Calling TeliaSonera - time to implement prefix filtering

[s***@nethelp.no]

We're currently receiving the following prefix from TeliaSonera on on
of our IP transit links in Oslo

62.0.0.0/8 *[BGP/170] 4d 22:23:07, localpref 10
AS path: 1299 29049
AS 29049 is

aut-num: AS2904
as-name: Delta-Telecom-A
descr: Delta Telecom LTD
descr: International Communication Operato
descr: Azerbaijan Republi

and *of course* they don't own 62.0.0.0/8

TeliaSonera: It's about time you started implementing prefix filterin
on your customer links. Our other transit providers do this

Steinar Haug, Nethelp consulting, ***@nethelp.n

[m***@bt.com]

We're currently receiving the following prefix from=2
TeliaSonera on one of our IP transit links in Oslo
aut-num: AS2904
as-name: Delta-Telecom-A
descr: Delta Telecom LTD
descr: International Communication Operato
descr: Azerbaijan Republi
=2
and *of course* they don't own 62.0.0.0/8

Own!
How can you tell who actually owns any network these days. According t
Lars Nyberg, President and CEO of TeliaSonera, TeliaSonera is committe
to Azerbaijan and will continue delivering world class service. Thi
statement was made at a press conference in Baku, the capital o
Azerbaijan, in January

It took about 30 seconds of googling to learn that this Swedish/Finnis
merged company is in a joint venture with a Turkish company and tha
joint venture is in another joint venture with the Azerbaijan
government. TeliaSonera owns a majority of the stake in the first join
venture (Fintur Holdings BV) which owns a majority stake in the secon
joint venture (Azercell Telecom).=2

I still have no idea who owns what AS or IP address range, but it seem
to be reasonable for TeliaSonera, an Azerbaijani telecom company, to b
announcing an IP address range assigned to another Azerbaijani teleco
company. Have you asked TeliaSonera why they are announcing the prefix

Yes, it is possible that someone in Azerbaijan made a mistake i
configuring their router, but rather than complain on NANOG, it would b
better to work back through the chain of BGP peers and help educate th
people who made the mistake

--Michael Dillo

[James Blessing]

Post by s***@nethelp.no
We're currently receiving the following prefix from
TeliaSonera on one of our IP transit links in Oslo
aut-num: AS2904
as-name: Delta-Telecom-A
descr: Delta Telecom LTD
descr: International Communication Operato
descr: Azerbaijan Republi
and *of course* they don't own 62.0.0.0/8

Own!

I think he was saying that Delta Telecom don't *own* 62.0.0.0/8 and
therefore shouldn't be advertising it. Following that Telia shouldn't be
accepting the route and then re-announcing it to peers ..


--
CO
Entanet Internationa
T: 0870 770 958
W: http://www.enta.net

[m***@bt.com]

Post by s***@nethelp.no
aut-num: AS2904
and *of course* they don't own 62.0.0.0/8

=2
Own!

=2
I think he was saying that Delta Telecom don't *own*=2
62.0.0.0/8 and therefore shouldn't be advertising it.=2
Following that Telia shouldn't be accepting the route and=2
then re-announcing it to peers ..

Of course! ... /8? ... Azerbaijan? ... What was I thinking?..

Still, it would be better to contact the upstream directl
and work back through the peering chain because this kind=2
of thing is usually a result of education deficit, not malice

--Michael Dillo

[[e-mail]]

Post by m***@bt.com

Post by James Blessing
I think he was saying that Delta Telecom don't *own*
62.0.0.0/8 and therefore shouldn't be advertising it.
Following that Telia shouldn't be accepting the route and
then re-announcing it to peers ..

Of course! ... /8? ... Azerbaijan? ... What was I thinking?..
Still, it would be better to contact the upstream directl
and work back through the peering chain because this kind
of thing is usually a result of education deficit, not malice

Probably in theory. In practice, it's not obvious. I *did* get
private response from a Telia person after my posting to Nanog
and this person alerted their routing registry. The 62.0.0.0/
prefix is now gone - whether as as result of my posting to Nano
or not, I have no means of knowing

Steinar Haug, Nethelp consulting, ***@nethelp.n

[[e-mail]]

Post by James Blessing
I think he was saying that Delta Telecom don't *own* 62.0.0.0/8 and
therefore shouldn't be advertising it. Following that Telia shouldn't be
accepting the route and then re-announcing it to peers ..

Exactly

Steinar Haug, Nethelp consulting, ***@nethelp.n

[Martin Hannigan]

Yes, it is operational

Best

Mart

But isn't this what nanog is for? It appears to be more on-topic than th
email threads. More E than S
Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-IS
Senior Network Enginee
Coleman Technologies, Inc
954-298-169

-----Original Message----
Sent: Tuesday, April 15, 2008 9:51 A
Subject: RE: Calling TeliaSonera - time to implement prefix filterin

Post by James Blessing

Post by s***@nethelp.no
aut-num: AS2904
and *of course* they don't own 62.0.0.0/8

Own!

I think he was saying that Delta Telecom don't *own
62.0.0.0/8 and therefore shouldn't be advertising it
Following that Telia shouldn't be accepting the route an
then re-announcing it to peers ..

Of course! ... /8? ... Azerbaijan? ... What was I thinking?..
Still, it would be better to contact the upstream directl
and work back through the peering chain because this kin
of thing is usually a result of education deficit, not malice
--Michael Dillo

[Geoff Huston]

Post by Martin Hannigan
Yes, it is operational

But isn't this what nanog is for? It appears to be more on-topic than th
email threads. More E than S

As well as 62.0.0.0/8 there is 88.0.0.0/8 (originated by AS13064, with upstreams of AS13237 (LambdaNet) and AS 8447 (Telekom Austria

Unlike 62.0.0.0/8, which is being announced as a stable announcement (and has AS 1299 (Telianet) as its upstream, 88.0.0.0/8 is being announced for periods of 30 seconds to 1 minute

Last time we saw this short announce behaviour it was a spammer using the "vacant" addresses in the /8 block to generate spam in short bursts. I have no data on what is going on with 88.0.0.0/

Here's what I see in terms of recent BGP activity for 88.0.0.0/8: http://88.0.0.0.8.potaroo.net and for 62.0.0.0/8: http://62.0.0.0.8.potaroo.ne