2340 >> Direct: 937-552-2343 >> 1100 Wayne St >> Suite 1337 >> Troy, OH 45373 >> On Sep 28, 2015 11:09 PM, "Seth Mattinen" <se...@rollernet.us> wrote: >> >> > On 9/28/15 18:30, William Herrin wrote: >> > >> >> On Mon, Sep 28, 2015 at 9:01 PM, Seth Mattinen <se...@rollernet.us> >> >> wrote: >> >> >> >>> I've got a problem where AS20115 continues to announce prefixes >> after BGP >> >>> neighbors were shutdown. They claim it's a wedged BGP process but >> aren't >> >>> in >> >>> any hurry to fix it outside of a maintenance window. >> >>> >> >> >> >> If they weren't lying to you, they'd fix it now. That's not the kind >> >> of problem that waits. >> >> >> >> Thing is: they lied to you. Long ago they "helpfully" programmed >> their >> >> router to announce your route regardless of whether you sent a route >> >> to them. They want to wait for a maintenance window to remove that >> >> configuration. >> >> >> >> >> >> I'm at a loss of what else I can do. They admit the problem but >> won't take >> >>> action saying it needs to wait for a maintenance window. Am I out >> of line >> >>> insisting that's an unacceptable response to a problem that >> results in >> >>> prefix/traffic hijacking? >> >>> >> >> >> >> Try dropping the link entirely. If they still announce your >> addresses, >> >> bring it back up but report it as emergency down, escalate, and call >> >> back every 10 minutes until the junior tech understands that it's >> time >> >> to call and wake up the guy who makes the decision to fix it now. >> >> >> >> >> > >> > I'm at the tail end here almost 8 hours later since the hijacking >> started. >> > Their NOC is just blowing me off now and they're happy to continue the >> > hijacking until it's convenient for them to have a maintenance >> window. And >> > that's apparently the final decision. >> > >> > ~Seth >> > >
