On 2013-09-26 15:01 , Fredy Kuenzler wrote:

Am 26.09.2013 12:33, schrieb Jeroen Massar:

...

...

Anyone else seeing this... do we have a new peering spat or is it just a random routing issue?

Looks to be just that prefix, as for instance:

Actually we've seen more than 300 prefixes with the same path.

Then I took a lucky path which worked ;)

Meanwhile the journey to california and back is history.

Good. It is always a bit surprising indeed to see when those problems happen.

Apparently there was just a BGP session down between L3(GBLX) and UPC. Not much n+1, though...

Not everybody gets that right, they learn though after a while ;)

Nevermind and sorry for the noise.

I would definitely say Signal as it covered a problem affecting the Internet in Switzerland which likely affected quite a few people on the list and possibly more importantly their users.

Noise would have been "Sudan is broken"

Greets, Jeroen

Hi

Ccom helpdesk won't help you, because they don't even know what routing is... You need to send routing related things to peering@aorta.netmailto:peering@aorta.net

remarks: Peering Requests: peering@aorta.net remarks: Routing Issues: peering@aorta.net

Freundliche Grüsse

Matias Meier Online WebToolbox: www.webtoolbox.chhttp://www.webtoolbox.ch/

Von: swinog-bounces@lists.swinog.ch [mailto:swinog-bounces@lists.swinog.ch] Im Auftrag von Stephan Wolf Gesendet: Donnerstag, 26. September 2013 15:47 An: swinog Betreff: Re: [swinog] Scenic route of the day: L3 towards UPC

I have seen things here similar to this very often / permanently:

cablecom to UK/NL often via level3 and washington instead going directly may something to do with UPC and partnership with level3 - and the "Nonpartners" of level3. "we do not peer with you" politics ?!

imho cogent vs level3 below a trace to system in london from cablecom home:

2 9 ms 17 ms 7 ms x.dclient.hispeed.chhttp://x.dclient.hispeed.ch [x] 3 10 ms 11 ms 10 ms 217-168-58-101.static.cablecom.chhttp://217-168-58-101.static.cablecom.ch [217.168.58.101] 4 111 ms 101 ms 101 ms 84.116.211.22 5 101 ms 183 ms 102 ms 84.116.204.225 6 102 ms 101 ms 101 ms 84-116-130-181.aorta.nethttp://84-116-130-181.aorta.net [84.116.130.181] 7 102 ms 101 ms 101 ms 84.116.133.185 8 101 ms 101 ms 110 ms 84.116.134.62 9 110 ms 107 ms 158 ms te-4-1.car3.Washington1.Level3.nethttp://te-4-1.car3.Washington1.Level3.net [4.79.168.201] 10 * 110 ms 117 ms ae-3-80.edge3.Washington4.Level3.nethttp://ae-3-80.edge3.Washington4.Level3.net [4.69.149.146] 11 108 ms 107 ms 109 ms Cogent-level3-1x10G.washington.Level3.nethttp://Cogent-level3-1x10G.washington.Level3.net [4.68.63.174] 12 149 ms 109 ms 109 ms be2113.mpd21.dca01.atlas.cogentco.comhttp://be2113.mpd21.dca01.atlas.cogentco.com [154.54.6.170] 13 111 ms 174 ms 107 ms te0-0-0-20.ccr21.jfk02.atlas.cogentco.comhttp://te0-0-0-20.ccr21.jfk02.atlas.cogentco.com [154.54.42.22] 14 180 ms 179 ms 191 ms te0-2-0-2.mpd22.lon13.atlas.cogentco.comhttp://te0-2-0-2.mpd22.lon13.atlas.cogentco.com [154.54.42.54] 15 200 ms 179 ms 193 ms te0-7-0-30.ccr21.lon01.atlas.cogentco.comhttp://te0-7-0-30.ccr21.lon01.atlas.cogentco.com [130.117.0.117] 16 215 ms 232 ms 192 ms te2-1.ccr01.lon18.atlas.cogentco.comhttp://te2-1.ccr01.lon18.atlas.cogentco.com [154.54.61.214] 17 190 ms 191 ms 183 ms 149.14.8.34 18 179 ms 179 ms 180 ms y tried multiple times to escalate this in ccom helpdesk. was silted there......

2013/9/26 Fredy Kuenzler <kuenzler@init7.netmailto:kuenzler@init7.net> Anyone else seeing this... do we have a new peering spat or is it just a random routing issue?

Regards, Fredy

traceroute to 84.116.204.234 (84.116.204.234), 30 hops max, 60 byte packets 1 r1zlz1.core.init7.nethttp://r1zlz1.core.init7.net (77.109.136.233) [AS13030] 23.682 ms 23.741 ms 23.775 ms 2 r1zrh1.core.init7.nethttp://r1zrh1.core.init7.net (77.109.128.209) [AS13030] 0.188 ms r1zrh2.core.init7.nethttp://r1zrh2.core.init7.net (77.109.128.74) [AS13030] 0.199 ms r1zrh1.core.init7.nethttp://r1zrh1.core.init7.net (77.109.128.209) [AS13030] 0.193 ms 3 r1bas1.core.init7.nethttp://r1bas1.core.init7.net (77.109.128.130) [AS13030] 1.090 ms 1.129 ms r1fra1.core.init7.nethttp://r1fra1.core.init7.net (77.109.128.250) [AS13030] 38.806 ms 4 r1fra2.core.init7.nethttp://r1fra2.core.init7.net (77.109.128.133) [AS13030] 5.997 ms 5.988 ms 6.016 ms 5 TenGigabitEthernet8-1.ar2.FRA4.gblx.nethttp://TenGigabitEthernet8-1.ar2.FRA4.gblx.net (64.213.54.33) [AS3549] 6.653 ms 6.134 ms 6.673 ms 6 ae7.edge2.SanJose3.level3.nethttp://ae7.edge2.SanJose3.level3.net (4.68.62.177) [AS3356] 153.420 ms 152.925 ms 153.399 ms 7 vlan70.csw2.SanJose1.Level3.nethttp://vlan70.csw2.SanJose1.Level3.net (4.69.152.126) [AS3356] 161.564 ms vlan90.csw4.SanJose1.Level3.nethttp://vlan90.csw4.SanJose1.Level3.net (4.69.152.254) [AS3356] 161.054 ms vlan70.csw2.SanJose1.Level3.nethttp://vlan70.csw2.SanJose1.Level3.net (4.69.152.126) [AS3356] 161.807 ms 8 ae-71-71.ebr1.SanJose1.Level3.nethttp://ae-71-71.ebr1.SanJose1.Level3.net (4.69.153.5) [AS3356] 160.948 ms ae-61-61.ebr1.SanJose1.Level3.nethttp://ae-61-61.ebr1.SanJose1.Level3.net (4.69.153.1) [AS3356] 160.512 ms 160.433 ms 9 ae-2-2.ebr2.NewYork1.Level3.nethttp://ae-2-2.ebr2.NewYork1.Level3.net (4.69.135.186) [AS3356] 161.355 ms 161.310 ms 161.509 ms 10 ae-47-47.ebr2.NewYork2.Level3.nethttp://ae-47-47.ebr2.NewYork2.Level3.net (4.69.201.34) [AS3356] 161.949 ms 4.69.201.38 (4.69.201.38) [AS3356] 161.581 ms 161.724 ms 11 ae-1-100.ebr1.NewYork2.Level3.nethttp://ae-1-100.ebr1.NewYork2.Level3.net (4.69.135.253) [AS3356] 162.124 ms 161.121 ms 161.658 ms 12 4.69.201.85 (4.69.201.85) [AS3356] 161.126 ms 4.69.201.93 (4.69.201.93) [AS3356] 161.524 ms 4.69.201.85 (4.69.201.85) [AS3356] 161.193 ms 13 ae-72-72.csw2.Washington1.Level3.nethttp://ae-72-72.csw2.Washington1.Level3.net (4.69.134.150) [AS3356] 161.151 ms 161.558 ms ae-82-82.csw3.Washington1.Level3.nethttp://ae-82-82.csw3.Washington1.Level3.net (4.69.134.154) [AS3356] 161.627 ms 14 ae-33-80.car3.Washington1.Level3.nethttp://ae-33-80.car3.Washington1.Level3.net (4.69.149.133) [AS3356] 185.388 ms ae-43-90.car3.Washington1.Level3.nethttp://ae-43-90.car3.Washington1.Level3.net (4.69.149.197) [AS3356] 263.449 ms ae-23-70.car3.Washington1.Level3.nethttp://ae-23-70.car3.Washington1.Level3.net (4.69.149.69) [AS3356] 264.054 ms 15 UPC-BROADBA.car3.Washington1.Level3.nethttp://UPC-BROADBA.car3.Washington1.Level3.net (4.79.168.202) [AS3356] 161.118 ms 161.109 ms 160.838 ms 16 84.116.134.61 (84.116.134.61) [AS6830] 167.752 ms 167.674 ms 159.751 ms 17 at-vie15a-ra1-xe-2-2-0.aorta.nethttp://at-vie15a-ra1-xe-2-2-0.aorta.net (84.116.130.245) [AS6830] 160.584 ms 161.327 ms 84-116-130-62.aorta.nethttp://84-116-130-62.aorta.net (84.116.130.62) [AS6830] 160.749 ms 18 hu-bud02a-ra3-xe-1-1-0.aorta.nethttp://hu-bud02a-ra3-xe-1-1-0.aorta.net (84.116.130.194) [AS6830] 161.284 ms 160.877 ms ch-zrh02a-ra1-xe-2-0-0.aorta.nethttp://ch-zrh02a-ra1-xe-2-0-0.aorta.net (84.116.130.226) [AS6830] 160.285 ms 19 84.116.204.234 (84.116.204.234) [AS6830] 160.346 ms 160.831 ms 160.272 ms

-- Fredy Kuenzler

Init7 (Switzerland) Ltd. AS13030 St. Georgen-Strasse 70 CH-8400 Winterthur Skype: flyingpotato Phone: +41 44 315 4400tel:%2B41%2044%20315%204400 Fax: +41 44 315 4401tel:%2B41%2044%20315%204401 Twitter: @init7 / @kuenzler http://www.init7.net/

_______________________________________________ swinog mailing list swinog@lists.swinog.chmailto:swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

On 2013-09-26 16:07 , Andreas Fink wrote:

...or modify your webservers to not deliver web content on such routes to avoid PRISM and inform the customer about the "shortcut" of his switzerland to switzerland data over NSA territory...

Don't worry about that, they don't need to pull that trick.

For most countries a foreign agency only has to file the right paperwork or pull the right strings to get to the data they want.

In this case Cablecom / UPC is part of Liberty Global, which is a UK company hence they fall completely under UK law which has very "nice" exchange procedures with other countries. Next to that LGI can't afford not to do business in the US, hence they can easily be coerced to comply.

Please note that this goes for anything as long as you still want to do business with that organization/country/secretsetup.

The time for paranoia has long been overrated; if you want to be 'secure', you need to do proper crypto (read: not the stuff fed to you that you can't verify). Easier to just let it be...

Greets, Jeroen