QRator has been alerting me that AS 3128 is coming and going. It just happened again and wondering if anyone else is seeing this behavior and also how things look on MICE's route reflectors. I already contacted the good folks at the University of Wisconsin and they're not seeing anything on their side. AS Number: AS3128 AS Name: # First seen Last seen 1 2019-12-29 21:49:00 2019-12-29 21:50:00 2 2019-12-29 18:42:00 2019-12-29 18:43:00 3 2019-12-29 17:57:00 2019-12-29 17:58:00 4 2019-12-29 16:27:00 2019-12-29 16:28:00 5 2019-12-29 14:12:00 2019-12-29 14:13:00 6 2019-12-29 13:27:00 2019-12-29 13:28:00 7 2019-12-29 12:42:00 2019-12-29 12:43:00 8 2019-12-29 11:57:00 2019-12-29 11:58:00 9 2019-12-29 11:12:00 2019-12-29 11:13:00 10 2019-12-29 11:04:00 2019-12-29 11:05:00 11 2019-12-29 10:27:00 2019-12-29 10:28:00 12 2019-12-29 08:57:00 2019-12-29 08:58:00 13 2019-12-29 08:12:00 2019-12-29 08:13:00 14 2019-12-29 07:53:00 2019-12-29 07:54:00 15 2019-12-29 07:27:00 2019-12-29 07:28:00 16 2019-12-29 06:42:00 2019-12-29 06:43:00 17 2019-12-29 05:57:00 2019-12-29 05:58:00 18 2019-12-29 05:12:00 2019-12-29 05:13:00 19 2019-12-29 04:40:00 2019-12-29 04:41:00 20 2019-12-29 04:27:00 2019-12-29 04:28:00 21 2019-12-29 00:05:00 2019-12-29 00:06:00 22 2019-12-28 23:57:00 2019-12-28 23:58:00 23 2019-12-28 23:12:00 2019-12-28 23:13:00 24 2019-12-28 23:04:00 2019-12-28 23:05:00 25 2019-12-28 22:27:00 2019-12-28 22:28:00 26 2019-12-28 21:42:00 2019-12-28 21:43:00 27 2019-12-28 20:57:00 2019-12-28 20:58:00 28 2019-12-28 20:12:00 2019-12-28 20:13:00 29 2019-12-28 07:27:00 2019-12-28 07:28:00 30 2019-12-28 06:42:00 2019-12-28 06:43:00 31 2019-12-28 05:57:00 2019-12-28 05:58:00 32 2019-12-28 05:12:00 2019-12-28 05:13:00 33 2019-12-27 17:21:00 2019-12-27 17:22:00 34 2019-12-06 07:01:00 2019-12-27 06:10:00 Frank
On Mon, Dec 30, 2019 at 09:36:55PM +0000, Frank Bulk wrote:
QRator has been alerting me that AS 3128 is coming and going. It just happened again and wondering if anyone else is seeing this behavior and also how things look on MICE's route reflectors.
The RR's show the connection to AS3128 has been up since 2019-12-17, no flapping. -- Doug McIntyre <merlyn@iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades
Hi everyone- Wanted to add a bit more detail to what we (AS 3128) checked on our side. Specifically, 1) our peering session(s) to the RS seems stable from an uptime perspective. 2) I don't see a large delta in outbound bgp messages from us to MICE. 3) we don't run BMP so I don't actually track outbound changes at a level that would conclusive prove what's going on. Frank, is it possible you are being notified about a single route flapping? I did check AS2381's looking glass, specifically a single route (143.235.0.0/16) and it looks stable. Admittedly I didn't look for LG across all MICE members but I'm not sure if any would allow me to run an as-path regexp to see if there is a specific flapping route that is flapping. If someone can help out on that front it could be useful. [output from AS2381 looking glass] [BGP/170] 1w6d 13:08:45, MED 10, localpref 200, from 206.108.255.1 AS path: 3128 3128 3128 3128 I, validation-state: unverified > to 206.108.255.66 via xe-0/1/5.300 [BGP/170] 3w3d 14:51:19, MED 10, localpref 200, from 206.108.255.2 AS path: 3128 3128 3128 3128 I, validation-state: unverified > to 206.108.255.66 via xe-0/1/5.300 Thanks- -Michael From: MICE Discuss <MICE-DISCUSS@LISTS.IPHOUSE.NET> On Behalf Of Frank Bulk Sent: Monday, December 30, 2019 3:37 PM To: MICE-DISCUSS@LISTS.IPHOUSE.NET Subject: [MICE-DISCUSS] Route reflector check QRator has been alerting me that AS 3128 is coming and going. It just happened again and wondering if anyone else is seeing this behavior and also how things look on MICE's route reflectors. I already contacted the good folks at the University of Wisconsin and they're not seeing anything on their side. AS Number: AS3128 AS Name: # First seen Last seen 1 2019-12-29 21:49:00 2019-12-29 21:50:00 2 2019-12-29 18:42:00 2019-12-29 18:43:00 3 2019-12-29 17:57:00 2019-12-29 17:58:00 4 2019-12-29 16:27:00 2019-12-29 16:28:00 5 2019-12-29 14:12:00 2019-12-29 14:13:00 6 2019-12-29 13:27:00 2019-12-29 13:28:00 7 2019-12-29 12:42:00 2019-12-29 12:43:00 8 2019-12-29 11:57:00 2019-12-29 11:58:00 9 2019-12-29 11:12:00 2019-12-29 11:13:00 10 2019-12-29 11:04:00 2019-12-29 11:05:00 11 2019-12-29 10:27:00 2019-12-29 10:28:00 12 2019-12-29 08:57:00 2019-12-29 08:58:00 13 2019-12-29 08:12:00 2019-12-29 08:13:00 14 2019-12-29 07:53:00 2019-12-29 07:54:00 15 2019-12-29 07:27:00 2019-12-29 07:28:00 16 2019-12-29 06:42:00 2019-12-29 06:43:00 17 2019-12-29 05:57:00 2019-12-29 05:58:00 18 2019-12-29 05:12:00 2019-12-29 05:13:00 19 2019-12-29 04:40:00 2019-12-29 04:41:00 20 2019-12-29 04:27:00 2019-12-29 04:28:00 21 2019-12-29 00:05:00 2019-12-29 00:06:00 22 2019-12-28 23:57:00 2019-12-28 23:58:00 23 2019-12-28 23:12:00 2019-12-28 23:13:00 24 2019-12-28 23:04:00 2019-12-28 23:05:00 25 2019-12-28 22:27:00 2019-12-28 22:28:00 26 2019-12-28 21:42:00 2019-12-28 21:43:00 27 2019-12-28 20:57:00 2019-12-28 20:58:00 28 2019-12-28 20:12:00 2019-12-28 20:13:00 29 2019-12-28 07:27:00 2019-12-28 07:28:00 30 2019-12-28 06:42:00 2019-12-28 06:43:00 31 2019-12-28 05:57:00 2019-12-28 05:58:00 32 2019-12-28 05:12:00 2019-12-28 05:13:00 33 2019-12-27 17:21:00 2019-12-27 17:22:00 34 2019-12-06 07:01:00 2019-12-27 06:10:00 Frank ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1
Frank- I may have found the answer to your question. Looking for tips on better ways to do this, but I did this. "show route community $ourCommunityForRoutesWeExport detail | match Age" and did a mix of lame exclusions and visual greps to find a few routes with an age of less than 60 minutes. specifically 184.164.250.0/24 *[BGP/170] 00:44:15 184.164.251.0/24 *[BGP/170] 00:44:15 184.164.252.0/24 *[BGP/170] 00:44:15 These are part of an anycast R&E project. We receive this over an eBGP peering with the project. It looks like they are setting community 47065:184 if you want to filter. Frank, how new is your detection software? This is an old project and I would call this normal behavior for them. -Michael From: MICE Discuss <MICE-DISCUSS@LISTS.IPHOUSE.NET> On Behalf Of Michael Hare Sent: Monday, December 30, 2019 3:59 PM To: MICE-DISCUSS@LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Route reflector check Hi everyone- Wanted to add a bit more detail to what we (AS 3128) checked on our side. Specifically, 1) our peering session(s) to the RS seems stable from an uptime perspective. 2) I don't see a large delta in outbound bgp messages from us to MICE. 3) we don't run BMP so I don't actually track outbound changes at a level that would conclusive prove what's going on. Frank, is it possible you are being notified about a single route flapping? I did check AS2381's looking glass, specifically a single route (143.235.0.0/16) and it looks stable. Admittedly I didn't look for LG across all MICE members but I'm not sure if any would allow me to run an as-path regexp to see if there is a specific flapping route that is flapping. If someone can help out on that front it could be useful. [output from AS2381 looking glass] [BGP/170] 1w6d 13:08:45, MED 10, localpref 200, from 206.108.255.1 AS path: 3128 3128 3128 3128 I, validation-state: unverified > to 206.108.255.66 via xe-0/1/5.300 [BGP/170] 3w3d 14:51:19, MED 10, localpref 200, from 206.108.255.2 AS path: 3128 3128 3128 3128 I, validation-state: unverified > to 206.108.255.66 via xe-0/1/5.300 Thanks- -Michael From: MICE Discuss <MICE-DISCUSS@LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> On Behalf Of Frank Bulk Sent: Monday, December 30, 2019 3:37 PM To: MICE-DISCUSS@LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] Route reflector check QRator has been alerting me that AS 3128 is coming and going. It just happened again and wondering if anyone else is seeing this behavior and also how things look on MICE's route reflectors. I already contacted the good folks at the University of Wisconsin and they're not seeing anything on their side. AS Number: AS3128 AS Name: # First seen Last seen 1 2019-12-29 21:49:00 2019-12-29 21:50:00 2 2019-12-29 18:42:00 2019-12-29 18:43:00 3 2019-12-29 17:57:00 2019-12-29 17:58:00 4 2019-12-29 16:27:00 2019-12-29 16:28:00 5 2019-12-29 14:12:00 2019-12-29 14:13:00 6 2019-12-29 13:27:00 2019-12-29 13:28:00 7 2019-12-29 12:42:00 2019-12-29 12:43:00 8 2019-12-29 11:57:00 2019-12-29 11:58:00 9 2019-12-29 11:12:00 2019-12-29 11:13:00 10 2019-12-29 11:04:00 2019-12-29 11:05:00 11 2019-12-29 10:27:00 2019-12-29 10:28:00 12 2019-12-29 08:57:00 2019-12-29 08:58:00 13 2019-12-29 08:12:00 2019-12-29 08:13:00 14 2019-12-29 07:53:00 2019-12-29 07:54:00 15 2019-12-29 07:27:00 2019-12-29 07:28:00 16 2019-12-29 06:42:00 2019-12-29 06:43:00 17 2019-12-29 05:57:00 2019-12-29 05:58:00 18 2019-12-29 05:12:00 2019-12-29 05:13:00 19 2019-12-29 04:40:00 2019-12-29 04:41:00 20 2019-12-29 04:27:00 2019-12-29 04:28:00 21 2019-12-29 00:05:00 2019-12-29 00:06:00 22 2019-12-28 23:57:00 2019-12-28 23:58:00 23 2019-12-28 23:12:00 2019-12-28 23:13:00 24 2019-12-28 23:04:00 2019-12-28 23:05:00 25 2019-12-28 22:27:00 2019-12-28 22:28:00 26 2019-12-28 21:42:00 2019-12-28 21:43:00 27 2019-12-28 20:57:00 2019-12-28 20:58:00 28 2019-12-28 20:12:00 2019-12-28 20:13:00 29 2019-12-28 07:27:00 2019-12-28 07:28:00 30 2019-12-28 06:42:00 2019-12-28 06:43:00 31 2019-12-28 05:57:00 2019-12-28 05:58:00 32 2019-12-28 05:12:00 2019-12-28 05:13:00 33 2019-12-27 17:21:00 2019-12-27 17:22:00 34 2019-12-06 07:01:00 2019-12-27 06:10:00 Frank ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1
Mike, It's possible that it's a single prefix that's setting QRator off. I just sent you a copy of our MICE-facing routing table for AS 2381 and we'll see I can jump on the next time I get a QRator alert to compare. I checked for 184.164.25[0-2].0/24 and I don't see it right now. Thanks! Frank From: MICE Discuss <MICE-DISCUSS@LISTS.IPHOUSE.NET> On Behalf Of Michael Hare Sent: Monday, December 30, 2019 3:59 PM To: MICE-DISCUSS@LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Route reflector check Hi everyone- Wanted to add a bit more detail to what we (AS 3128) checked on our side. Specifically, 1) our peering session(s) to the RS seems stable from an uptime perspective. 2) I don't see a large delta in outbound bgp messages from us to MICE. 3) we don't run BMP so I don't actually track outbound changes at a level that would conclusive prove what's going on. Frank, is it possible you are being notified about a single route flapping? I did check AS2381's looking glass, specifically a single route (143.235.0.0/16) and it looks stable. Admittedly I didn't look for LG across all MICE members but I'm not sure if any would allow me to run an as-path regexp to see if there is a specific flapping route that is flapping. If someone can help out on that front it could be useful. [output from AS2381 looking glass] [BGP/170] 1w6d 13:08:45, MED 10, localpref 200, from 206.108.255.1 AS path: 3128 3128 3128 3128 I, validation-state: unverified > to 206.108.255.66 via xe-0/1/5.300 [BGP/170] 3w3d 14:51:19, MED 10, localpref 200, from 206.108.255.2 AS path: 3128 3128 3128 3128 I, validation-state: unverified > to 206.108.255.66 via xe-0/1/5.300 Thanks- -Michael From: MICE Discuss <MICE-DISCUSS@LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET>> On Behalf Of Frank Bulk Sent: Monday, December 30, 2019 3:37 PM To: MICE-DISCUSS@LISTS.IPHOUSE.NET<mailto:MICE-DISCUSS@LISTS.IPHOUSE.NET> Subject: [MICE-DISCUSS] Route reflector check QRator has been alerting me that AS 3128 is coming and going. It just happened again and wondering if anyone else is seeing this behavior and also how things look on MICE's route reflectors. I already contacted the good folks at the University of Wisconsin and they're not seeing anything on their side. AS Number: AS3128 AS Name: # First seen Last seen 1 2019-12-29 21:49:00 2019-12-29 21:50:00 2 2019-12-29 18:42:00 2019-12-29 18:43:00 3 2019-12-29 17:57:00 2019-12-29 17:58:00 4 2019-12-29 16:27:00 2019-12-29 16:28:00 5 2019-12-29 14:12:00 2019-12-29 14:13:00 6 2019-12-29 13:27:00 2019-12-29 13:28:00 7 2019-12-29 12:42:00 2019-12-29 12:43:00 8 2019-12-29 11:57:00 2019-12-29 11:58:00 9 2019-12-29 11:12:00 2019-12-29 11:13:00 10 2019-12-29 11:04:00 2019-12-29 11:05:00 11 2019-12-29 10:27:00 2019-12-29 10:28:00 12 2019-12-29 08:57:00 2019-12-29 08:58:00 13 2019-12-29 08:12:00 2019-12-29 08:13:00 14 2019-12-29 07:53:00 2019-12-29 07:54:00 15 2019-12-29 07:27:00 2019-12-29 07:28:00 16 2019-12-29 06:42:00 2019-12-29 06:43:00 17 2019-12-29 05:57:00 2019-12-29 05:58:00 18 2019-12-29 05:12:00 2019-12-29 05:13:00 19 2019-12-29 04:40:00 2019-12-29 04:41:00 20 2019-12-29 04:27:00 2019-12-29 04:28:00 21 2019-12-29 00:05:00 2019-12-29 00:06:00 22 2019-12-28 23:57:00 2019-12-28 23:58:00 23 2019-12-28 23:12:00 2019-12-28 23:13:00 24 2019-12-28 23:04:00 2019-12-28 23:05:00 25 2019-12-28 22:27:00 2019-12-28 22:28:00 26 2019-12-28 21:42:00 2019-12-28 21:43:00 27 2019-12-28 20:57:00 2019-12-28 20:58:00 28 2019-12-28 20:12:00 2019-12-28 20:13:00 29 2019-12-28 07:27:00 2019-12-28 07:28:00 30 2019-12-28 06:42:00 2019-12-28 06:43:00 31 2019-12-28 05:57:00 2019-12-28 05:58:00 32 2019-12-28 05:12:00 2019-12-28 05:13:00 33 2019-12-27 17:21:00 2019-12-27 17:22:00 34 2019-12-06 07:01:00 2019-12-27 06:10:00 Frank ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.iphouse.net_cgi-2Dbin_wa-3FSUBED1-3DMICE-2DDISCUSS-26A-3D1&d=DwMFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=xqx0yD1kWOETi5_MVFlMPPxb5us_12870MpQFRgCEns&m=9BGvedlJWov0PSYX_54J1OIhnstbh6juO6qwrNFg8t0&s=fg_fkpPROfs8qvQLqgAttS-kaZwaJEQ5c3tMT6Wjjjg&e=> ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.iphouse.net_cgi-2Dbin_wa-3FSUBED1-3DMICE-2DDISCUSS-26A-3D1&d=DwMFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=xqx0yD1kWOETi5_MVFlMPPxb5us_12870MpQFRgCEns&m=9BGvedlJWov0PSYX_54J1OIhnstbh6juO6qwrNFg8t0&s=fg_fkpPROfs8qvQLqgAttS-kaZwaJEQ5c3tMT6Wjjjg&e=>
participants (3)
-
Doug McIntyre
-
Frank Bulk
-
Michael Hare