{"tool":"network-report","status":"fail","input":{"query":"AS25384"},"findings":[{"level":"fail","text":"AS25384 (DMDATA-AS) announces 17 IPv4 and 1 IPv6 prefixes.","title":"AS25384 (DMDATA-AS) announces 17 IPv4 and 1 IPv6 prefixes.","params":{"query":"AS25384","who":"AS25384 (DMDATA-AS)","v4":17,"v6":1}},{"level":"fail","text":"1 of 18 announced prefixes are RPKI invalid: 92.60.154.0/24.","title":"1 of 18 announced prefixes are RPKI invalid: 92.60.154.0/24.","params":{"count":1,"total":18,"list":"92.60.154.0/24"},"detail":"A ROA covers them but does not allow this origin or prefix length, so networks that filter (most large ones do) drop these routes.","fix":"Fix the ROAs (origin AS and max length) at your RIR, or stop announcing the routes."},{"level":"warn","text":"6 of 18 announced prefixes have no ROA (RPKI not found): 193.162.1.0/24, 193.162.8.0/24, 193.162.9.0/24, 193.162.10.0/24, 193.162.11.0/24 (+1).","title":"6 of 18 announced prefixes have no ROA (RPKI not found): 193.162.1.0/24, 193.162.8.0/24, 193.162.9.0/24, 193.162.10.0/24, 193.162.11.0/24 (+1).","params":{"count":6,"total":18,"list":"193.162.1.0/24, 193.162.8.0/24, 193.162.9.0/24, 193.162.10.0/24, 193.162.11.0/24 (+1)","asn":25384},"detail":"Without a ROA, networks cannot tell your routes from a hijack.","fix":"Create a ROA for each at your RIR portal, with origin AS25384 and a max length equal to the prefix length:","record":"193.162.1.0/24 AS25384 max-length /24\n193.162.8.0/24 AS25384 max-length /24\n193.162.9.0/24 AS25384 max-length /24\n193.162.10.0/24 AS25384 max-length /24\n193.162.11.0/24 AS25384 max-length /24\n193.162.12.0/24 AS25384 max-length /24"},{"level":"warn","text":"No IRR as-set is listed.","title":"No IRR as-set is listed.","params":{},"detail":"Peers and route servers build prefix filters from the as-set. Without one they fall back to the AS number alone, which breaks as soon as you have customers.","fix":"Create an as-set in your RIR’s IRR database and add it to your PeeringDB record."},{"level":"warn","text":"No public NOC, policy or technical contact.","title":"No public NOC, policy or technical contact.","params":{},"detail":"Other networks use these addresses to set up peering and to reach you during an incident.","fix":"Add a role contact (for example noc@ or peering@ an address you monitor) with visibility Public."}],"data":{"query":"AS25384","kind":"asn","special":null,"allocation":{"rir":"ripencc","registry":"RIPE NCC","cc":"DK","country":"Denmark","date":"2002-11-07","status":"allocated","range":"AS25384","opaque_id":"01a94229-bba3-47ac-b156-04d7bc6ae05f","special":null},"verdict":{"level":"fail","title":":who announces :v4 IPv4 and :v6 IPv6 prefixes.","params":{"query":"AS25384","who":"AS25384 (DMDATA-AS)","v4":17,"v6":1}},"seconds":4.7999999999999998,"sections":{"routing":{"status":"fail","findings":[{"level":"pass","title":"AS:asn announces :v4 IPv4 and :v6 IPv6 prefixes.","params":{"asn":25384,"v4":17,"v6":1}},{"tool":["rpki",{"prefix":"92.60.154.0/24","asn":"25384"}],"guide":"create-rpki-roas","level":"fail","title":":count of :total announced prefixes are RPKI invalid: :list.","params":{"count":1,"total":18,"list":"92.60.154.0/24"},"detail":"A ROA covers them but does not allow this origin or prefix length, so networks that filter (most large ones do) drop these routes.","fix":"Fix the ROAs (origin AS and max length) at your RIR, or stop announcing the routes."},{"tool":["rpki",{"prefix":"193.162.1.0/24","asn":"25384"}],"guide":"create-rpki-roas","level":"warn","title":":count of :total announced prefixes have no ROA (RPKI not found): :list.","params":{"count":6,"total":18,"list":"193.162.1.0/24, 193.162.8.0/24, 193.162.9.0/24, 193.162.10.0/24, 193.162.11.0/24 (+1)","asn":25384},"detail":"Without a ROA, networks cannot tell your routes from a hijack.","fix":"Create a ROA for each at your RIR portal, with origin AS:asn and a max length equal to the prefix length:","record":"193.162.1.0/24 AS25384 max-length /24\n193.162.8.0/24 AS25384 max-length /24\n193.162.9.0/24 AS25384 max-length /24\n193.162.10.0/24 AS25384 max-length /24\n193.162.11.0/24 AS25384 max-length /24\n193.162.12.0/24 AS25384 max-length /24"},{"level":"info","title":":count of :total announced prefixes are RPKI valid.","params":{"count":11,"total":18}},{"level":"pass","title":"Every announced prefix has an IRR route object.","params":[]},{"level":"info","title":":left upstreams and peers, :right downstream networks seen.","params":{"left":2,"right":2}}],"data":{"asn":25384,"holder":"DMDATA-AS Kyndryl Danmark ApS","announced":true,"v4":17,"v6":1,"prefixes":["85.89.224.0/19","85.89.239.0/24","85.89.250.0/24","92.60.144.0/20","92.60.154.0/24","109.236.176.0/20","185.3.13.0/24","185.3.14.0/24","185.3.15.0/24","193.162.1.0/24","193.162.8.0/24","193.162.9.0/24","193.162.10.0/24","193.162.11.0/24","193.162.12.0/24","193.162.192.0/19","217.10.16.0/20","2001:15f8:c00::/48"],"rpki":{"valid":11,"invalid":1,"not-found":6,"unchecked":0},"rpki_problems":[{"prefix":"92.60.154.0/24","state":"invalid"},{"prefix":"193.162.1.0/24","state":"not-found"},{"prefix":"193.162.8.0/24","state":"not-found"},{"prefix":"193.162.9.0/24","state":"not-found"},{"prefix":"193.162.10.0/24","state":"not-found"},{"prefix":"193.162.11.0/24","state":"not-found"},{"prefix":"193.162.12.0/24","state":"not-found"}],"irr_missing":[],"irr_missing_count":0,"bogons":[],"upstreams":[{"asn":8220,"power":722,"name":"Colt"},{"asn":31027,"power":414,"name":"GlobalConnect AS31027"}],"left":2,"right":2},"title":"Routing and RPKI","tool":"bgp","tool_input":{"query":"AS25384"},"summary":{"level":"fail","title":":count of :total announced prefixes are RPKI invalid: :list.","params":{"count":1,"total":18,"list":"92.60.154.0/24"}}},"registration":{"status":"pass","findings":[{"level":"pass","title":"Found at :server.","params":{"server":"rdap.db.ripe.net"}}],"data":{"query":"AS25384","looked_up":"AS25384","kind":"autnum","source":"https://rdap.db.ripe.net/autnum/25384","terms":"https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms/","summary":{"Name":"DMDATA-AS","Handle":"AS25384","Range":"AS25384","Status":"active","Registered":"2002-11-07T14:05:14Z","Last changed":"2024-04-04T12:48:40Z","Abuse contact":"nam.nordics@kyndryl.com"},"entities":[{"roles":["registrant"],"kind":"individual","name":"AS25384-MNT","email":null},{"roles":["registrant"],"kind":"org","name":"Kyndryl Danmark ApS","email":null},{"roles":["registrant"],"kind":"individual","name":"RIPE-NCC-END-MNT","email":null},{"roles":["abuse"],"kind":"group","name":"AS25384 abuse role","email":"nam.nordics@kyndryl.com"}],"allocation":{"rir":"ripencc","registry":"RIPE NCC","cc":"DK","country":"Denmark","date":"2002-11-07","status":"allocated","range":"AS25384","opaque_id":"01a94229-bba3-47ac-b156-04d7bc6ae05f","special":null}},"title":"Registration","tool":"whois","tool_input":{"query":"AS25384"},"summary":{"level":"pass","title":"Found at :server.","params":{"server":"rdap.db.ripe.net"}}},"peering":{"status":"warn","findings":[{"level":"pass","title":"AS:asn is in PeeringDB as :name.","params":{"asn":25384,"name":"IBM Denmark"}},{"level":"info","title":"Peering policy: :policy.","params":{"policy":"Open"},"detail":"Peers with anyone at a shared location, usually without a contract."},{"level":"info","title":"No internet exchange ports are listed.","params":[]},{"level":"warn","title":"No IRR as-set is listed.","params":[],"detail":"Peers and route servers build prefix filters from the as-set. Without one they fall back to the AS number alone, which breaks as soon as you have customers.","fix":"Create an as-set in your RIR’s IRR database and add it to your PeeringDB record."},{"level":"warn","title":"No public NOC, policy or technical contact.","params":[],"detail":"Other networks use these addresses to set up peering and to reach you during an incident.","fix":"Add a role contact (for example noc@ or peering@ an address you monitor) with visibility Public."},{"level":"info","title":"The record was last updated :date.","params":{"date":"2022-07-27"},"detail":"Peers rely on it for max-prefix limits and contacts; check it is still right."}],"data":{"asn":25384,"net":{"id":1801,"name":"IBM Denmark","aka":"DMdata, IBM SDC DK","website":"","looking_glass":"","route_server":"","irr_as_set":"","info_type":"NSP","info_prefixes4":20,"info_prefixes6":1,"info_traffic":"100-1000Mbps","info_ratio":"Mostly Inbound","info_scope":"Regional","info_unicast":true,"info_ipv6":true,"info_never_via_route_servers":false,"ix_count":0,"fac_count":0,"policy_url":"","policy_general":"Open","policy_locations":"Not Required","policy_ratio":false,"policy_contracts":"Not Required","updated":"2022-07-27T05:33:52Z"},"ix_count":0,"capacity":0,"ix":[],"ix_total":0,"fac":[],"fac_total":0,"poc":[],"missing":[]},"title":"PeeringDB","tool":"peeringdb","tool_input":{"asn":"25384"},"summary":{"level":"warn","title":"No IRR as-set is listed.","params":[]}}},"fixes":[{"tool":["rpki",{"prefix":"92.60.154.0/24","asn":"25384"}],"guide":"create-rpki-roas","level":"fail","title":":count of :total announced prefixes are RPKI invalid: :list.","params":{"count":1,"total":18,"list":"92.60.154.0/24"},"detail":"A ROA covers them but does not allow this origin or prefix length, so networks that filter (most large ones do) drop these routes.","fix":"Fix the ROAs (origin AS and max length) at your RIR, or stop announcing the routes.","section":"routing"},{"tool":["rpki",{"prefix":"193.162.1.0/24","asn":"25384"}],"guide":"create-rpki-roas","level":"warn","title":":count of :total announced prefixes have no ROA (RPKI not found): :list.","params":{"count":6,"total":18,"list":"193.162.1.0/24, 193.162.8.0/24, 193.162.9.0/24, 193.162.10.0/24, 193.162.11.0/24 (+1)","asn":25384},"detail":"Without a ROA, networks cannot tell your routes from a hijack.","fix":"Create a ROA for each at your RIR portal, with origin AS:asn and a max length equal to the prefix length:","record":"193.162.1.0/24 AS25384 max-length /24\n193.162.8.0/24 AS25384 max-length /24\n193.162.9.0/24 AS25384 max-length /24\n193.162.10.0/24 AS25384 max-length /24\n193.162.11.0/24 AS25384 max-length /24\n193.162.12.0/24 AS25384 max-length /24","section":"routing"},{"level":"warn","title":"No IRR as-set is listed.","params":[],"detail":"Peers and route servers build prefix filters from the as-set. Without one they fall back to the AS number alone, which breaks as soon as you have customers.","fix":"Create an as-set in your RIR’s IRR database and add it to your PeeringDB record.","section":"peering"},{"level":"warn","title":"No public NOC, policy or technical contact.","params":[],"detail":"Other networks use these addresses to set up peering and to reach you during an incident.","fix":"Add a role contact (for example noc@ or peering@ an address you monitor) with visibility Public.","section":"peering"}]},"url":"https://thenetworkery.com/tools/network-report?query=AS25384"}