With a non so little space of the IP numbers of IPv4 in the net, sky shall not fall over your head, at least not frequently. But, when it happens, you must know where is the best place to start looking for problems and troubleshootings.
Note: This little reference is for those of you who manage their own ASN (autonomous system number).
Let me describe the scenario “sky is falling”:
When suddenly your web sites and datacenter (merged in a little /24 IP block) are not reached by anybody in the world except your own constituency (the hosts inside your ASN), the problem could be due to prefix inconsistency.
Our friends in TEAM CYMRU have done a wonderful work by monitoring these inconsistencies on the whole net. If you are based on Peru, you can be sure that the source of TEAM CYMRU is trusted, because there is a local ISP which participates with some data.
Here is a big picture of this real problem across the Internet. Look at the numbers: k means kilo, just multiple x1000.
To make a deeper review on this, you go to the this URL, and look for your IP block, which is suffering this picture:
Prefix Origin ASNs ASN Name
8.3.30.0/24 AS14153 EDGECAST-SJO – EdgeCast Networks, Inc.
AS14210 EDGECAST-DCA – EdgeCast Networks, Inc.
AS15133 EDGECAST – EdgeCast Networks, Inc.
In this little example, you can see one IP block (8.3.30.0/24), which has been seen on AS14153, but this is not the right source. This is a problem with prefix inconsistency. The real owner of this IP block is the company Level 3 Communications, Inc., as I saw in the WHOIS.
Level 3 Communications, Inc. LVLT-ORG-8-8 (NET-8-0-0-0-1)
8.0.0.0 – 8.255.255.255
EdgeCast Networks, Inc. LVLT-EDGEC-1-8-3-30 (NET-8-3-30-0-1)
8.3.30.0 – 8.3.30.255
Although, this post is not exclusively a security topic, my suspiciouness alerts me when something like this occurs, I used to think the worst about the ASN which issued my little IP block. I am not out of my right mind, this evil idea happened just a few weeks ago, with Pakistan and YouTube network. Then, it become a security problem, without any doubt.
Javier Romero
JaCkSecurity, CTO
Conocimiento, Conciencia, y Consultoria