Strange Network routing via Virgin Media

[#1]

One of our work networks is routing a very strange way from PlusNet connections - this may be an issue that someone with BGP networks needs to look into....

Our ASN (44052) has a subnet 195.2.224.0/24 attached to it; this router advertises itself via Entanet and IXreach and has IP addresses 188.39.202.154 and 31.217.134.34 respectively from those ISPs - trace routes to those IP addresses look reasonable.

alan-mbp:~ alanramsay$ traceroute -I 188.39.202.154
traceroute to 188.39.202.154 (188.39.202.154), 64 hops max, 72 byte packets
 1  nat (172.16.10.1)  5.767 ms  3.174 ms  1.931 ms
 2  410.xe-2-2-0.central10.pcn-bng02.plus.net (84.93.253.72)  17.874 ms  17.056 ms  14.640 ms
 3  411.be6.pcn-ir02.plus.net (84.93.253.79)  17.152 ms  14.379 ms  17.687 ms
 4  195.99.125.144 (195.99.125.144)  14.960 ms  17.165 ms  14.512 ms
 5  peer1-et-10-3-0.telehouse.ukcore.bt.net (62.172.103.17)  18.485 ms  16.459 ms  14.942 ms
 6  * * *
 7  te0-2-0-3.interxion3.core.enta.net (188.39.127.172)  18.420 ms  18.229 ms  17.572 ms
 8  te0-0-2-0.miltonkeynes.core.enta.net (188.39.127.209)  19.556 ms  18.382 ms  20.486 ms
 9  te0-0-0-1.birmingham-te.core.enta.net (188.39.127.212)  22.215 ms  30.097 ms  21.483 ms
10  te0-0-0-2.wolv-te.core.enta.net (188.39.127.217)  22.330 ms  25.702 ms  21.107 ms
11  188-39-202-154.static.enta.net (188.39.202.154)  20.173 ms  21.385 ms  20.329 ms
alan-mbp:~ alanramsay$ 
alan-mbp:~ alanramsay$ 
alan-mbp:~ alanramsay$ traceroute -I 31.217.134.34
traceroute to 31.217.134.34 (31.217.134.34), 64 hops max, 72 byte packets
 1  nat (172.16.10.1)  5.455 ms  2.448 ms  2.362 ms
 2  410.xe-2-2-0.central10.pcn-bng02.plus.net (84.93.253.72)  16.839 ms  14.814 ms  14.290 ms
 3  411.be6.pcn-ir01.plus.net (84.93.253.75)  15.082 ms  15.229 ms  15.825 ms
 4  195.99.125.136 (195.99.125.136)  15.509 ms  15.857 ms  16.325 ms
 5  62.172.103.49 (62.172.103.49)  41.430 ms  17.144 ms  15.461 ms
 6  * * *
 7  31.217.134.34 (31.217.134.34)  24.338 ms  21.765 ms  21.651 ms
alan-mbp:~ alanramsay$ 

Now the router advertises one of our /24's - 195.2.224.0/24 and this router has an IP of 195.2.224.253 - this is where things start to get a little strange - instead of traffic leaving PlusNet / BT's network and going directly to either EntaNet or IXreach as before, traffic is now sent via Virgin Media:

alan-mbp:~ alanramsay$ traceroute -I 195.2.224.253
traceroute to 195.2.224.253 (195.2.224.253), 64 hops max, 72 byte packets
 1  nat (172.16.10.1)  4.343 ms  2.126 ms  5.047 ms
 2  410.xe-2-2-0.central10.pcn-bng02.plus.net (84.93.253.72)  17.572 ms  16.744 ms  13.716 ms
 3  411.be6.pcn-ir02.plus.net (84.93.253.79)  19.078 ms  18.111 ms  15.559 ms
 4  195.99.125.140 (195.99.125.140)  15.161 ms  15.049 ms  15.472 ms
 5  peer2-et-1-1-0.redbus.ukcore.bt.net (62.172.103.45)  15.296 ms  15.722 ms  17.498 ms
 6  194.74.65.22 (194.74.65.22)  22.802 ms  27.988 ms  23.007 ms
 7  * * *
 8  * * *
 9  * * *
10  tcl5-ic-5-ae0-0.network.virginmedia.net (62.254.84.66)  28.122 ms  23.156 ms  24.506 ms
11  * * *
12  te0-2-0-3.interxion3.core.enta.net (188.39.127.172)  23.327 ms  20.859 ms  21.733 ms
13  te0-0-2-0.miltonkeynes.core.enta.net (188.39.127.209)  22.365 ms  23.298 ms  25.178 ms
14  te0-0-0-1.birmingham-te.core.enta.net (188.39.127.212)  26.434 ms  27.137 ms  29.711 ms
15  te0-0-0-2.wolv-te.core.enta.net (188.39.127.217)  31.469 ms  31.309 ms  28.197 ms
16  ip195-2-224-253.presscomputers.net (195.2.224.253)  28.177 ms  25.894 ms  27.156 ms
alan-mbp:~ alanramsay$ 

Looking for some assistance from the PlusNet side as to why they are sending traffic via VM rather than the more direct route - can't seem to find a PlusNet looking glass, so struggling to see anything from my end.

Thanks

Alan

[#2]

Anyone from PlusNet to help with this?

[#3]

Working on it Alan.

Seeing some unexpected advertisements that we're following up on.

[#4 · Accepted solution]

Fancy giving things another go?

[#5]

Yes, it’s looking better now


root@nat:~# traceroute -I 195.2.224.253
traceroute to 195.2.224.253 (195.2.224.253), 30 hops max, 38 byte packets
1 410.xe-2-2-0.central10.pcn-bng02.plus.net (84.93.253.72) 12.171 ms 11.206 ms 11.483 ms
2 411.be6.pcn-ir01.plus.net (84.93.253.75) 12.766 ms 411.be6.pcn-ir02.plus.net (84.93.253.79) 12.085 ms 411.be6.pcn-ir01.plus.net (84.93.253.75) 11.963 ms
3 195.99.125.136 (195.99.125.136) 11.971 ms 195.99.125.140 (195.99.125.140) 12.166 ms 195.99.125.136 (195.99.125.136) 11.925 ms
4 peer5-hu0-1-0-1.telehouse.ukcore.bt.net (195.99.127.21) 12.207 ms peer1-et-10-3-0.telehouse.ukcore.bt.net (62.172.103.17) 12.792 ms peer5-hu0-1-0-1.telehouse.ukcore.bt.net (195.99.127.21) 12.017 ms
5 * * *
6 te0-1-0-0.telehouse-east4.core.enta.net (188.39.127.149) 12.930 ms 12.886 ms 12.602 ms
7 te0-0-0-3.man.core.enta.net (188.39.127.183) 19.668 ms 19.745 ms 19.570 ms
8 te0-0-2-0.man-te.core.enta.net (188.39.127.31) 19.564 ms 19.644 ms 19.694 ms
9 te0-0-0-0.wolv-te.core.enta.net (188.39.127.225) 21.520 ms 21.191 ms 21.092 ms
10 ip195-2-224-253.presscomputers.net (195.2.224.253) 19.209 ms 18.864 ms 19.504 ms
root@nat:~#


Has a filter been put in place to stop Virgin leaking, or have they stopped doing it now?

Alan

[#6]

---

@alan2402 wrote:
Has a filter been put in place to stop Virgin leaking, or have they stopped doing it now?

 
The former. Although last I checked we were trying to get in touch with them too.

[#7]

Hi Bob,

I have raised this with Virgin NMC directly too now after Neil had confirmed that they were leaking routes, as I'm concerned that they are doing it elsewhere that we haven't picked up on yet too!

I've just had a response from them, which (isn't particularly clear but) appears to escalate within VM as the initial person "can't find if we are advertising to any peer", but they can see that they are learning them (you don't say!).

If someone could let me have your diagnostics (either on here or via email) to show that the routes were coming in from VM, then I can put it back into their NMC ticket.

Cheers

Alan

[#8]

Bob,

Virgin have responded as below. Are you able to confirm that things are looking OK now without the filters that you put in?

From Virgin:

We have deleted the prefix-list statements for 195.2.224.0/24 and 195.2.225.0/24 from each of the Interconnect-Peering routers where it was configured.

Now we no longer export these routes.



Many thanks

Alan