[nsp-sec] Warning for those of you with older JunOS based routers...

[White, Gerard]

Today this ISP decided to announce a more specific /24 from their /19:


AS      | IP               | AS Name
25019   | 212.118.142.0    | SAUDINETSTC-AS Autonomus System Number for SaudiNet


It triggers this JunOS PR:
http://s-tools1.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-01-626&viewMode=view


Even in newer JunOS code (10.4R2), the prefix looks like this:


show route 212.118.142.0 extensive    

inet.0: 371027 destinations, 663293 routes (368882 active, 26 holddown, 33233 hidden)
212.118.142.0/24 (2 entries, 1 announced)
TSI:
KRT in-kernel 212.118.142.0/24 -> {indirect(1049427)}
Standby generator for 0.0.0.0/0
Page 0 idx 1 Type 1 val 1b1532a0
    Nexthop: <REMOVED>
    MED: 0
    Localpref: 100
    AS path: [855] 3257 6453 39386 25019 I (Originator)
    Cluster list:  <REMOVED>
    Originator ID: <REMOVED>
    Unrecognized Attributes: 34 bytes
    Attr flags e0 code 80: 00 00 fd 88 40 01 01 02 40 02 06 02 01 00 00 fc da 80 04 04 00 00 00 01 40 05 04 00 00 00 64
    Communities: <REMOVED>
    Cluster ID: <REMOVED>
    Originator ID: <REMOVED>


Just a FYI for those of you that may have some older JunOS based assets doing BGP...

GW
855 - Bell Aliant

-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 183 bytes
Desc: not available
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20110908/ab823cf2/attachment-0001.sig>