[atnog] Massive prefix hijack by AS4788

Jürgen Jaritsch jj at anexia.at
Fri Jun 12 19:02:07 CEST 2015 

Ja, ging dann ja recht flott ... War übrigens kein "anschwärzen" sondern war als Auflistung zu verstehen über wen wir die Probleme zu dem Zeitpunkt gesehen haben ...

Highwinds hats wohl besonders schlimm getroffen weil die auch gleich den AMS-IX Link verloren haben (Level3 L2 circuit outage) - Brennercom hatte das gleiche Problem am DE-CIX.

Offizielle Rückmeldung von Level3:

###
Level 3's network, alongside some other ISP's, experienced service disruptions affecting customers in Europe, Asia and multiple other markets. IP, Voice and Content Delivery Network (CDN) services were affected for Level 3. The root cause of the issue was isolated to a third party Internet Service Provider in Asia that leaked internet routes resulting in traffic being sent to a destination that could not route them, which affected IP, Voice and CDN services in multiple markets. The issue has been resolved, but the provider continues working to determine the specific root cause of the incident. At this time, customer services are restored with the exception of any that pose any possible risk to the Level 3 network. Maintaining a reliable, high-performing network for our customers is our top priority. Level 3 will continue to work with the provider to prevent a recurrence.
###

Viele Grüße


Jürgen Jaritsch
Head of Network & Infrastructure

ANEXIA Internetdienstleistungs GmbH

Telefon: +43-5-0556-300
Telefax: +43-5-0556-500

E-Mail: jj at anexia.at
Web: http://www.anexia.at

Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt
Geschäftsführer: Alexander Windbichler
Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601


-----Original Message-----
From: Kaiser, Karl [karl.kaiser at upc.at]
Received: Freitag, 12 Juni 2015, 16:18
To: atnog at atnog.at [atnog at atnog.at]
CC: Jürgen Jaritsch [jj at anexia.at]
Subject: RE: Massive prefix hijack by AS4788

also bei uns ists inzwischen wieder ruhig geworden
sie kündigen auch nichts mehr neues an
ich habe derzeit 1832 von dort.

[cid:image001.png at 01D0A52B.76238340]

From: atnog-bounces at atnog.at [mailto:atnog-bounces at atnog.at] On Behalf Of Jürgen Jaritsch
Sent: Freitag, 12. Juni 2015 13:03
To: atnog at atnog.at
Subject: Re: [atnog] Massive prefix hijack by AS4788

Falls jemand nicht auf NANOG liest: http://mailman.nanog.org/pipermail/nanog/2015-June/076187.html




Jürgen Jaritsch
Head of Network & Infrastructure

ANEXIA Internetdienstleistungs GmbH

Telefon: +43-5-0556-300
Telefax: +43-5-0556-500

E-Mail: jj at anexia.at<mailto:jj at anexia.at>
Web: http://www.anexia.at<http://www.anexia.at/>

Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt
Geschäftsführer: Alexander Windbichler
Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

Von: Jürgen Jaritsch
Gesendet: Freitag, 12. Juni 2015 12:42
An: Jürgen Jaritsch; atnog at atnog.at<mailto:atnog at atnog.at>
Betreff: AW: Massive prefix hijack by AS4788

PS: für diejenigen unter euch, die keinen Zugriff auf das Level3 Ticket-System haben:

Network Event Detail
Network Event Summary:

An unknown issue throughout the United Kingdom is impacting Voice and IP services.

Event Ticket ID:

9340339

Market Area Affected:

Multiple Markets

Ticket Create Date:

6/12/15 9:43:21 AM GMT

Impacted For:

1 hour 51 minutes

Event Status:

Active

Resolve Date:



Time Since Last Update:

51 minutes

There are currently no reported impacts to your services caused by this network event. If you are experiencing a service disruption, please report the issue to Level 3 by submitting a ticket via the MyLevel3 Portal or calling 877-4LEVEL3.

Recent Notes
Date

Notes

6/12/15 9:49:05 AM GMT

The European NOC has advised that an unknown issue throughout the United Kingdom is impacting IP and Voice services in multiple markets. The European NOC is currently investigating to obtain more information about the issue. Further updates will be provided as information becomes available.




Network Event Detail
Network Event Summary:

Routing issues across the network in multiple markets globally are impacting IP services.

Event Ticket ID:

9340550

Market Area Affected:

Multiple Markets Globally

Ticket Create Date:

6/12/15 9:58:36 AM GMT

Impacted For:

1 hour 57 minutes

Event Status:

Active

Resolve Date:



Time Since Last Update:

5 minutes

There are currently no reported impacts to your services caused by this network event. If you are experiencing a service disruption, please report the issue to Level 3 by submitting a ticket via the MyLevel3 Portal or calling 877-4LEVEL3.

Recent Notes
Date

Notes

6/12/15 10:35:27 AM GMT

The European NOC has advised that some services are beginning to restore. Investigations continue to determine a root cause.

6/12/15 10:06:05 AM GMT

The IP NOC is investigating routing issues in Multiple Markets across the network globally that are impacting IP services. Troubleshooting efforts are currently ongoing with no estimated time to restore services available at this point. Please be advised that updates for this event will be relayed every half an hour unless otherwise noted.






Jürgen Jaritsch
Head of Network & Infrastructure

ANEXIA Internetdienstleistungs GmbH

Telefon: +43-5-0556-300
Telefax: +43-5-0556-500

E-Mail: jj at anexia.at<mailto:jj at anexia.at>
Web: http://www.anexia.at<http://www.anexia.at/>

Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt
Geschäftsführer: Alexander Windbichler
Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

Von: atnog-bounces at atnog.at<mailto:atnog-bounces at atnog.at> [mailto:atnog-bounces at atnog.at] Im Auftrag von Jürgen Jaritsch
Gesendet: Freitag, 12. Juni 2015 12:40
An: atnog at atnog.at<mailto:atnog at atnog.at>
Betreff: [atnog] Massive prefix hijack by AS4788

Servus die Runde,

wäre mal interessant zu wissen wer die derzeitigen Probleme registriert und selbst aktiv Re-Routen muss :).

Was wir wissen:

#) AS4788 startet route leak
#) GBLX importiert alle Routen ungefiltert von AS4788
#) Level3 importiert alle Routen von GBLX und re-exportiert ungefiltert

Somit sind Provider wie Highwinds, Seabone, DTAG, PCCW, UPC und Co seit ca 10:30 ziemlich unter Druck den Traffic umzurouten.

Der "Shitstorm" auf Twitter nimmt im Moment auch kein Ende:

https://twitter.com/hashtag/level3?src=hash
https://twitter.com/hashtag/outage?src=hash
https://twitter.com/hashtag/internet?src=hash



Viele Grüße

Jürgen Jaritsch
Head of Network & Infrastructure

ANEXIA Internetdienstleistungs GmbH

Telefon: +43-5-0556-300
Telefax: +43-5-0556-500

E-Mail: jj at anexia.at<mailto:jj at anexia.at>
Web: http://www.anexia.at<http://www.anexia.at/>

Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt
Geschäftsführer: Alexander Windbichler
Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

________________________________

eMail ist virenfrei.
Von AVG überprüft - www.avg.de<http://www.avg.de>
Version: 10.0.1434 / Virendatenbank: 4311/9499 - Ausgabedatum: 12.06.2015

Information pursuant to paragraph 14 Austrian Companies Code: UPC Austria GmbH, Registered Office: Wolfganggasse 58-60, 1120 Vienna, Company Register Number: FN 251865s at the Commercial Court of Vienna.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://atnog.at/pipermail/atnog/attachments/20150612/bb32d662/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 15316 bytes
Desc: image001.png
URL: <http://atnog.at/pipermail/atnog/attachments/20150612/bb32d662/attachment-0001.png>

More information about the atnog mailing list