Charter – anuragbhatia.com

Reliance Jio orignating Charter's /16 pool

Just noticed that Reliance Jio (AS55836) seems to be originating a /16 which is for Charter Communications (AS20115) – 47.35.0.0/16.

route-views>sh ip bgp 47.35.0.0/16 long | exclude 20115
BGP table version is 18764390, local router ID is 128.223.51.103
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
     Network          Next Hop            Metric LocPrf Weight Path
 *   47.35.0.0/16     195.208.112.161                        0 3277 3267 174 64049 55836 i
 *                    217.192.89.50                          0 3303 6762 64049 55836 i
 *                    212.66.96.126                          0 20912 1267 64049 55836 i
 *                    162.243.188.2                          0 393406 6453 6762 64049 55836 i
 *                    192.241.164.4                          0 62567 2914 174 64049 55836 i
 *                    129.250.0.11          1007             0 2914 174 64049 55836 i
 *                    104.192.216.1                          0 46450 174 64049 55836 i
 *                    202.93.8.242                           0 24441 3491 3491 174 64049 55836 i
 *                    66.59.190.221                          0 6539 577 6762 64049 55836 i
 *                    144.228.241.130         80             0 1239 174 64049 55836 i
 *                    207.172.6.20             0             0 6079 3356 174 64049 55836 i
 *                    203.62.252.83                          0 1221 4637 174 64049 55836 i
 *                    93.104.209.174                         0 58901 51167 3356 6762 64049 55836 i
     Network          Next Hop            Metric LocPrf Weight Path
 *                    162.250.137.254                        0 4901 174 64049 55836 i
 *                    4.69.184.193             0             0 3356 174 64049 55836 i
 *                    208.51.134.254           1             0 3549 3356 174 64049 55836 i
 *                    89.149.178.10           10             0 3257 174 64049 55836 i
 *                    66.110.0.86                            0 6453 6762 64049 55836 i
 *                    134.222.87.1           650             0 286 174 64049 55836 i
 *                    95.85.0.2                              0 200130 6453 174 64049 55836 i
 *                    12.0.1.63                              0 7018 174 64049 55836 i
 *                    173.205.57.234                         0 53364 3257 174 64049 55836 i
 *                    206.24.210.80                          0 3561 174 64049 55836 i
 *                    5.101.110.2                            0 202018 2914 174 64049 55836 i
 *                    207.172.6.1              0             0 6079 3356 174 64049 55836 i
 *                    154.11.98.225            0             0 852 174 64049 55836 i
 *                    194.85.40.15                           0 3267 174 64049 55836 i
 *                    208.74.64.40                           0 19214 174 64049 55836 i
 *                    209.124.176.223                        0 101 101 174 64049 55836 i
 *                    66.185.128.48            6             0 1668 174 64049 55836 i
 *                    203.181.248.168                        0 7660 2516 6762 64049 55836 i
 *                    202.232.0.2                            0 2497 701 6762 64049 55836 i
 *                    103.247.3.45                           0 58511 64049 55836 i
 *                    193.0.0.56                             0 3333 1103 64049 55836 i
     Network          Next Hop            Metric LocPrf Weight Path
 *                    80.241.176.31                          0 20771 47872 64049 55836 i
 *>                   216.218.252.164                        0 6939 64049 55836 i
 *                    132.198.255.253                        0 1351 174 64049 55836 i
 *                    103.255.249.22                         0 58443 45177 64049 55836 i
 *                    114.31.199.1                           0 4826 174 64049 55836 i
route-views>

This shows Reliance Jio’s ASN AS55836 announcing 47.35.0.0/16. Charter Communications (AS20115) is originating multiple of /18s out of the same pool.

route-views>sh ip bgp 47.35.0.0/16 long
BGP table version is 18764237, local router ID is 128.223.51.103
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
     Network          Next Hop            Metric LocPrf Weight Path
 *   47.35.0.0/18     195.208.112.161                        0 3277 3267 6939 20115 i
 *                    212.66.96.126                          0 20912 6939 20115 i
 *                    162.243.188.2                          0 393406 6939 20115 i
 *                    192.241.164.4                          0 62567 6939 20115 i
 *                    129.250.0.11          1006             0 2914 1299 20115 i
 *                    4.69.184.193             0             0 3356 20115 i
 *                    89.149.178.10           10             0 3257 3356 20115 i
 *                    194.85.40.15                           0 3267 6939 20115 i
 *                    216.218.252.164                        0 6939 20115 i

Let’s look for whois record of this /16 pool: https://whois.arin.net/rest/net/NET-47-32-0-0-1

NetRange: 47.32.0.0 - 47.51.255.255
CIDR: 47.32.0.0/12, 47.48.0.0/14
NetName: CC04
NetHandle: NET-47-32-0-0-1
Parent: NET47 (NET-47-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Charter Communications (CC04)
RegDate: 2014-12-23
Updated: 2014-12-23
Ref: https://whois.arin.net/rest/net/NET-47-32-0-0-1

It seems highly unlikely that this pool has been transferred over to Jio and hence it’s highly likely that Reliance Jio is falsely advertising this pool. Possible reason for such mistake can be because they have got 47.29.0.0/16, 47.30.0.0/16 and 47.31.0.0/16 but beyond that there are few Charter Pools. So likely someone just mistyped an IP. Another possible reason for such mistype can be that they have also got 49.35.0.0/16 (it’s 49, not 47).
What is much more fascinating is that they even have a RADB route object registered for the same.

whois -h whois.radb.net 47.35.0.0
route:      47.35.0.0/16
descr:      Route Set JIO Maharastra LTE USER Pool
origin:     AS55836
notify:     Ip.abuse@ril.com
mnt-by:     MAINT-AS55836
changed:    ip.management@ril.com 20160624
source:     RADB

World of BGP is interesting!

Update:
As per update from Mr Morlay Gosh from Reliance Jio on SANOG mailing list- This was mistake and they are removing the same.
http://article.gmane.org/gmane.org.operators.sanog/2929

Private IPs in Public routing

Sometimes we see interesting IP’s in traceroute & they confuse lot of people.

I have seen this topic in discussion twice on NANOG and once on Linux Delhi user group.

OK – let’s pick an example:

anurag:~ anurag$ traceroute 71.89.140.11
traceroute to 71.89.140.11 (71.89.140.11), 64 hops max, 52 byte packets
1 router (10.10.0.1) 1.176 ms 0.993 ms 0.941 ms
2 117.220.160.1 (117.220.160.1) 20.626 ms 29.101 ms 19.216 ms
3 218.248.169.122 (218.248.169.122) 23.983 ms 43.850 ms 45.057 ms
4 115.114.89.21.static-mumbai.vsnl.net.in (115.114.89.21) 118.094 ms 81.447 ms 66.838 ms
5 172.31.16.193 (172.31.16.193) 115.979 ms 90.947 ms 90.491 ms
6 ix-4-2.tcore1.cxr-chennai.as6453.net (180.87.36.9) 95.778 ms 98.601 ms 98.920 ms
7 if-5-2.tcore1.svw-singapore.as6453.net (180.87.12.53) 321.174 ms
if-3-3.tcore2.cxr-chennai.as6453.net (180.87.36.6) 331.386 ms 326.671 ms
8 if-6-2.tcore2.svw-singapore.as6453.net (180.87.37.14) 317.442 ms
if-2-2.tcore2.svw-singapore.as6453.net (180.87.12.2) 334.647 ms 339.289 ms
9 if-7-2.tcore2.lvw-losangeles.as6453.net (180.87.15.26) 318.003 ms 328.334 ms 309.234 ms
10 if-2-2.tcore1.lvw-losangeles.as6453.net (66.110.59.1) 306.500 ms 326.194 ms 341.537 ms
11 66.110.59.66 (66.110.59.66) 315.431 ms 330.417 ms 308.372 ms
12 dls-bb1-link.telia.net (213.155.136.40) 354.768 ms 344.360 ms 357.050 ms
13 chi-bb1-link.telia.net (80.91.248.208) 352.479 ms 358.751 ms 359.987 ms
14 cco-ic-156108-chi-bb1.c.telia.net (213.248.89.46) 367.467 ms 370.482 ms 377.280 ms
15 bbr01aldlmi-bue-4.aldl.mi.charter.com (96.34.0.98) 387.269 ms 385.362 ms 365.694 ms
16 crr02aldlmi-bue-2.aldl.mi.charter.com (96.34.2.11) 375.275 ms 375.356 ms 371.621 ms
17 dtr02grhvmi-tge-0-1-0-0.grhv.mi.charter.com (96.34.34.83) 383.539 ms 371.817 ms 383.804 ms
18 dtr02whthmi-tge-0-1-0-0.whth.mi.charter.com (96.34.34.85) 384.400 ms 391.197 ms 393.340 ms
19 dtr02ldngmi-tge-0-1-0-0.ldng.mi.charter.com (96.34.34.87) 371.192 ms 375.679 ms 378.457 ms
20 acr01mnplmi-tge-0-0-0-3.mnpl.mi.charter.com (96.34.40.75) 364.824 ms 385.534 ms 374.401 ms
21 * *^C
anurag:~ anurag$

Let’s try pinging IP on 14th hop (which is with a major backbone Telia) – 213.248.89.46

anurag:~ anurag$ ping -c 5 213.248.89.46
PING 213.248.89.46 (213.248.89.46): 56 data bytes
64 bytes from 213.248.89.46: icmp_seq=0 ttl=240 time=517.305 ms
64 bytes from 213.248.89.46: icmp_seq=1 ttl=240 time=329.230 ms
64 bytes from 213.248.89.46: icmp_seq=2 ttl=240 time=324.397 ms
64 bytes from 213.248.89.46: icmp_seq=3 ttl=240 time=331.474 ms
64 bytes from 213.248.89.46: icmp_seq=4 ttl=240 time=326.409 ms

— 213.248.89.46 ping statistics —
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 324.397/365.763/517.305/75.809 ms
anurag:~ anurag$

Works fine!

Game begins here…

Next, let’s try pinging hop 15th IP which is with a major cable company Charter operating in US East – 96.34.0.98

PING 96.34.0.98 (96.34.0.98): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3

— 96.34.0.98 ping statistics —
5 packets transmitted, 0 packets received, 100.0% packet loss
anurag:~ anurag$

So we see some nice timeouts. This confuses lot of people as we can’t have a firewall blocking ICMP packets here since we did had ICMP based traceroute with ICMP replies from 15th hop in last trace.

Let’s try to do a trace to this IP to see where exactly is connection breaking.

anurag:~ anurag$ traceroute -a 96.34.0.98
traceroute to 96.34.0.98 (96.34.0.98), 64 hops max, 52 byte packets
1 [AS65534] router (10.10.0.1) 1.661 ms 0.887 ms 0.934 ms
2 [AS9829] 117.220.160.1 (117.220.160.1) 18.867 ms 31.898 ms 20.931 ms
3 [AS9829] 218.248.169.118 (218.248.169.118) 43.427 ms 22.327 ms 34.790 ms
4 [AS4755] 115.114.89.17.static-mumbai.vsnl.net.in (115.114.89.17) 78.673 ms 79.056 ms 70.441 ms
5 * * *
6 * * *
7 * * *
8 * * *
^C
anurag:~ anurag$

(Surprising?) Well as we see – we can’t go beyond Tata-VSNL AS4755 border router in Mumbai. Why? Let’s ask it’s neighbor upstream router Tata AS6453. Checking route for IP 96.34.0.98 in Tata AS6453 routing table:

show ip bgp 96.34.0.98

Router: gin-mlv-core1
Site: IN, Mumbai, MLV
Command: show ip bgp 96.34.0.98

% Network not in table

This situation is the one this blog post is about! 🙂

What’s bit confusing here is the fact that we are able to reach a destination IP say 71.89.140.11 as taken in this example and middle routers just seem normal but if we try to explicitly reach these middle routers then we don’t see a route.

Why we see no route?

Because there’s just no route. These prefixes are not announced in global routing table via BGP.

So technically no one is announcing any subnet in global IPv4 table which covers address space for 96.34.0.98.

Here’s another major backbone router in US:

route-server>
route-server> sh bgp ipv4 unicast 96.34.0.98
% Network not in table
route-server>

Did someone missed to announce a prefix?

Well, answer is NO!
Everything is just fine in such setup. Basically many providers like Charter (and many ISPs) do not announce address space allocated to their backbone routers which are middle in chain to avoid possibility of packet flooding and possibly some other attacks.

Then how we are getting ICMP replies during initial trace to destination IP?

We get ICMP replies because we just followed chain, and in chain last router before Charter was Telia which is announcing its address space normally and we are able to reach it. Now that specific Telia router is having a BGP session with Charter router (since Charter is their downstream customer network) and that Telia router has multiple broadcast domains. Including the one which takes us to it 213.248.89.46 (coming from BGP announcement for 213.248.64.0/18 from AS1299). The other possible broadcast domain it has is /30 which is used for BGP session with Charter. /30 = 4IP’s. One goes for Telia router, other goes to Charter router, third one becomes broadcast IP and last one lies useless due to Maths. 😉

Hence that specific Telia router has routing table of Charter and knows from which “Physical interface” is the “next hop” to that Charter router and so does and next, next and next till we reach destination router (which is always on a well advertised address space). The same logic pretty much applies on RFC 1918 based private address space too. Like 10.0.0.0/8 or 192.168.0.0/24 etc.

Now as soon as one knows this chain – one can always add static routes in routing table and flood those routers (taking off the reason for not announcing address space). For IXP’s this part is also important – since lot of them use a shared peering VLAN which stays on single broadcast subnet often a /23 or /24. Will discuss more about IX prefix and announcement impacts in my future posts.

So that’s all about it. Have a good week ahead! 🙂

anuragbhatia.com

DNS, BGP, IPv6 and more!

Tag Archives: Charter