[outages] Vocus routing US Salesforce.com traffic through Australia?

Wed Sep 8 19:22:02 EDT 2021

Hi, 

That's interesting. I did a traceroute from behind HE: 

[sabri at dora ~]$ traceroute 23.1.35.132 
traceroute to 23.1.35.132 (23.1.35.132), 30 hops max, 60 byte packets 
1 ge-0-0-1-unit-2.rtr1.fremont1.dc.cluecentral.net (195.16.84.1) 0.770 ms 0.690 ms 0.953 ms 
2 ip-87-249.members.virt-ix.net (195.16.87.249) 25.145 ms 25.173 ms 25.458 ms 
3 103.144.176.65 (103.144.176.65) 25.431 ms 25.431 ms 25.399 ms 
4 v710.core4.fmt2.he.net (216.218.132.13) 36.449 ms 25.415 ms 25.809 ms 
5 100ge10-1.core1.sjc1.he.net (184.105.80.193) 25.804 ms 25.795 ms 26.049 ms 
6 vocus.gigabitethernet2-13.core1.sjc1.he.net (64.71.184.46) 26.331 ms 24.090 ms * 
7 be100.bdr04.sjc01.ca.us.vocus.network (114.31.199.33) 252.448 ms be202.cor02.syd04.nsw.vocus.network (114.31.199.42) 248.817 ms 249.374 ms 
8 be100.bdr04.syd03.nsw.vocus.network (114.31.192.45) 249.358 ms be203.cor01.syd11.nsw.vocus.network (114.31.199.40) 252.469 ms be100.bdr04.syd03.nsw.vocus.network (114.31.192.45) 249.286 ms 
9 be101.bdr04.syd03.nsw.vocus.network (114.31.192.47) 252.577 ms * 252.879 ms 
10 * * * 
11 * a23-1-240-227.deploy.static.akamaitechnologies.com (23.1.240.227) 267.015 ms 266.998 ms 
12 * static-73.173.255.49.in-addr.VOCUS.net.au (49.255.173.73) 262.371 ms * 
13 be114.cor02.syd04.nsw.vocus.network (114.31.192.44) 340.616 ms static-73.173.255.49.in-addr.VOCUS.net.au (49.255.173.73) 253.192 ms be114.cor02.syd04.nsw.vocus.network (114.31.192.44) 340.815 ms 
14 be114.cor02.syd04.nsw.vocus.network (114.31.192.44) 343.393 ms be114.cor01.syd11.nsw.vocus.network (114.31.192.46) 343.116 ms * 
15 * * * 
16 * * * 
17 be201.bdr01.sin01.sin.vocus.network (114.31.206.51) 349.315 ms 357.906 ms 358.658 ms 
18 80.81.65.217 (80.81.65.217) 364.537 ms 353.187 ms be201.bdr01.sin01.sin.vocus.network (114.31.206.51) 352.445 ms 
19 ae9.0.cjr01.mrs002.flagtel.com (62.216.129.182) 485.064 ms 484.690 ms 80.81.65.217 (80.81.65.217) 350.032 ms 
20 62.216.128.129 (62.216.128.129) 502.377 ms ae9.0.cjr01.mrs002.flagtel.com (62.216.129.182) 487.969 ms 487.956 ms 
21 * * 62.216.128.129 (62.216.128.129) 500.875 ms 
22 * a23-1-35-132.deploy.static.akamaitechnologies.com (23.1.35.132) 293.983 ms 293.992 ms 

The supernet 23.0.0.0/12 is owned by Akamai, who announces the more specific /24 to Vocus: 

23.1.35.0/24 *[BGP/170] 2d 16:10:52, localpref 100 
AS path: 53356 6939 4826 20940 33905 I, validation-state: unverified 
> to 195.16.87.249 via ge-0/0/6.0 
[BGP/170] 2w2d 00:35:09, localpref 100 
AS path: 136620 60011 3356 4826 20940 33905 I, validation-state: unverified 
> to 195.16.87.241 via ge-0/0/7.0 

To me this looks like Vocus is accidentally leaking it to HE. 

Thanks, 

Sabri 

----- On Sep 8, 2021, at 2:19 PM, Eric Lester via Outages <outages at outages.org> wrote: 

> Received latency complaints from one location in Nashville with Centurylink
> Internet. Traceroutes showed traffic routing through Australia. Looks like 1 of
> 8 Salesforce.com publicly resolved IP’s is currently being routed through San
> Jose, California and then to Australia before coming back to US. We sent the
> info to Salesforce.com through a ticket but I’m doubtful of it making it to
> someone that can figure out what to do with the info.

> Just curious if anyone has insight into what is going on. I am not familiar with
> Australia ISP’s etc.

> Public IP’s I’m receiving

> NSLOOKUP salesforce.com

> Name: salesforce.com

> Addresses: 23.1.35.132

> 23.1.99.130

> 23.1.106.133

> 104.109.10.129

> 104.109.11.129

> 184.25.179.132

> 184.31.3.130

> 184.31.10.133

> Traceroutes from a couple of public hosts

> Lumen Traceroute

> NASHVILLE TN USA Traceroute results for: 23.1.35.132
> (a23-1-35-132.deploy.static.akamaitechnologies.com)

> Tracing route to 23.1.35.132 1 ae-2-3605.edge9.SanJose1.Level3.net (4.69.219.65)
> 61ms 70ms 60ms

> 2 0.0.0.0 (0.0.0.0) * * *

> 3 be100.bdr03.sjc01.ca.us.vocus.network (114.31.199.32) 205ms 205ms
> be203.cor01.syd11.nsw.vocus.network (114.31.199.40) 208ms

> 4 be101.bdr04.syd03.nsw.vocus.network (114.31.192.47) 208ms
> be202.cor02.syd04.nsw.vocus.network (114.31.199.42) 205ms 205ms

> 5 static-74.173.255.49.in-addr.VOCUS.net.au (49.255.173.74) 210ms
> be100.bdr04.syd03.nsw.vocus.network (114.31.192.45) 205ms
> static-74.173.255.49.in-addr.VOCUS.net.au (49.255.173.74) 223ms

> 6 a23-1-240-228.deploy.static.akamaitechnologies.com (23.1.240.228) 208ms
> static-74.173.255.49.in-addr.VOCUS.net.au (49.255.173.74) 212ms 212ms

> 7 0.0.0.0 (0.0.0.0) * * a23-1-240-143.deploy.static.akamaitechnologies.com
> (23.1.240.143) 205ms

> 8 static-73.173.255.49.in-addr.VOCUS.net.au (49.255.173.73) 208ms 0.0.0.0
> (0.0.0.0) * *

> 9 be114.cor02.syd04.nsw.vocus.network (114.31.192.44) 356ms 356ms
> static-73.173.255.49.in-addr.VOCUS.net.au (49.255.173.73) 205ms

> 10 be114.cor02.syd04.nsw.vocus.network (114.31.192.44) 356ms
> be202.bdr03.sjc01.ca.us.vocus.network (114.31.199.43) 359ms
> be114.cor02.syd04.nsw.vocus.network (114.31.192.44) 357ms

> 11 173.205.35.1 (173.205.35.1) 359ms 356ms be202.bdr03.sjc01.ca.us.vocus.network
> (114.31.199.43) 356ms

> 12 173.205.35.1 (173.205.35.1) 356ms ae18-3416.cr11-fra2.ip4.gtt.net
> (89.149.180.134) 356ms ae6.cr6-sjc1.ip4.gtt.net (89.149.180.78) 356ms

> 13 ae18-3416.cr11-fra2.ip4.gtt.net (89.149.180.134) 357ms 354ms ip4.gtt.net
> (98.124.180.42) 360ms

> 14 ae12.r02.sjc01.icn.netarch.akamai.com (23.207.232.40) 360ms ip4.gtt.net
> (98.124.180.42) 356ms 356ms

> 15 ae4.r02.ord01.icn.netarch.akamai.com (23.32.63.26) 405ms 425ms
> ae12.r02.sjc01.icn.netarch.akamai.com (23.207.232.40) 357ms

> 16 ae3.r01.lga01.icn.netarch.akamai.com (23.32.63.4) 425ms
> ae4.r02.ord01.icn.netarch.akamai.com (23.32.63.26) 405ms 400ms

> 17 ae1.r02.lga01.ien.netarch.akamai.com (23.203.156.37) 426ms 426ms
> ae3.r01.lga01.icn.netarch.akamai.com (23.32.63.4) 422ms

> 18 ae1.r02.lga01.ien.netarch.akamai.com (23.203.156.37) 423ms 0.0.0.0 (0.0.0.0)
> * ae1.r02.lga01.ien.netarch.akamai.com (23.203.156.37) 423ms

> 19 a23-1-35-132.deploy.static.akamaitechnologies.com (23.1.35.132) 226ms 228ms
> 0.0.0.0 (0.0.0.0) *

> Hurricane Electric Traceroute

> core2.bna1.he.net> traceroute 23.1.35.132 source 216.218.252.20

> Target

> 23.1.35.132

> Hop Start

> 1

> Hop End

> 30

> Hop

> Packet 1

> Packet 2

> Packet 3

> Hostname

> 1

> 5.469 ms

> 5.579 ms

> 5.586 ms

> 100ge6-2.core1.ind1.he.net (184.105.65.149)

> 2

> 11.324 ms

> 11.347 ms

> 11.391 ms

> 100ge0-33.core2.stl1.he.net (184.104.196.14)

> 3

> 16.556 ms

> 16.854 ms

> 16.982 ms

> 100ge0-68.core2.mci3.he.net (72.52.92.237)

> 4

> 16.800 ms

> 16.811 ms

> 16.930 ms

> 100ge4-1.core1.mci3.he.net (184.104.197.69)

> 5

> 27.761 ms

> 27.783 ms

> 27.788 ms

> 100ge7-2.core1.den1.he.net (184.104.195.213)

> 6

> 51.918 ms

> 50.625 ms

> 50.712 ms

> 100ge0-29.core2.sjc2.he.net (184.105.64.69)

> 7

> 50.842 ms

> 50.672 ms

> 50.647 ms

> 100ge16-1.core1.sjc2.he.net (184.104.192.213)

> 8

> 51.078 ms

> 80.874 ms

> 81.187 ms

> 100ge13-2.core1.sjc1.he.net (184.105.65.113)

> 9

> 52.429 ms

> 52.441 ms

> 52.506 ms

> vocus.gigabitethernet2-13.core1.sjc1.he.net (64.71.184.46)

> 10

> 202.821 ms

> 202.354 ms

> *

> be202.cor02.syd04.nsw.vocus.network (114.31.199.42)

> 21

> 463.994 ms

> 463.937 ms

> 464.130 ms

> 100ge0-33.core2.nyc4.he.net (184.105.81.62)

> 22

> 420.303 ms

> 420.423 ms

> 420.768 ms

> 100ge3-2.core1.bos1.he.net (184.105.64.54)

> 23

> 224.026 ms

> 224.042 ms

> 224.045 ms

> a23-1-35-132.deploy.static.akamaitechnologies.com (23.1.35.132)

> Eric Lester | Vice President of Technology

> Acadia Healthcare Company, Inc.

> Email : [ mailto:eric.lester at acadiahealthcare.com |
> eric.lester at acadiahealthcare.com ]

> Address: 6100 Tower Circle – Suite 1000 – Franklin, TN 37067

> _______________________________________________
> Outages mailing list
> Outages at outages.org
> https://puck.nether.net/mailman/listinfo/outages
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/outages/attachments/20210908/6b2ce3c8/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 14464 bytes
Desc: image001.png
URL: <https://puck.nether.net/pipermail/outages/attachments/20210908/6b2ce3c8/attachment-0001.png>