New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Anyone familiar with AS7029?
Hey all,
Just wondering if anyone here has experience dealing with AS7029 (Windstream). We have an IP block that we lease out, and AS7029 has been announcing it for over half a year — even though the ROA is invalid and has been invalid the entire time.
We've tried contacting them multiple times (NOC, abuse, peering contacts, etc.), but never got a single reply. The route is still being announced today.
At this point I’m just trying to figure out:
Is this a common thing with AS7029?
Has anyone successfully gotten them to stop announcing something they shouldn't?
Any recommended escalation paths (ARIN? upstreams?)
Appreciate any input or war stories. This has been a pain.
Comments
here's a noob question from me. What are the cons if someone announcing other's IP block. Does it affects sites hosted on those IPs?
Basically something like phising, if you announce someone else's IP's you're basically saying hey come to me, instead of the original owner. Though it's not an issue with most T1 isps dropping invalid rpki, if your provider does not have proper RPKI you can reach the wrong destination.
Would've thought spamhaus would've got in contact with em by now, and if theyre not responding to spamhaus, you likely wont get much luck.
GL.
How often providers have no rpki?
Their CF Radar page sure looks like a mess. They're announcing 42 prefixes where they're an invalid RPKI origin, and of those, 10 are multi-origin prefixes where the other ASN is RPKI valid.
Escalate this to their upstreams, especially those that accept the invalid route.
Will be bunch of work, since they have so many of them but in general T1s try to fix things.
In the end its their fault for accepting any route from their customers without proper filters/validation.
seen this before with them, you'll have to escalate to their upstreams. really fucked that a large(ish) carrier can act like this.
They seem to list names here maybe contact them personally and ask them to get their shit together
https://uniti.com/about/
You could also try to find/contact other victims to get more pressure on them and their upstreams.
Never knew this was possible but sounds like fun. Wanna try it @beanman109 ?
I would just note that Skhron accepts only RPKI valid routes authorised for direct downstream ASN and everything else is rejected.
But they have a reputation for taking ages to respond, and sometimes they keep advertising routes they shouldn't simply because no one internally checks them... If the ROA has been invalid for months, and they're still advertising it... Look, you can also open a ticket with the American Registry of Internet Numbers (ARIN), mainly so they can formalize the incident and put pressure on compliance. Many people have had to go that way because Windstream rarely responds to the first contact.