Calling TeliaSonera - time to implement prefix filtering

[s***@nethelp.no]

We're currently receiving the following prefix from TeliaSonera on one
of our IP transit links in Oslo:

62.0.0.0/8 *[BGP/170] 4d 22:23:07, localpref 100
AS path: 1299 29049 I
AS 29049 is:

aut-num: AS29049
as-name: Delta-Telecom-AS
descr: Delta Telecom LTD.
descr: International Communication Operator
descr: Azerbaijan Republic

and *of course* they don't own 62.0.0.0/8.

TeliaSonera: It's about time you started implementing prefix filtering
on your customer links. Our other transit providers do this.

Steinar Haug, Nethelp consulting, ***@nethelp.no

[m***@bt.com]

Post by s***@nethelp.no
We're currently receiving the following prefix from
aut-num: AS29049
as-name: Delta-Telecom-AS
descr: Delta Telecom LTD.
descr: International Communication Operator
descr: Azerbaijan Republic
and *of course* they don't own 62.0.0.0/8.

Own!?
How can you tell who actually owns any network these days. According to
Lars Nyberg, President and CEO of TeliaSonera, TeliaSonera is committed
to Azerbaijan and will continue delivering world class service. This
statement was made at a press conference in Baku, the capital of
Azerbaijan, in January.

It took about 30 seconds of googling to learn that this Swedish/Finnish
merged company is in a joint venture with a Turkish company and that
joint venture is in another joint venture with the Azerbaijani
government. TeliaSonera owns a majority of the stake in the first joint
venture (Fintur Holdings BV) which owns a majority stake in the second
joint venture (Azercell Telecom).

I still have no idea who owns what AS or IP address range, but it seems
to be reasonable for TeliaSonera, an Azerbaijani telecom company, to be
announcing an IP address range assigned to another Azerbaijani telecom
company. Have you asked TeliaSonera why they are announcing the prefix?

Yes, it is possible that someone in Azerbaijan made a mistake in
configuring their router, but rather than complain on NANOG, it would be
better to work back through the chain of BGP peers and help educate the
people who made the mistake.

--Michael Dillon

[James Blessing]

Post by s***@nethelp.no
We're currently receiving the following prefix from
aut-num: AS29049
as-name: Delta-Telecom-AS
descr: Delta Telecom LTD.
descr: International Communication Operator
descr: Azerbaijan Republic
and *of course* they don't own 62.0.0.0/8.

Own!?

I think he was saying that Delta Telecom don't *own* 62.0.0.0/8 and
therefore shouldn't be advertising it. Following that Telia shouldn't be
accepting the route and then re-announcing it to peers ...

J

[s***@nethelp.no]

Post by James Blessing
I think he was saying that Delta Telecom don't *own* 62.0.0.0/8 and
therefore shouldn't be advertising it. Following that Telia shouldn't be
accepting the route and then re-announcing it to peers ...

Exactly.

Steinar Haug, Nethelp consulting, ***@nethelp.no

[m***@bt.com]

Post by James Blessing

Post by s***@nethelp.no
aut-num: AS29049
and *of course* they don't own 62.0.0.0/8.

Own!?

I think he was saying that Delta Telecom don't *own*
62.0.0.0/8 and therefore shouldn't be advertising it.
Following that Telia shouldn't be accepting the route and
then re-announcing it to peers ...

Of course! ... /8? ... Azerbaijan? ... What was I thinking?...

Still, it would be better to contact the upstream directly
and work back through the peering chain because this kind
of thing is usually a result of education deficit, not malice.

--Michael Dillon

[Martin Hannigan]

Yes, it is operational.

Best,

Marty

But isn't this what nanog is for? It appears to be more on-topic than the
email threads. More E than S.
Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS
Senior Network Engineer
Coleman Technologies, Inc.
954-298-1697

-----Original Message-----
Sent: Tuesday, April 15, 2008 9:51 AM
Subject: RE: Calling TeliaSonera - time to implement prefix filtering

Post by James Blessing

Post by s***@nethelp.no
aut-num: AS29049
and *of course* they don't own 62.0.0.0/8.

Own!?

I think he was saying that Delta Telecom don't *own*
62.0.0.0/8 and therefore shouldn't be advertising it.
Following that Telia shouldn't be accepting the route and
then re-announcing it to peers ...

Of course! ... /8? ... Azerbaijan? ... What was I thinking?...
Still, it would be better to contact the upstream directly
and work back through the peering chain because this kind
of thing is usually a result of education deficit, not malice.
--Michael Dillon

[Geoff Huston]

Post by Martin Hannigan
Yes, it is operational.

But isn't this what nanog is for? It appears to be more on-topic than the
email threads. More E than S.

As well as 62.0.0.0/8 there is 88.0.0.0/8 (originated by AS13064, with upstreams of AS13237 (LambdaNet) and AS 8447 (Telekom Austria)

Unlike 62.0.0.0/8, which is being announced as a stable announcement (and has AS 1299 (Telianet) as its upstream, 88.0.0.0/8 is being announced for periods of 30 seconds to 1 minute.

Last time we saw this short announce behaviour it was a spammer using the "vacant" addresses in the /8 block to generate spam in short bursts. I have no data on what is going on with 88.0.0.0/8

Here's what I see in terms of recent BGP activity for 88.0.0.0/8: http://88.0.0.0.8.potaroo.net and for 62.0.0.0/8: http://62.0.0.0.8.potaroo.net

[s***@nethelp.no]

Post by m***@bt.com

Post by James Blessing
I think he was saying that Delta Telecom don't *own*
62.0.0.0/8 and therefore shouldn't be advertising it.
Following that Telia shouldn't be accepting the route and
then re-announcing it to peers ...

Of course! ... /8? ... Azerbaijan? ... What was I thinking?...
Still, it would be better to contact the upstream directly
and work back through the peering chain because this kind
of thing is usually a result of education deficit, not malice.

Probably in theory. In practice, it's not obvious. I *did* get a
private response from a Telia person after my posting to Nanog,
and this person alerted their routing registry. The 62.0.0.0/8
prefix is now gone - whether as as result of my posting to Nanog
or not, I have no means of knowing.

Steinar Haug, Nethelp consulting, ***@nethelp.no