Last night I was looking at routing tables and saw a interesting case where for a specific route.
Here’s what I got from Tata’s AS6453 looking glass:
Router: gin-ldn-core4 Site: UK, London, LDN Command: show ip bgp 220.127.116.11 BGP routing table entry for 18.104.22.168/20 Bestpath Modifiers: deterministic-med Paths: (4 available, best #4) Multipath: eBGP 17 18 19 33765 1299 3549 9829, (received-only) ix-3-1-2.core4.LDN-London. from ix-3-1-2.core4.LDN-London. (ix-3-1-2.core4.LDN-London.) Origin IGP, valid, external 4755 9829 mlv-tcore2. (metric 3605) from l78-tcore2. (22.214.171.124) Origin IGP, valid, internal Community: Originator: 126.96.36.199 4755 9829 mlv-tcore2. (metric 3605) from l78-tcore1. (188.8.131.52) Origin IGP, valid, internal Community: Originator: 184.108.40.206 4755 9829 mlv-tcore2. (metric 3605) from ldn-mcore3. (ldn-mcore3.) Origin IGP, valid, internal, best Community: Originator: 220.127.116.11
The first route in table seems pretty weird. AS path is 33765 1299 3549 9829 i.e clearly AS33765 sitting in middle of AS6453 and AS1299. This must be a route leak since Tata AS6453 and Telia AS1299 are way too bigger then Tanzania telecom and hence there’s no possibility of Tata transitting via Tanzania telecom. Though issue seems for just one specific route for BSNL which Tanzania telecom is learning from Telia, which further is getting from Global Crossing AS3549 (one of upstreams of BSNL).
As per RADB both Telia and Tata Comm are upstreams of AS33765.
anurag:~ anurag$ whois -h whois.radb.net as1299 | grep 33765 import: from AS33765 action pref=50; accept AS-33765 export: to AS33765 announce ANY mp-import: afi ipv6 from AS33765 accept AS-33765 mp-export: afi ipv6 to AS33765 announce ANY anurag:~ anurag$ anurag:~ anurag$ anurag:~ anurag$ whois -h whois.radb.net as6453 | grep 33765 import: from AS33765 action pref = 50; accept AS33765 export: to AS33765 announce ANY anurag:~ anurag$
With hope that you are not leaking routes between two tier 1 networks, time for me to start my day! :)