[outages] EXEMPLAR: Re: AT&T SFO to Twitter -- possible routing issue or BGP hijack

Jay R. Ashworth jra at baylink.com
Sun Jun 25 18:45:02 EDT 2023


*This*, folks and peoples, is a good problem report.

Strive to provide this much detail, or more.

The price of free help is you gotta show your work:

http://www.catb.org/~esr/faqs/smart-questions.html

Cheers,
-- jr '<admin/>' a

----- Original Message -----
> From: "Jeremy Chadwick via Outages" <outages at outages.org>
> To: outages at outages.org
> Sent: Saturday, June 24, 2023 2:17:12 AM
> Subject: [outages] AT&T SFO to Twitter -- possible routing issue or BGP hijack

> Found twitter.com was not loading tonight.  Dug in.
> 
> $ host www.twitter.com
> www.twitter.com is an alias for twitter.com.
> twitter.com has address 104.244.42.129
> twitter.com mail is handled by 30 ASPMX2.GOOGLEMAIL.com.
> twitter.com mail is handled by 20 alt2.aspmx.l.google.com.
> twitter.com mail is handled by 20 alt1.aspmx.l.google.com.
> twitter.com mail is handled by 10 aspmx.l.google.com.
> twitter.com mail is handled by 30 ASPMX3.GOOGLEMAIL.com.
> 
> $ dig ns twitter.com +short
> b.r06.twtrdns.net.
> a.r06.twtrdns.net.
> c.r06.twtrdns.net.
> d.r06.twtrdns.net.
> a.u06.twtrdns.net.
> b.u06.twtrdns.net.
> c.u06.twtrdns.net.
> d.u06.twtrdns.net.
> 
> $ dig @b.r06.twtrdns.net a twitter.com +short
> 104.244.42.129
> 
> And 104.244.42.129 does indeed point to Twitter (per WHOIS/ARIN), so doesn't
> appear to be a DNS-related thing.  Onward we go:
> 
> $ mtr www.twitter.com
>                                                                      Packets               Pings
> Host                                                               Loss%   Snt
> Rcv  Last   Avg  Best  Wrst
> 1. 192.168.1.254                                                    0.0%     9
> 9   0.6   0.6   0.5   0.8
> 2. 172-10-232-1.lightspeed.sntcca.sbcglobal.net (172.10.232.1)      0.0%     9
> 9   2.3   2.3   1.5   4.3
> 3. 71.148.149.42 (71.148.149.42)                                    0.0%     8
> 8   2.6   2.7   1.7   3.9
> 4. 12.242.117.22 (12.242.117.22)                                    0.0%     8
> 8   4.6   6.1   3.6   8.2
> 5. att-gw.sfo.pccw.net (192.205.32.82)                              0.0%     8
> 8   6.7   6.5   5.3   8.1
> 6. Bundle-Ether45.br04.osa01.pccwbtn.net (63.223.26.30)             0.0%     8
> 8 121.6 121.1 119.6 122.8
> 7. 63-222-51-222.static.pccwglobal.net (63.222.51.222)              0.0%     8
> 8 154.3 154.4 153.3 155.8
> 8. (waiting for reply)
> 9. 104.244.42.129 (104.244.42.129)                                  0.0%     8
> 8 151.5 152.6 151.4 153.8
> 
> $ mtr -z www.twitter.com
> 
>                                                                      Packets               Pings
> Host                                                               Loss%   Snt
> Rcv  Last   Avg  Best  Wrst
> 1. AS???    192.168.1.254                                           0.0%     8
> 8   0.8   0.6   0.3   0.8
> 2. AS7018   172-10-232-1.lightspeed.sntcca.sbcglobal.net (172.10.2  0.0%     8
> 8   1.3   2.2   1.0   4.1
> 3. AS7018   71.148.149.42 (71.148.149.42)                           0.0%     8
> 8   2.2   3.4   1.9   5.0
> 4. AS7018   12.242.117.22 (12.242.117.22)                           0.0%     8
> 8   6.0   6.1   4.5   7.6
> 5. AS7018   att-gw.sfo.pccw.net (192.205.32.82)                     0.0%     8
> 8   5.6   6.2   4.8   7.7
> 6. AS3491   Bundle-Ether45.br04.osa01.pccwbtn.net (63.223.26.30)    0.0%     8
> 8 120.4 120.7 120.0 121.5
> 7. AS3491   63-222-51-222.static.pccwglobal.net (63.222.51.222)     0.0%     8
> 8 154.1 155.4 153.6 161.5
> 8. (waiting for reply)
> 9. AS13414  104.244.42.129 (104.244.42.129)                         0.0%     7
> 7 152.7 152.2 150.8 154.0
> 
> AS3491 (pccwbtn.net) is PCCW Global, though a WHOIS on pccwbtn.net says
> they're PCCW-HKT out of Hong Kong, which would explains the huge jump in
> latency (6ms -> 121ms) since I'm located in California.  63.223.26.30 is
> also PCCW Global.
> 
> PeeringDB says https://www.peeringdb.com/net/674 (AT&T) has a looking
> glass server at http://route-server.ip.att.net/ but the webserver is not
> listening on TCP port 80, nor 443:
> 
> $ telnet route-server.ip.att.net 80
> Trying 12.0.1.28...
> telnet: connect to address 12.0.1.28: Connection refused
> telnet: Unable to connect to remote host
> $ telnet route-server.ip.att.net 443
> Trying 12.0.1.28...
> telnet: connect to address 12.0.1.28: Connection refused
> telnet: Unable to connect to remote host
> 
> And for those that want source and destinations:
> 
> src IP: 107.197.104.143 (AT&T Fibre)
> dst IP: 104.244.42.129  (Twitter)
> 
> --
>| Jeremy Chadwick                              jdc_at_koitsu.org |
>| UNIX Systems Administrator                      PGP 0x2A389531 |
>| Making life hard for others since 1977.                        |
> 
> _______________________________________________
> Outages mailing list
> Outages at outages.org
> https://puck.nether.net/mailman/listinfo/outages

-- 
Jay R. Ashworth                  Baylink                       jra at baylink.com
Designer                     The Things I Think                       RFC 2100
Ashworth & Associates       http://www.bcp38.info          2000 Land Rover DII
St Petersburg FL USA      BCP38: Ask For It By Name!           +1 727 647 1274


More information about the Outages mailing list