SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment? - swinog

List overview All Threads
Download

newer

SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

older

please unsuscribe me

RIPE NCC Survey 2019

Fredy Kuenzler

9 Jun 2019 9 Jun '19

1:22 p.m.

https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...

-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur Switzerland

http://www.init7.net/

Attachments:

attachment.html (text/html — 622 bytes)

Show replies by date

Andreas Fink

9 Jun 9 Jun

1:32 p.m.

New subject: SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

Interesting thas this happens at times where a certain bloody event in china has its 30th birthday. Could well be a coincident to see how the world deals with it or an attempt to censor it outside of china. ... or it might just be a stupid engineer's mistake...

...

On 9 Jun 2019, at 13:22, Fredy Kuenzler kuenzler@init7.net wrote:

https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-... https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-through-china-telecom/

-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur Switzerland

http://www.init7.net/ http://www.init7.net/

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

Rainer Duffner

1:59 p.m.

New subject: SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

...

Am 09.06.2019 um 13:32 schrieb Andreas Fink afink@list.fink.org:

Interesting thas this happens at times where a certain bloody event in china has its 30th birthday. Could well be a coincident to see how the world deals with it or an attempt to censor it outside of china. ... or it might just be a stupid engineer's mistake...

Coincidence?

https://www.safehost.com/en/news/335-safe-host-china-telecom-announce-strate...

Steven Glogger

6:20 p.m.

New subject: SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

...

Coincidence?

https://www.safehost.com/en/news/335-safe-host-china-telecom-announce-strate...

23.02.2017 till now? :)

greetings

-steven

Job Snijders

1:40 p.m.

New subject: SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

And they have yet to explain how this could happen. I tried calling their NOC but they didn’t pick up the phone :-(

https://twitter.com/swisscolo/status/1136980918227341312?s=21

Kind regards,

Job

On Sun, Jun 9, 2019 at 7:25 Fredy Kuenzler kuenzler@init7.net wrote:

...

https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...

-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g CH-8406 Winterthur https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g Switzerland https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g

http://www.init7.net/

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

Robert.Guentensperger＠swisscom.com

1:47 p.m.

New subject: SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

Hi,

Nobody of us made ever a typo...

Here is a good article: https://blogs.oracle.com/internetintelligence/large-european-routing-leak-se...

Cheers, Günti

Am 09.06.2019 um 13:43 schrieb Job Snijders <job@ntt.netmailto:job@ntt.net>:

And they have yet to explain how this could happen. I tried calling their NOC but they didn’t pick up the phone :-(

https://twitter.com/swisscolo/status/1136980918227341312?s=21

Kind regards,

Job

On Sun, Jun 9, 2019 at 7:25 Fredy Kuenzler <kuenzler@init7.netmailto:kuenzler@init7.net> wrote: https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...

-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g CH-8406 Winterthurhttps://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g Switzerlandhttps://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g

http://www.init7.net/

_______________________________________________ swinog mailing list swinog@lists.swinog.chmailto:swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

Job Snijders

1:56 p.m.

New subject: SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

Yes, we all make errors. However, a number of the leaked routes don’t exist in the DFZ, so they were either generated or picked up some place special. I’d like to learn from this incident to see if we can protect ourselves better.

If this was a typo, I’d like them to confirm. If it was a software defect, I’d also like to know.

On Sun, Jun 9, 2019 at 7:47 Robert.Guentensperger@swisscom.com wrote:

...

Hi,

Nobody of us made ever a typo...

Here is a good article:

https://blogs.oracle.com/internetintelligence/large-european-routing-leak-se...

Cheers, Günti

Am 09.06.2019 um 13:43 schrieb Job Snijders job@ntt.net:

And they have yet to explain how this could happen. I tried calling their NOC but they didn’t pick up the phone :-(

https://twitter.com/swisscolo/status/1136980918227341312?s=21

Kind regards,

Job

On Sun, Jun 9, 2019 at 7:25 Fredy Kuenzler kuenzler@init7.net wrote:

...
https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...

https://www.google.com/maps/search/Technoparkstrasse+5+%0D%0A+CH-8406+Winterthur+%0D%0A+Switzerland?entry=gmail&source=g

https://www.google.com/maps/search/Technoparkstrasse+5+%0D%0A+CH-8406+Winterthur+%0D%0A+Switzerland?entry=gmail&source=g Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g CH-8406 Winterthur https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g Switzerland https://www.google.com/maps/search/Technoparkstrasse+5+CH-8406+Winterthur+Switzerland?entry=gmail&source=g

http://www.init7.net/

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

Gert Doering

4:22 p.m.

New subject: SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

Hi,

On Sun, Jun 09, 2019 at 11:47:19AM +0000, Robert.Guentensperger@swisscom.com wrote:

...

Nobody of us made ever a typo...

This is why peers and upstreams have security mechanisms in place... like max-pfx on peers, and strict prefix filters on downstreams.

We all have that, of course... have we?

Gert Doering -- NetMaster

-- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

Will van Gulik

6:20 p.m.

New subject: SafeHost AS21217 accused to leak routes for two hours to China Telecom AS4134 - anyone from SafeHost to comment?

Hi Fredy and list,

Interesting one, I'm not aware that SafeHost's noc is around on the list. Also, from what I see Safehost doesn't peer anywhere, so that looks more like route manipulaiton , like someone injecting a route that looks that it's from AS21217 . Or worse, overly fat fingers or routing optimization tools.

We have something to look at during our rainy long week end ;)

Will

On Sun, Jun 09, 2019 at 07:22:52AM -0400, Fredy Kuenzler wrote:

...

https://blog.apnic.net/2019/06/07/large-european-routing-leak-sends-traffic-...

-- Fredy Kuenzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur Switzerland

http://www.init7.net/

...

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

1782

Age (days ago)

1782

Last active (days ago)

swinog@lists.swinog.ch

8 comments

8 participants

tags (0)

participants (8)

Andreas Fink
Fredy Kuenzler
Gert Doering
Job Snijders
Rainer Duffner
Robert.Guentensperger＠swisscom.com
Steven Glogger
Will van Gulik