<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>Yes,</div>
<div><br>
</div>
<div>I can confirm that one particular large mobile network in South Africa is doing strict urpf and has been for years despite many requests and much pleading by well, everyone, to change it.</div>
<div><br>
</div>
<div>It causes unholy hell </div>
<div><br>
</div>
<div>Andrew</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div id="x_composer_signature">
<div style="font-size:85%; color:#575757">Sent from my Samsung device</div>
</div>
<br>
<br>
-------- Original message --------<br>
From: Frank Habicht <geier@geier.ne.tz> <br>
Date: 18/10/2015 7:34 pm (GMT+02:00) <br>
To: afnog <afnog@afnog.org> <br>
Subject: [afnog] strict RPF ???? <br>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Hi all,<br>
<br>
I'm getting the impression that something is wrong in the South...<br>
<br>
Can anyone please confirm whether or not any bigger network in South<br>
Africa is doing strict RPF on their AS-boundaries, specifically<br>
peering/transit links.<br>
(not talking about customer links here)<br>
<br>
I don't want to mention names yet....<br>
<br>
What we see (from AS37084, for example 41.221.41.13):<br>
<br>
traffic to most IPs does work and ping fine , some 50ms via Seacom IP<br>
network (37100) - good.<br>
<br>
that also means the south african network has (and uses) a route to us<br>
via Seacom - nice and short. also good.<br>
<br>
the problem:<br>
traffic to at least one prefix<br>
- the prefix is apparently not advertised by that south african network<br>
in the same way to seacom, at least we don't get it advertised from<br>
seacom like we get many others<br>
- so traffic goes to Europe, specifically to a "tier-1" network<br>
(mentioning because i think it's safe to say the south african<br>
network won't have a peering with my upstream.)<br>
- and then traceroute to the problem-destination stops<br>
- from a hetzner hosted host in Europe we can get to the problem<br>
destination fine.<br>
a stable RTT of >790ms might suggest a vsat link from SA thoug - not<br>
a problem.<br>
- from same host a traceroute features the AMS-IX IP of the south<br>
African network....<br>
So peering might suggest a symmetric path<br>
- in fact: traceroute the opposite direction kind-of confirms that.<br>
<br>
<br>
The only idea that I have here is that from 37084 in TZ the path to the<br>
problem-prefix is via Europe. and the return path is not.<br>
and that someone is doing strict RPF.<br>
<br>
To which I would like to say:<br>
Where I life the internet is asymmetric.<br>
Especially when you guys (same origin AS btw) advertise some but not all<br>
prefixes to Seacom.<br>
<br>
And this hurts both our customers and your customers.<br>
And at the moment I'm convinced that it's not my routers dropping the<br>
packets.<br>
And that's the message our customers are getting.<br>
<br>
I'd like to get it fixed - soon.<br>
If possible without naming names.<br>
So I add one email address (from whois) into BCC...<br>
<br>
But I _can_ name names.<br>
<br>
Have fun.<br>
<br>
Frank<br>
<br>
<br>
_______________________________________________<br>
afnog mailing list<br>
<a href="https://www.afnog.org/mailman/listinfo/afnog">https://www.afnog.org/mailman/listinfo/afnog</a><br>
<br>
</div>
</span></font>
</body>
</html>