SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?
https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...
-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur Switzerland
Interesting thas this happens at times where a certain bloody event in china has its 30th birthday. Could well be a coincident to see how the world deals with it or an attempt to censor it outside of china. ... or it might just be a stupid engineer's mistake...
On 9 Jun 2019, at 13:22, Fredy Kuenzler kuenzler@init7.net wrote:
https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-... https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-through-china-telecom/
-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur Switzerland
http://www.init7.net/ http://www.init7.net/
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
Am 09.06.2019 um 13:32 schrieb Andreas Fink afink@list.fink.org:
Interesting thas this happens at times where a certain bloody event in china has its 30th birthday. Could well be a coincident to see how the world deals with it or an attempt to censor it outside of china. ... or it might just be a stupid engineer's mistake...
Coincidence?
https://www.safehost.com/en/news/335-safe-host-china-telecom-announce-strate...
Coincidence?
https://www.safehost.com/en/news/335-safe-host-china-telecom-announce-strate...
23.02.2017 till now? :)
greetings
-steven
And they have yet to explain how this could happen. I tried calling their NOC but they didn’t pick up the phone :-(
https://twitter.com/swisscolo/status/1136980918227341312?s=21
Kind regards,
Job
On Sun, Jun 9, 2019 at 7:25 Fredy Kuenzler kuenzler@init7.net wrote:
https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...
-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g CH-8406 Winterthur https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g Switzerland https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
Hi,
Nobody of us made ever a typo...
Here is a good article: https://blogs.oracle.com/internetintelligence/large-european-routing-leak-se...
Cheers, Günti
Am 09.06.2019 um 13:43 schrieb Job Snijders <job@ntt.netmailto:job@ntt.net>:
And they have yet to explain how this could happen. I tried calling their NOC but they didn’t pick up the phone :-(
https://twitter.com/swisscolo/status/1136980918227341312?s=21
Kind regards,
Job
On Sun, Jun 9, 2019 at 7:25 Fredy Kuenzler <kuenzler@init7.netmailto:kuenzler@init7.net> wrote: https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...
-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g CH-8406 Winterthurhttps://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g Switzerlandhttps://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g
_______________________________________________ swinog mailing list swinog@lists.swinog.chmailto:swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
_______________________________________________ swinog mailing list swinog@lists.swinog.chmailto:swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
Yes, we all make errors. However, a number of the leaked routes don’t exist in the DFZ, so they were either generated or picked up some place special. I’d like to learn from this incident to see if we can protect ourselves better.
If this was a typo, I’d like them to confirm. If it was a software defect, I’d also like to know.
On Sun, Jun 9, 2019 at 7:47 Robert.Guentensperger@swisscom.com wrote:
Hi,
Nobody of us made ever a typo...
Here is a good article:
https://blogs.oracle.com/internetintelligence/large-european-routing-leak-se...
Cheers, Günti
Am 09.06.2019 um 13:43 schrieb Job Snijders job@ntt.net:
And they have yet to explain how this could happen. I tried calling their NOC but they didn’t pick up the phone :-(
https://twitter.com/swisscolo/status/1136980918227341312?s=21
Kind regards,
Job
On Sun, Jun 9, 2019 at 7:25 Fredy Kuenzler kuenzler@init7.net wrote:
https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...
https://www.google.com/maps/search/Technoparkstrasse+5+%0D%0A+CH-8406+Winterthur+%0D%0A+Switzerland?entry=gmail&source=g
https://www.google.com/maps/search/Technoparkstrasse+5+%0D%0A+CH-8406+Winterthur+%0D%0A+Switzerland?entry=gmail&source=g Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g CH-8406 Winterthur https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g Switzerland https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
Hi,
On Sun, Jun 09, 2019 at 11:47:19AM +0000, Robert.Guentensperger@swisscom.com wrote:
Nobody of us made ever a typo...
This is why peers and upstreams have security mechanisms in place... like max-pfx on peers, and strict prefix filters on downstreams.
We all have that, of course... have we?
Gert Doering -- NetMaster
Hi Fredy and list,
Interesting one, I'm not aware that SafeHost's noc is around on the list. Also, from what I see Safehost doesn't peer anywhere, so that looks more like route manipulaiton , like someone injecting a route that looks that it's from AS21217 . Or worse, overly fat fingers or routing optimization tools.
We have something to look at during our rainy long week end ;)
Will
On Sun, Jun 09, 2019 at 07:22:52AM -0400, Fredy Kuenzler wrote:
https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...
-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur Switzerland
swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog
-
Andreas Fink -
Fredy Kuenzler -
Gert Doering -
Job Snijders -
Rainer Duffner -
Robert.Guentensperger＠swisscom.com -
Steven Glogger -
Will van Gulik