Why NIXI AS24029 appears to be transit ASN?

31-03-2014

And my post on 1st April. Don’t take it as April fool post ;)

Multiple times NIXI’s AS24029 has been reported as acting like transit ASN for multiple networks. I have analysed it in past and this is very much because of route leaks by few specific networks. I have explained difference in peering Vs transit routes and their handling previously on my blog.

In short: A network is supposed to re-announce it’s peering and transit routes only to customer and not to any other peer or upstream. Whenever NIXI’s ASN appears in global routing table, its always the case where one or more networks are re-announcing routes learnt via NIXI to their upstream transits.

Looking at Hurricane Electric’s bgp.he.net for NIXI’s AS24029, we get:

Now according to this - many ASNs are peers of NIXI and visible to HE. The problem with HE’s data is that it doesn’t shows who is downstream and who is upstream (but is pretty fast!). Looking at stat.ripe.net data for AS24029, we get:

This is very interesting data as left side are the ones which are actually announcing these routes to their upstreams. Finding upstream is tricky since these are filtered out at global level are don’t stay in the global routing table. It would be overall hard to find ones whose path count is low but for ones with large path count, we can likely see those routes in RIPE RIS collected data.

Using bgpdump on RIPE RIS data, I get:

anurag@server7:~/test$ grep "24029" latest.txt
TABLE_DUMP_V2|03/31/14 16:00:05|A|68.67.63.245|22652|103.27.140.0/22|22652 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|46.149.194.2|15469|103.27.140.0/22|15469 6762 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|193.160.39.1|57821|103.27.140.0/22|57821 48039 3320 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|79.143.241.12|29608|103.27.140.0/22|29608 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|203.119.76.5|4608|103.27.140.0/22|4608 1221 4637 1273 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|46.149.194.1|15469|103.27.140.0/22|15469 6762 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|193.150.22.1|57381|103.27.140.0/22|57381 42708 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|202.12.28.1|4777|103.27.140.0/22|4777 2500 2500 2500 7660 4635 1273 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|208.51.134.248|3549|103.27.140.0/22|3549 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|203.123.48.6|37989|103.27.140.0/22|37989 4844 2914 3491 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|213.200.87.254|3257|103.27.140.0/22|3257 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|218.189.6.2|9304|103.27.140.0/22|9304 4635 1273 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|12.0.1.63|7018|103.27.140.0/22|7018 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|212.25.27.44|8758|103.27.140.0/22|8758 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|176.12.110.8|50300|103.27.140.0/22|50300 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|193.0.0.56|3333|103.27.140.0/22|3333 3356 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|195.47.235.100|6881|103.27.140.0/22|6881 15685 6939 1273 55410 {18101,24029,45804,132777}|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|208.51.134.248|3549|103.245.200.0/24|3549 6453 4755 17439 24029 9498 132542|IGP
TABLE_DUMP_V2|03/31/14 16:00:05|A|12.0.1.63|7018|103.245.200.0/24|7018 6453 4755 17439 24029 9498 132542|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|46.149.194.2|15469|116.214.114.0/24|15469 6762 9498 17447 24029 4755 24063|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|46.149.194.1|15469|116.214.114.0/24|15469 6762 9498 17447 24029 4755 24063|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|193.150.22.1|57381|116.214.114.0/24|57381 42708 9498 17447 24029 4755 24063|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|176.12.110.8|50300|116.214.114.0/24|50300 9498 17447 24029 4755 24063|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|203.123.48.6|37989|116.214.114.0/24|37989 4844 9498 17447 24029 4755 24063|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|213.200.87.254|3257|116.214.114.0/24|3257 9498 17447 24029 4755 24063|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|195.47.235.100|6881|116.214.114.0/24|6881 3257 9498 17447 24029 4755 24063|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|208.51.134.248|3549|116.214.114.0/24|3549 7473 9498 17447 24029 4755 24063|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|46.149.194.2|15469|123.136.159.0/24|15469 6762 9498 45528 45528 45528 45528 24029 18101 18101 9396|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|46.149.194.1|15469|123.136.159.0/24|15469 6762 9498 45528 45528 45528 45528 24029 18101 18101 9396|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|193.150.22.1|57381|123.136.159.0/24|57381 42708 9498 45528 45528 45528 45528 24029 18101 18101 9396|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|218.189.6.2|9304|123.136.159.0/24|9304 4635 9498 45528 45528 45528 45528 24029 18101 18101 9396|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|203.123.48.6|37989|123.136.159.0/24|37989 4844 7473 9498 45528 45528 45528 45528 24029 18101 18101 9396|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|208.51.134.248|3549|123.136.159.0/24|3549 9498 45528 45528 45528 45528 24029 18101 18101 9396|IGP
TABLE_DUMP_V2|03/31/14 16:00:06|A|202.12.28.1|4777|123.136.159.0/24|4777 2500 2500 2500 7660 4635 9498 45528 45528 45528 45528 24029 18101 18101 9396|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|46.149.194.2|15469|182.48.209.0/24|15469 6762 9498 17443 4755 24029 9583 45769|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|46.149.194.1|15469|182.48.209.0/24|15469 6762 9498 17443 4755 24029 9583 45769|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|195.47.235.100|6881|182.48.209.0/24|6881 3257 9498 17443 4755 24029 9583 45769|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|208.51.134.248|3549|182.48.209.0/24|3549 10026 9498 17443 4755 24029 9583 45769|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|203.123.48.6|37989|182.48.209.0/24|37989 4844 7473 9498 17443 4755 24029 9583 45769|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|202.12.28.1|4777|182.48.209.0/24|4777 2516 10026 9498 17443 4755 24029 9583 45769|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|213.200.87.254|3257|182.48.209.0/24|3257 9498 17443 4755 24029 9583 45769|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|202.12.28.1|4777|183.87.210.0/24|4777 2516 6453 4755 18229 24029 9583 45841|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|202.12.28.1|4777|183.87.244.0/24|4777 2516 6453 4755 18229 24029 9583 45841|IGP
TABLE_DUMP_V2|03/31/14 16:00:09|A|202.12.28.1|4777|183.87.250.0/24|4777 2516 6453 4755 18229 24029 9583 45841|IGP
TABLE_DUMP_V2|03/31/14 16:00:12|A|193.150.22.1|57381|202.3.15.0/24|57381 42708 9583 24186 24029 4755 45927|IGP
TABLE_DUMP_V2|03/31/14 16:00:12|A|203.119.76.5|4608|202.140.137.0/24|4608 1221 4637 6453 4755 10201 10201 10201 10201 10201 10201 10201 24029 9583|IGP
TABLE_DUMP_V2|03/31/14 16:00:12|A|202.12.28.1|4777|202.140.137.0/24|4777 2516 6453 4755 10201 10201 10201 10201 10201 10201 10201 24029 9583|IGP
TABLE_DUMP_V2|03/31/14 16:00:12|A|208.51.134.248|3549|202.140.137.0/24|3549 6453 4755 10201 10201 10201 10201 10201 10201 10201 24029 9583|IGP
TABLE_DUMP_V2|03/31/14 16:00:13|A|46.149.194.2|15469|203.119.50.0/24|15469 6762 9498 24186 24029 18101 18101|IGP
TABLE_DUMP_V2|03/31/14 16:00:13|A|46.149.194.1|15469|203.119.50.0/24|15469 6762 9498 24186 24029 18101 18101|IGP
TABLE_DUMP_V2|03/31/14 16:00:13|A|193.150.22.1|57381|203.119.50.0/24|57381 42708 9498 24186 24029 18101 18101|IGP
TABLE_DUMP_V2|03/31/14 16:00:13|A|203.123.48.6|37989|203.119.50.0/24|37989 4844 9498 24186 24029 18101 18101|IGP
TABLE_DUMP_V2|03/31/14 16:00:13|A|208.51.134.248|3549|203.119.50.0/24|3549 9498 24186 24029 18101 18101|IGP
anurag@server7:~/test$

Refinding more of AS path part, we get:

anurag@server7:~/test$ grep "24029" latest.txt |awk -F '|' '{print $7}' |awk -F '24029' '{print $1}'|awk -F ' ' '{print $NF}' |sort -u
10201 - Aircel
17439 - Netmagic
17447 - Net4India
18229 - CtrlS Datacenter
24186 - RailTel India
45528 - Tikona Networks
4755 - Tata Comm/VSNL
{18101, - Reliance Comm
anurag@server7:~/test$

Here we get the culprit ASNs. :)

So why does this happen?

Mostly it happens due the way filters are controlled in routers. Most of networks open their filters with upstreams to announce their customer routes. Now if customer routes are received via NIXI, they are re-announced as well. So in many of these cases these networks have/had the origination ASN as customer.

These are the prefixes which are causing this:

anurag@server7:~/test$ grep "24029" latest.txt |awk -F '|' '{print $6}'|sort -u
103.245.200.0/24
103.27.140.0/22
116.214.114.0/24
123.136.159.0/24
182.48.209.0/24
183.87.210.0/24
183.87.244.0/24
183.87.250.0/24
202.140.137.0/24
202.3.15.0/24
203.119.50.0/24
anurag@server7:~/test$

So that’s all about NIXI route leaks. Wish NIXI becomes a International hub for traffic exchange between Europe/Middle East and East Asia and as per current policy it’s no where around promoting domestic traffic exchange let alone international one!

Disclaimer: I work for an Indian ISP and all comments here are completely personal. In no way it reflects my employers view.