Some leaks in China/Hongkong
Mike Leber
mleber at he.net
Sun Oct 26 16:59:38 CET 2008
Several of the parties in the path you list are intentionally preferring
to send traffic to Hong Kong and perhaps being publicly shamed is the
only way to get them to change it.
We are not "leaking full tables" in Hong Kong. We went live in Hong
Kong a few weeks ago and have a few IPv6 customers in Hong Kong,
including some Chinese research and education networks.
The fact that none of the parties involved bothers to have the necessary
transit route to reach that customer prefix in Europe and instead
prefers to use a Chinese university network as their transit of last
resort, is something to ask them not us.
dfn, geant2, or internet2 don't currently get a decent full view
otherwise they wouldn't send traffic to Hong Kong.
Anybody that actually cares about decent routing can fix this in Europe
by either peering with us in Europe, taking IPv6 transit from us
directly in Europe, *or* by turning off their transit provider that has
to use a Chinese University as their upstream transit provider for their
European network. There are a bunch of other decent European IPv6
transit networks that would be happy to sell you service!
For your convenience if you'd like to peer directly, meet us at any of
the following exchanges:
We are AS6939.
NAP Status Speed IPv4 IPv6
--------------- ------- ------- --------------- ------------------------
EQUINIX-ASH UP 10GigE 206.223.115.37 2001:504:0:2::6939:1
EQUINIX-CHI UP 10GigE 206.223.119.37 2001:504:0:4::6939:1
EQUINIX-DAL UP 10GigE 206.223.118.37 2001:504:0:5::6939:1
EQUINIX-LAX UP 10GigE 206.223.123.37 2001:504:0:3::6939:1
EQUINIX-SJC UP 10GigE 206.223.116.37 2001:504:0:1::6939:1
LINX UP 10GigE 195.66.224.21 2001:7f8:4:0::1b1b:1
LoNAP UP GigE 193.203.5.128 2001:7f8:17::1b1b:1
AMS-IX UP 10GigE 195.69.145.150 2001:7f8:1::a500:6939:1
NL-IX UP GigE 193.239.116.14 2001:7f8:13::a500:6939:1
PAIX Palo Alto UP 10GigE 198.32.176.20 2001:504:d::10
PAIX New York UP 10GigE 198.32.118.57 2001:504:f::39
NYIIX UP 10GigE 198.32.160.61 2001:504:1::a500:6939:1
LAIIX UP GigE 198.32.146.50 2001:504:a::a500:6939:1
NYCX UP GigE 198.32.229.22
BIGEAPE UP 100BT 2001:458:26:2::500
SIX UP 10GigE 198.32.180.40 2001:478:180::40
PaNAP UP 10GigE 62.35.254.111 2001:860:0:6::6939:1
DE-CIX UP 10GigE 80.81.192.172 2001:7f8::1b1b:0:1
NOTA UP 10GigE 198.32.124.176 2001:478:124::176
Any2-LAX UP 10GigE 206.223.143.122 2001:504:13:0:0:0:0:1A
HKIX UP GigE 202.40.161.158 2001:7fa:0:1::ca28:a19e
Telx-Atlanta UP 10GigE 198.32.132.75 2001:478:132::75
Mike.
Bernhard Schmidt wrote:
> Hello everyone,
>
> I had a very unpleasant experience when I looked at my RTT monitoring
> this morning.
>
> a)
>
> bschmidt at lxbsc01:~$ traceroute6 -q1 2001:470:0:69::2
> traceroute to 2001:470:0:69::2 (2001:470:0:69::2) from 2001:4ca0:0:f000:211:43ff:fe7e:3a76, port 33434, from port 36641, 30 hops max, 60 bytepackets
> 1 vl-23.csr1-2wr.lrz-muenchen.de (2001:4ca0:0:f000::1) 0.374 ms
> 2 xr-gar1-te1-3-108.x-win.dfn.de (2001:638:c:a003::1) 0.441 ms
> 3 2001:638:c:c043::2 (2001:638:c:c043::2) 8.484 ms
> 4 dfn.rt1.fra.de.geant2.net (2001:798:14:10aa::1) 7.879 ms
> 5 abilene-wash-gw.rt1.fra.de.geant2.net (2001:798:14:10aa::12) 100.643 ms
> 6 so-0-2-0.0.rtr.chic.net.internet2.edu (2001:468:ff:209::2) 117.230 ms
> 7 so-4-3-0.rtr.kans.net.internet2.edu (2001:468:ff:204:8000::2) 127.967 ms
> 8 so-0-0-0.0.rtr.salt.net.internet2.edu (2001:468:ff:407::2) 181.439 ms
> 9 so-0-0-0.0.rtr.seat.net.internet2.edu (2001:468:ff:716::1) 181.476 ms
> 10 kreonet-1-lo-jmb-706.sttlwa.pacificwave.net (2001:504:b:10::6) 169.102 ms
> 11 2001:320:1b00:1::1 (2001:320:1b00:1::1) 283.341 ms
> 12 hurricaneelectric-RGE.hkix.net (2001:7fa:0:1::ca28:a19e) 327.876 ms
> 13 v1026.core1.sjc1.he.net (2001:470:0:c3::1) 331.108 ms
> 14 10gigabitethernet2-1.core1.sjc2.he.net (2001:470:0:55::2) 327.817 ms
> 15 10gigabitethernet1-3.core1.nyc4.he.net (2001:470:0:33::2) 327.861 ms
> 16 10gigabitethernet1-2.core1.lon1.he.net (2001:470:0:3e::2) 327.785 ms
> 17 10gigabitethernet1-1.core1.ams1.he.net (2001:470:0:3f::2) 327.827 ms
> 18 10gigabitethernet1-1.core1.fra1.he.net (2001:470:0:47::2) 327.742 ms
> 19 1g-bge0.tserv6.fra1.ipv6.he.net (2001:470:0:69::2) 328.126 ms
>
> 680 20965 11537 17579 4635 6939
> 2001:638:C:A003::1 from 2001:638:C:A003::1 (188.1.200.38)
> Origin IGP, localpref 90, valid, external, best
> Community: 680:77 11537:2501 12816:2100 12816:2110 20965:11537
>
> This, apparently new or newly leaking, peering between AS4635 and AS6939
> affects about 200 prefixes that are detoured through Hongkong for all
> users behind 20965 (the european REN, comparable to I2) or 11537 (I2).
> So, I guess, a not-too-small two-digit slice of the current IPv6 users.
>
> b)
>
> bschmidt at lxbsc01:~$ traceroute6 -q1 ipv6.google.com
> traceroute to ipv6.google.com (2001:4860:0:1001::68) from 2001:4ca0:0:f000:211:43ff:fe7e:3a76, port 33434, from port 34321, 30 hops max, 60 byte packets
> 1 vl-23.csr1-2wr.lrz-muenchen.de (2001:4ca0:0:f000::1) 0.384 ms
> 2 xr-gar1-te1-3-108.x-win.dfn.de (2001:638:c:a003::1) 0.482 ms
> 3 2001:638:c:c043::2 (2001:638:c:c043::2) 8.283 ms
> 4 dfn.rt1.fra.de.geant2.net (2001:798:14:10aa::1) 7.876 ms
> 5 abilene-wash-gw.rt1.fra.de.geant2.net (2001:798:14:10aa::12) 100.596 ms
> 6 so-0-2-0.0.rtr.chic.net.internet2.edu (2001:468:ff:209::2) 117.203 ms
> 7 so-4-3-0.rtr.kans.net.internet2.edu (2001:468:ff:204:8000::2) 127.765 ms
> 8 so-0-0-0.0.rtr.salt.net.internet2.edu (2001:468:ff:407::2) 181.408 ms
> 9 so-0-0-0.0.rtr.seat.net.internet2.edu (2001:468:ff:716::1) 181.495 ms
> 10 kreonet-1-lo-jmb-706.sttlwa.pacificwave.net (2001:504:b:10::6) 169.117 ms
> 11 2001:320:1b00:1::1 (2001:320:1b00:1::1) 283.376 ms
> 12 2001:320:8300:30::11 (2001:320:8300:30::11) 274.199 ms
> 13 2001:252:0:101::2 (2001:252:0:101::2) 300.406 ms
> 14 *
> 15 *
> 16 2001:4860:0:1001::68 (2001:4860:0:1001::68) 348.676 ms
>
> 680 20965 11537 17579 23911 15169, (aggregated by 15169 64.233.175.244)
> 2001:638:C:A003::1 from 2001:638:C:A003::1 (188.1.200.38)
> Origin IGP, localpref 90, valid, external, best
> Community: 680:77 11537:2501 12816:2100 12816:2110 20965:11537
>
> again, affects all users in GEANT2 and I2.
>
> AS4635 has a very bad reputation regarding leaking fulltables where they
> don't belong, AS17579 has not been a saint either. Additionally, these
> problems are very much amplified by the current policy of most RENs to
> prefer (through localpref) their fellow RENs and tag their prefixes
> accordingly. As soon as someone does this on an unfiltered link, as
> Abilene does for Kreonet, it creates havoc.
>
> In this case, 680 has direct peering with both 6939 and 15169, so I
> would not have seen anything without these localpref games. And both
> GEANT2 and I2 should see 6939 and 15169 through at most one transit ASN.
>
> No wonder people are reluctant to use IPv6 for serious production use if
> we can't fix those problems for good. Thankfully I could fix it for our
> users by depreffing those paths and switching to our commercial (backup)
> transit, but that's far from optimal.
>
> Regards,
> Bernhard
--
+---------------- H U R R I C A N E - E L E C T R I C ----------------+
| Mike Leber Wholesale IPv4 and IPv6 Transit 510 580 4100 |
| Hurricane Electric AS6939 |
| mleber at he.net Internet Backbone & Colocation http://he.net |
+---------------------------------------------------------------------+
More information about the ipv6-ops
mailing list