Thanks for the reminder

Author: Tom  |  Category: Hong Kong

You know you’re in China when….

Author: Tom  |  Category: China, Food, Hong Kong, Life, Work

…you find chicken feet in the office fridge!

The Peak

Author: Tom  |  Category: Hong Kong

Went up to the peak again to show a friend around hong kong.

It’s a great spot except for the ‘congestion’ to get up there. If you go, try a week day, it’s a bit less crowded :-)

BGP, Prefix Lists & ISPs/Carriers can be a bad idea.

Author: Tom  |  Category: Tech Stuff, Work

One of the most important things about building a network is making it scalable. The fact that it “works” now should never be an excuse for a poor design.

In BGP, there are several ways you can control routes that are received from or sent to a BGP neighbor, prefix lists, IP Access Lists and BGP Community tags.

All 3 are used and in different purposes in the ASN’s I administer.

In the past few months, I’ve seen a repeating occurrence with some ISP’s who have either a Prefix List or Access-List configured facing their upstreams and peers to control their customer and internal routes. This is a very bad idea.

A case I’ve come across today is pictured below.

     Network          Next Hop            Metric LocPrf Weight Path
*>  202.22.171.0     206.223.143.164        100    250      0 18221 4826 7606 9942 9942 9942 ?
*>  202.22.174.0     206.223.143.164        100    250      0 18221 4826 7606 9942 9942 9942 ?
So what has happened here? AS9942 is originating a route, which is received by AS7606 (a peering IX) advertised to AS4826 and onto AS18221. AS18221 advises this route onto a peering IX (which is where the above is displayed from).

AS18221 in this case has these to prefixes configured to be allowed through its access-lists or prefix lists to be advertised upstream or to other peers. AS4826 is AS18221′s transit provider, so this is generally a bad idea to do as you’re transiting traffic that will cost you money!

Why might this have occurred? There are a few possibilities for this, the most common is lazy house keeping. If you were originating a customer prefix who then moved to another provider, but didn’t clean up your access-lists, you’d learn their route from your upstream and send it back on to the internet!
This also has possible security concerns for the end user, as their traffic could be passing through a rouge ASN who is spying on the traffic, but, this is a different more in-depth topic on BGP security (or the lack of).
The simplest ways for ISPs and Carriers to prevent leaking routes unintentionally like this is to implement BGP Community controls. By tagging the route as it enters your network your routers will be able to back you up for lazy house keeping to prevent the route leaking.
Create a community tag for customer routes learnt from eBGP direct to your customer. Another for your internal routes. While you’re at it, you can tag peers and upstreams too for better control. What you’ll end up with is a route-map like this:
route-map peer-out deny 10
 match community upstream
route-map peer-out permit 20
 match community customer
route-map peer-out permit 30
 match community internal
!
route-map upstream-out deny 10
 match community peer
route-map upstream-out permit 20
 match community customer
route-map upstream-out permit 30
 match community internal

While this is not the only solution, it is by far the most scalable. One other option is to put an AS_PATH filter on your peers/upstreams, listing the neighbor ASN and denying it to be advertised.

While this works, its not a scalable option as when your network grows, you need to update all of the filters again for each new peer you make. It also doesn’t resolve the issue of lazy house keeping with turn ups/downs.

Please remember though, use of BGP Communities on their own can be dangerous also, as you don’t know what your customer might be sending you, so continue to use your prefix-lists/access-lists and AS_PATHs to help manage and protect your network, but consider the use of communities to track a routes origin and make sure you’re handling it correctly.

I am not an administrator of AS18221.

Hong Kong Pets

Author: Tom  |  Category: Hong Kong, Life

People with pets here are stuffed.  They have huge dogs living in tiny places.
There really isn’t enough space here for large dogs, its so unfair on them!

I saw today something even worse. On the MTR, people were keeping their dog in a zipped bag!

Poor Dog

The dog was panting like crazy – too hot in the bag. How can people treat their pets like this! :(

Beijing Engrish

Author: Tom  |  Category: China

Great bit of Chinese Engrish, or Chinglish, not to mention just hilarious to have at the urinal.

The Chinese translation is a little bit different I’m told.  its closer to:

“Taking one step closer will be a big step for our culture.”  :)

Dinner at Cafe de Coral

Author: Tom  |  Category: Food, Hong Kong

I tried Cafe de Coral for dinner last night. Its $1 cheaper than MX at $43.

The quality? Equal, though the pepper sauce was much better.

Lion Dance in Sheung Wan

Author: Tom  |  Category: Hong Kong

Outhouse

Author: Tom  |  Category: Hong Kong

This is a new definition for the outhouse. Roofhouse?

Enjoy

Echoes of the Rainbow and Wing Lee street

Author: Tom  |  Category: Uncategorized

After the success of ‘echoes of the rainbow’ set in 1960′s Hong Kong, Wing Lee street, where the movie is set, has become somewhat of a local tourist trap.

I went for a walk through to check it out as it’s one of the few older housing areas left in Hong Kong.

First thing I saw on the street was an old lady at the doorways to one of the houses. She seemed less than impressed with all the attention.

A large no photos sign was stuck on her place too. I decided not to take direct photos of the places there to respect them.

So what’s so special about Wing Lee street? Nothing that I can tell at first glance. The movie depected things much better than this dilapidated old street.