Re: Suspecious anycast prefixes

2011-05-10 Thread Randy Bush
> I might not explain the background clearly and confused people. We're > doing research on multiple origin AS issue, and we want to confirm if > our inference is correct based on history data we collected. For > example, we found several hundreds of prefixes with multiple origins > more than two,

Re: Suspecious anycast prefixes

2011-05-09 Thread Yaoqing(Joey) Liu
On Thu, May 5, 2011 at 1:24 PM, wrote: > On Thu, May 05, 2011 at 09:36:50AM -0500, Yaoqing(Joey) Liu wrote: >> On Thu, May 5, 2011 at 3:54 AM, Joe Abley wrote: >> > >> > On 2011-05-05, at 11:46, bmann...@vacation.karoshi.com wrote: >> > >> >> On Wed, May 04, 2011 at 10:23:12PM -0500, Yaoqing(Joe

Re: Suspecious anycast prefixes

2011-05-06 Thread Randy Bush
>>> It's perhaps worth noting that there is work in the IETF to >>> recommend that every prefix originated as part of an anycast cloud >>> uses a unique origin AS (see >>> ). I'm >>> not personally convinced of the arguments in the dra

Re: Suspecious anycast prefixes

2011-05-05 Thread bmanning
On Thu, May 05, 2011 at 11:48:31AM -0500, Yaoqing(Joey) Liu wrote: > On Thu, May 5, 2011 at 8:10 AM, John Kristoff wrote: > > On Thu, 5 May 2011 11:54:17 +0300 > > Joe Abley wrote: > > > >> Perhaps I'm misunderstanding the original question, but the assertion > >> that anybody is hijacking that p

Re: Suspecious anycast prefixes

2011-05-05 Thread bmanning
On Thu, May 05, 2011 at 12:27:04PM -0400, Danny McPherson wrote: > > On May 5, 2011, at 11:58 AM, David Miller wrote: > > > > IF things are not functioning properly and the operator of the service is > > depending on end consumers of the service to notify them of which node is > > malfunctionin

Re: Suspecious anycast prefixes

2011-05-05 Thread bmanning
On Thu, May 05, 2011 at 09:36:50AM -0500, Yaoqing(Joey) Liu wrote: > On Thu, May 5, 2011 at 3:54 AM, Joe Abley wrote: > > > > On 2011-05-05, at 11:46, bmann...@vacation.karoshi.com wrote: > > > >> On Wed, May 04, 2011 at 10:23:12PM -0500, Yaoqing(Joey) Liu wrote: > >>> 198.32.64.0/24 > >>> AS4555:

Re: Suspecious anycast prefixes

2011-05-05 Thread bmanning
On Thu, May 05, 2011 at 11:54:17AM +0300, Joe Abley wrote: > > On 2011-05-05, at 11:46, bmann...@vacation.karoshi.com wrote: > > > On Wed, May 04, 2011 at 10:23:12PM -0500, Yaoqing(Joey) Liu wrote: > >> 198.32.64.0/24 > >> AS4555:ASName: EP0-BLK-ASNBLOCK-5;OrgName:Almond Oil Process, LLC. > >> AS

Re: Suspecious anycast prefixes

2011-05-05 Thread John Kristoff
On Thu, 5 May 2011 11:48:31 -0500 "Yaoqing(Joey) Liu" wrote: > > Furthermore, that exchange prefixes may often appear to be anycast > > is not unusual.  Those prefixes are often originated by multiple > > disparate networks who are connected to the exchange. > You mean that many different exchan

Re: Suspecious anycast prefixes

2011-05-05 Thread Yaoqing(Joey) Liu
On Thu, May 5, 2011 at 8:10 AM, John Kristoff wrote: > On Thu, 5 May 2011 11:54:17 +0300 > Joe Abley wrote: > >> Perhaps I'm misunderstanding the original question, but the assertion >> that anybody is hijacking that particular prefix seems false. > > Furthermore, that exchange prefixes may often

Re: Suspecious anycast prefixes

2011-05-05 Thread Yaoqing(Joey) Liu
On Thu, May 5, 2011 at 2:35 AM, Bill Woodcock wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > > On May 4, 2011, at 8:23 PM, Yaoqing(Joey) Liu wrote: > >> Hi NANOG, >> >> I manually extracted the origins and their org info for the announced >> block of prefixes. All these prefixes we

Re: Suspecious anycast prefixes

2011-05-05 Thread Danny McPherson
On May 5, 2011, at 11:58 AM, David Miller wrote: > > IF things are not functioning properly and the operator of the service is > depending on end consumers of the service to notify them of which node is > malfunctioning, then it is time for the operator of the service to go back to > the drawi

Re: Suspecious anycast prefixes

2011-05-05 Thread David Miller
On 5/5/2011 11:39 AM, Danny McPherson wrote: On May 5, 2011, at 9:43 AM, David Miller wrote: In a properly functioning system - folks that consume the service don't need to know which node they are utilizing. Right, it doesn't matter IF things are functioning properly. If they're not, howev

Re: Suspecious anycast prefixes

2011-05-05 Thread Danny McPherson
On May 5, 2011, at 9:43 AM, David Miller wrote: > In a properly functioning system - folks that consume the service don't need > to know which node they are utilizing. Right, it doesn't matter IF things are functioning properly. If they're not, however... > Providing the capability for well

Re: Suspecious anycast prefixes

2011-05-05 Thread Yaoqing(Joey) Liu
On Thu, May 5, 2011 at 3:54 AM, Joe Abley wrote: > > On 2011-05-05, at 11:46, bmann...@vacation.karoshi.com wrote: > >> On Wed, May 04, 2011 at 10:23:12PM -0500, Yaoqing(Joey) Liu wrote: >>> 198.32.64.0/24 >>> AS4555:ASName: EP0-BLK-ASNBLOCK-5;OrgName:Almond Oil Process, LLC. >>> AS9584:as-name:GE

Re: Suspecious anycast prefixes

2011-05-05 Thread David Miller
On 5/5/2011 8:59 AM, Danny McPherson wrote: On May 3, 2011, at 6:17 AM, Bill Woodcock wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On May 2, 2011, at 12:35 PM, Joe Abley wrote: It's perhaps worth noting that there is work in the IETF to recommend that every prefix originated as part

Re: Suspecious anycast prefixes

2011-05-05 Thread John Kristoff
On Thu, 5 May 2011 11:54:17 +0300 Joe Abley wrote: > Perhaps I'm misunderstanding the original question, but the assertion > that anybody is hijacking that particular prefix seems false. Furthermore, that exchange prefixes may often appear to be anycast is not unusual. Those prefixes are often

Re: Suspecious anycast prefixes

2011-05-05 Thread Danny McPherson
On May 3, 2011, at 6:17 AM, Bill Woodcock wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > On May 2, 2011, at 12:35 PM, Joe Abley wrote: >> It's perhaps worth noting that there is work in the IETF to recommend that >> every prefix originated as part of an anycast cloud uses a uni

Re: Suspecious anycast prefixes

2011-05-05 Thread Joe Abley
On 2011-05-05, at 11:46, bmann...@vacation.karoshi.com wrote: > On Wed, May 04, 2011 at 10:23:12PM -0500, Yaoqing(Joey) Liu wrote: >> 198.32.64.0/24 >> AS4555:ASName: EP0-BLK-ASNBLOCK-5;OrgName:Almond Oil Process, LLC. >> AS9584:as-name:GENESIS-AP|descr:Diyixian.com Limited|country:HK >> AS20144:

Re: Suspecious anycast prefixes

2011-05-05 Thread bmanning
On Wed, May 04, 2011 at 10:23:12PM -0500, Yaoqing(Joey) Liu wrote: > Hi NANOG, > > 198.32.64.0/24 > AS4555:ASName: EP0-BLK-ASNBLOCK-5;OrgName:Almond Oil Process, LLC. > AS9584:as-name:GENESIS-AP|descr:Diyixian.com Limited|country:HK > AS20144:ASName: L-ROOT;Comment:distributed using Anycast. > AS4

Re: Suspecious anycast prefixes

2011-05-05 Thread Bill Woodcock
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On May 5, 2011, at 12:35 AM, Bill Woodcock wrote: >> I suspect they provide … IXP service, but not positive. > > The IXP subnets are here: > http://www.pch.net/ixpdir/ip_city_country.pl It has been pointed out to me that not _all_ IXP subnets are

Re: Suspecious anycast prefixes

2011-05-05 Thread Bill Woodcock
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On May 4, 2011, at 8:23 PM, Yaoqing(Joey) Liu wrote: > Hi NANOG, > > I manually extracted the origins and their org info for the announced > block of prefixes. All these prefixes were observed being originated > by at most four ASNs simultaneously

Re: Suspecious anycast prefixes

2011-05-04 Thread Yaoqing(Joey) Liu
Hi NANOG, I manually extracted the origins and their org info for the announced block of prefixes. All these prefixes were observed being originated by at most four ASNs simultaneously. I suspect they provide anycast or IXP service, but not positive. Please confirm my conjecture if you know them.

Re: Suspecious anycast prefixes

2011-05-04 Thread Yaoqing(Joey) Liu
On Wed, May 4, 2011 at 3:15 PM, Joe Abley wrote: > > On 2011-05-04, at 23:11, Yaoqing(Joey) Liu wrote: > > > Thanks for clarifying this, actually I have a few more blocks with four > origin ASNs that I'm not positive if they are anycast prefixes. Please help > distinguish them if the provide anyc

Re: Suspecious anycast prefixes

2011-05-04 Thread Joe Abley
On 2011-05-04, at 23:11, Yaoqing(Joey) Liu wrote: > Thanks for clarifying this, actually I have a few more blocks with four > origin ASNs that I'm not positive if they are anycast prefixes. Please help > distinguish them if the provide anycast service. You could probably get a good distance to

Re: Suspecious anycast prefixes

2011-05-04 Thread Yaoqing(Joey) Liu
Thanks for clarifying this, actually I have a few more blocks with four origin ASNs that I'm not positive if they are anycast prefixes. Please help distinguish them if the provide anycast service. 27.130.0.0/16 58.147.0.0/20 58.147.0.0/17 58.147.16.0/20 58.147.64.0/20 58.147.80.0/20 58.147.96.0/2

Re: Suspecious anycast prefixes

2011-05-03 Thread David Miller
On 5/3/2011 6:17 AM, Bill Woodcock wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On May 2, 2011, at 12:35 PM, Joe Abley wrote: It's perhaps worth noting that there is work in the IETF to recommend that every prefix originated as part of an anycast cloud uses a unique origin AS (see

Re: Suspecious anycast prefixes

2011-05-03 Thread Bill Woodcock
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On May 2, 2011, at 12:35 PM, Joe Abley wrote: > It's perhaps worth noting that there is work in the IETF to recommend that > every prefix originated as part of an anycast cloud uses a unique origin AS > (see

Re: Suspecious anycast prefixes

2011-05-02 Thread Andrew Koch
On Mon, May 2, 2011 at 23:20, wrote: >> >> 198.32.176.0/24 >> > >> > Yahoo! > This particular prefix was used as a public exchange, operated by Switch & > Data. Not sure > what they have done w/ it since then. > > Switch and Data Management Company LLC NET-PAIX-V4 (NET-198-32-175-0-1) > 198.3

Re: Suspecious anycast prefixes

2011-05-02 Thread bmanning
On Mon, May 02, 2011 at 08:40:01PM -0400, Christopher Morrow wrote: > On Mon, May 2, 2011 at 3:35 PM, Joe Abley wrote: > > > > On 2011-05-02, at 21:16, Yaoqing(Joey) Liu wrote: > > > >> I found the following prefixes are often originated by many ASNs more than > >> five, wonder if they provide glo

Re: Suspecious anycast prefixes

2011-05-02 Thread Christopher Morrow
On Mon, May 2, 2011 at 3:35 PM, Joe Abley wrote: > > On 2011-05-02, at 21:16, Yaoqing(Joey) Liu wrote: > >> I found the following prefixes are often originated by many ASNs more than >> five, wonder if they provide global anycast service, if so what specific >> service they provide? >> >> 12.64.25

Re: Suspecious anycast prefixes

2011-05-02 Thread Joe Abley
On 2011-05-02, at 21:16, Yaoqing(Joey) Liu wrote: > I found the following prefixes are often originated by many ASNs more than > five, wonder if they provide global anycast service, if so what specific > service they provide? > > 12.64.255.0/24 CERNET. > 70.37.135.0/24 Microsoft/Hotmail. > 1

RE: Suspecious anycast prefixes

2011-05-02 Thread Stefan Fouant
> -Original Message- > From: Yaoqing(Joey) Liu [mailto:joey.li...@gmail.com] > Sent: Monday, May 02, 2011 2:17 PM > To: nanog@nanog.org > Subject: Suspecious anycast prefixes > > Hi all, > > I found the following prefixes are often originated by many ASNs more > than > five, wonder if the