Tanzania Telecom leaking Telia routes to Tata

Networking

Last night I was looking at routing tables and saw a interesting case where for a specific route.

Here’s what I got from Tata’s AS6453 looking glass:

Router: gin-ldn-core4  
Site: UK, London, LDN  
Command: show ip bgp 117.219.227.229

BGP routing table entry for 117.219.224.0/20  
Bestpath Modifiers: deterministic-med  
Paths: (4 available, best #4)  
Multipath: eBGP  
17 18 19

33765 1299 3549 9829, (received-only)  
ix-3-1-2.core4.LDN-London. from ix-3-1-2.core4.LDN-London. (ix-3-1-2.core4.LDN-London.)  
Origin IGP, valid, external

4755 9829  
mlv-tcore2. (metric 3605) from l78-tcore2. (66.110.10.234)  
Origin IGP, valid, internal  
Community:  
Originator: 66.110.10.215

4755 9829  
mlv-tcore2. (metric 3605) from l78-tcore1. (66.110.10.237)  
Origin IGP, valid, internal  
Community:  
Originator: 66.110.10.215

4755 9829  
mlv-tcore2. (metric 3605) from ldn-mcore3. (ldn-mcore3.)  
Origin IGP, valid, internal, best  
Community:  
Originator: 66.110.10.215

The first route in table seems pretty weird. AS path is 33765 1299 3549 9829 i.e clearly AS33765 sitting in middle of AS6453 and AS1299. This must be a route leak since Tata AS6453 and Telia AS1299 are way too bigger then Tanzania telecom and hence there’s no possibility of Tata transitting via Tanzania telecom. Though issue seems for just one specific route for BSNL which Tanzania telecom is learning from Telia, which further is getting from Global Crossing AS3549 (one of upstreams of BSNL). 

As per RADB both Telia and Tata Comm are upstreams of AS33765.

anurag:~ anurag$ whois -h whois.radb.net as1299 | grep 33765  
import: from AS33765 action pref=50; accept AS-33765  
export: to AS33765 announce ANY  
mp-import: afi ipv6 from AS33765 accept AS-33765  
mp-export: afi ipv6 to AS33765 announce ANY  
anurag:~ anurag$  
anurag:~ anurag$  
anurag:~ anurag$ whois -h whois.radb.net as6453 | grep 33765  
import: from AS33765 action pref = 50; accept AS33765  
export: to AS33765 announce ANY  
anurag:~ anurag$

With hope that you are not leaking routes between two tier 1 networks, time for me to start my day! :)