{"tool":"network-report","status":"fail","input":{"query":"AS4812"},"findings":[{"level":"fail","text":"AS4812 (CHINANET-SH-AP) announces 499 IPv4 and 101 IPv6 prefixes.","title":"AS4812 (CHINANET-SH-AP) announces 499 IPv4 and 101 IPv6 prefixes.","params":{"query":"AS4812","who":"AS4812 (CHINANET-SH-AP)","v4":499,"v6":101}},{"level":"fail","text":"3 of 600 announced prefixes are RPKI invalid: 43.242.96.0/23, 45.253.26.0/24, 45.253.27.0/24.","title":"3 of 600 announced prefixes are RPKI invalid: 43.242.96.0/23, 45.253.26.0/24, 45.253.27.0/24.","params":{"count":3,"total":600,"list":"43.242.96.0/23, 45.253.26.0/24, 45.253.27.0/24"},"detail":"A ROA covers them but does not allow this origin or prefix length, so networks that filter (most large ones do) drop these routes.","fix":"Fix the ROAs (origin AS and max length) at your RIR, or stop announcing the routes."},{"level":"warn","text":"8 of 600 announced prefixes have no ROA (RPKI not found): 43.254.220.0/24, 43.254.221.0/24, 43.254.222.0/24, 43.254.223.0/24, 45.115.144.0/22 (+3).","title":"8 of 600 announced prefixes have no ROA (RPKI not found): 43.254.220.0/24, 43.254.221.0/24, 43.254.222.0/24, 43.254.223.0/24, 45.115.144.0/22 (+3).","params":{"count":8,"total":600,"list":"43.254.220.0/24, 43.254.221.0/24, 43.254.222.0/24, 43.254.223.0/24, 45.115.144.0/22 (+3)","asn":4812},"detail":"Without a ROA, networks cannot tell your routes from a hijack.","fix":"Create a ROA for each at your RIR portal, with origin AS4812 and a max length equal to the prefix length:","record":"43.254.220.0/24 AS4812 max-length /24\n43.254.221.0/24 AS4812 max-length /24\n43.254.222.0/24 AS4812 max-length /24\n43.254.223.0/24 AS4812 max-length /24\n45.115.144.0/22 AS4812 max-length /22\n45.124.124.0/22 AS4812 max-length /22\n61.151.0.0/16 AS4812 max-length /16\n61.151.128.0/17 AS4812 max-length /17"},{"level":"warn","text":"14 of 600 announced prefixes have no IRR route object: 45.253.26.0/24, 221.133.232.0/24, 180.235.64.0/21, 103.222.40.0/24, 103.116.78.0/24 (+9).","title":"14 of 600 announced prefixes have no IRR route object: 45.253.26.0/24, 221.133.232.0/24, 180.235.64.0/21, 103.222.40.0/24, 103.116.78.0/24 (+9).","params":{"count":14,"total":600,"list":"45.253.26.0/24, 221.133.232.0/24, 180.235.64.0/21, 103.222.40.0/24, 103.116.78.0/24 (+9)","asn":4812},"detail":"Many networks build their prefix filters from IRR data; without route objects some of them drop the routes.","fix":"Create route (IPv4) and route6 (IPv6) objects with origin AS4812 in your RIR’s IRR database (or RADB).","record":"route: 45.253.26.0/24\norigin: AS4812\n\nroute: 221.133.232.0/24\norigin: AS4812\n\nroute: 180.235.64.0/21\norigin: AS4812"},{"level":"warn","text":"PeeringDB did not answer: HTTP 404","title":"PeeringDB did not answer: HTTP 404","params":{"error":"HTTP 404"},"fix":"Try again in a minute."}],"data":{"query":"AS4812","kind":"asn","special":null,"allocation":{"rir":"apnic","registry":"APNIC","cc":"CN","country":"China","date":"1996-01-09","status":"allocated","range":"AS4812 – AS4813","opaque_id":"A914EAE4","special":null},"verdict":{"level":"fail","title":":who announces :v4 IPv4 and :v6 IPv6 prefixes.","params":{"query":"AS4812","who":"AS4812 (CHINANET-SH-AP)","v4":499,"v6":101}},"seconds":1,"sections":{"routing":{"status":"fail","findings":[{"level":"pass","title":"AS:asn announces :v4 IPv4 and :v6 IPv6 prefixes.","params":{"asn":4812,"v4":499,"v6":101}},{"tool":["rpki",{"prefix":"43.242.96.0/23","asn":"4812"}],"guide":"create-rpki-roas","level":"fail","title":":count of :total announced prefixes are RPKI invalid: :list.","params":{"count":3,"total":600,"list":"43.242.96.0/23, 45.253.26.0/24, 45.253.27.0/24"},"detail":"A ROA covers them but does not allow this origin or prefix length, so networks that filter (most large ones do) drop these routes.","fix":"Fix the ROAs (origin AS and max length) at your RIR, or stop announcing the routes."},{"tool":["rpki",{"prefix":"43.254.220.0/24","asn":"4812"}],"guide":"create-rpki-roas","level":"warn","title":":count of :total announced prefixes have no ROA (RPKI not found): :list.","params":{"count":8,"total":600,"list":"43.254.220.0/24, 43.254.221.0/24, 43.254.222.0/24, 43.254.223.0/24, 45.115.144.0/22 (+3)","asn":4812},"detail":"Without a ROA, networks cannot tell your routes from a hijack.","fix":"Create a ROA for each at your RIR portal, with origin AS:asn and a max length equal to the prefix length:","record":"43.254.220.0/24 AS4812 max-length /24\n43.254.221.0/24 AS4812 max-length /24\n43.254.222.0/24 AS4812 max-length /24\n43.254.223.0/24 AS4812 max-length /24\n45.115.144.0/22 AS4812 max-length /22\n45.124.124.0/22 AS4812 max-length /22\n61.151.0.0/16 AS4812 max-length /16\n61.151.128.0/17 AS4812 max-length /17"},{"level":"info","title":":count of :total announced prefixes are RPKI valid.","params":{"count":503,"total":600}},{"level":"info","title":"The RPKI state of :count prefixes was not looked up (no ROA of AS:asn covers them; only the first :n are checked).","params":{"count":86,"asn":4812,"n":10}},{"level":"warn","title":":count of :total announced prefixes have no IRR route object: :list.","params":{"count":14,"total":600,"list":"45.253.26.0/24, 221.133.232.0/24, 180.235.64.0/21, 103.222.40.0/24, 103.116.78.0/24 (+9)","asn":4812},"detail":"Many networks build their prefix filters from IRR data; without route objects some of them drop the routes.","fix":"Create route (IPv4) and route6 (IPv6) objects with origin AS:asn in your RIR’s IRR database (or RADB).","record":"route: 45.253.26.0/24\norigin: AS4812\n\nroute: 221.133.232.0/24\norigin: AS4812\n\nroute: 180.235.64.0/21\norigin: AS4812"},{"level":"info","title":":left upstreams and peers, :right downstream networks seen.","params":{"left":2,"right":49}}],"data":{"asn":4812,"holder":"CHINANET-SH-AP - China Telecom (Group)","announced":true,"v4":499,"v6":101,"prefixes":["36.111.0.0/20","43.240.124.0/24","43.240.192.0/22","43.240.196.0/22","43.242.96.0/23","43.247.100.0/24","43.247.101.0/24","43.247.102.0/24","43.247.103.0/24","43.254.44.0/22","43.254.106.0/24","43.254.152.0/24","43.254.220.0/24","43.254.221.0/24","43.254.222.0/24","43.254.223.0/24","45.115.144.0/22","45.124.124.0/22","45.253.26.0/24","45.253.27.0/24","58.32.0.0/14","58.32.0.0/16","58.32.0.0/17","58.32.128.0/17","58.33.0.0/16","58.33.218.0/24","58.34.0.0/16","58.34.26.0/24","58.34.164.0/24","58.35.0.0/16","58.35.0.0/17","58.35.128.0/17","58.36.0.0/14","58.37.0.0/16","58.38.0.0/16","58.40.0.0/16","58.41.0.0/16","58.41.0.0/17","59.153.92.0/22","61.129.0.0/16","61.129.0.0/17","61.129.128.0/17","61.151.0.0/16","61.151.0.0/17","61.151.128.0/17","61.151.238.0/23","61.152.0.0/16","61.165.0.0/16","61.165.0.0/17","61.165.128.0/17","61.169.0.0/16","61.169.0.0/17","61.169.58.0/24","61.169.128.0/17","61.170.0.0/18","61.170.64.0/18","61.170.128.0/17","61.171.0.0/16","61.171.0.0/17","61.171.128.0/17","61.172.0.0/16","61.173.0.0/16","61.173.0.0/17","61.173.128.0/17","101.80.0.0/13","101.82.0.0/15","101.87.0.0/16","101.88.0.0/13","101.90.0.0/16","101.95.144.0/24","101.95.174.0/24","101.96.10.0/23","101.224.0.0/13","101.226.0.0/16","101.226.186.0/23","101.226.188.0/22","101.226.192.0/22","101.227.0.0/16","101.228.0.0/17","101.228.0.0/19","101.228.32.0/19","101.228.64.0/19","101.228.96.0/19","101.230.0.0/15","101.230.0.0/16","101.230.64.0/18","101.230.80.0/20","101.230.128.0/18","101.230.152.0/24","101.230.155.0/24","101.230.177.0/24","101.230.215.0/24","101.230.226.0/24","101.230.250.0/24","101.230.253.0/24","101.231.0.0/16","101.231.36.0/24","103.5.192.0/23","103.5.194.0/24","103.6.220.0/22"],"rpki":{"valid":503,"invalid":3,"not-found":8,"unchecked":86},"rpki_problems":[{"prefix":"43.242.96.0/23","state":"invalid"},{"prefix":"45.253.26.0/24","state":"invalid"},{"prefix":"45.253.27.0/24","state":"invalid"},{"prefix":"43.254.220.0/24","state":"not-found"},{"prefix":"43.254.221.0/24","state":"not-found"},{"prefix":"43.254.222.0/24","state":"not-found"},{"prefix":"43.254.223.0/24","state":"not-found"},{"prefix":"45.115.144.0/22","state":"not-found"},{"prefix":"45.124.124.0/22","state":"not-found"},{"prefix":"61.151.0.0/16","state":"not-found"},{"prefix":"61.151.128.0/17","state":"not-found"}],"irr_missing":["45.253.26.0/24","221.133.232.0/24","180.235.64.0/21","103.222.40.0/24","103.116.78.0/24","103.116.77.0/24","103.222.42.0/24","45.253.27.0/24","103.108.244.0/24","103.222.41.0/24","221.133.235.0/24","103.116.76.0/24","43.242.96.0/23","103.222.43.0/24"],"irr_missing_count":14,"bogons":[],"upstreams":[{"asn":4134,"power":11384,"name":"China Telecom"},{"asn":4809,"power":848,"name":"China Telecom / CN2"}],"left":2,"right":49},"title":"Routing and RPKI","tool":"bgp","tool_input":{"query":"AS4812"},"summary":{"level":"fail","title":":count of :total announced prefixes are RPKI invalid: :list.","params":{"count":3,"total":600,"list":"43.242.96.0/23, 45.253.26.0/24, 45.253.27.0/24"}}},"registration":{"status":"pass","findings":[{"level":"pass","title":"Found at :server.","params":{"server":"rdap.apnic.net"}}],"data":{"query":"AS4812","looked_up":"AS4812","kind":"autnum","source":"https://rdap.apnic.net/autnum/4812","terms":"https://www.apnic.net/about-apnic/whois_search/about/termsofuse/","summary":{"Name":"CHINANET-SH-AP","Handle":"AS4812","Range":"AS4812","Country":"CN","Status":"active","Registered":"2008-09-04T06:40:30Z","Last changed":"2020-05-13T04:20:58Z","Abuse contact":"anti-spam@chinatelecom.cn"},"entities":[{"roles":["technical"],"kind":"individual","name":"Shi Jin","email":"shijin@sh163.net"},{"roles":["abuse"],"kind":"group","name":"IRT-CHINANET-CN","email":"anti-spam@chinatelecom.cn"},{"roles":["technical"],"kind":"individual","name":"Chen Benyuan","email":"cbenyuan@capricorn.sta.net.cn"},{"roles":["administrative"],"kind":"individual","name":"Wu Xiao Li","email":"ipms@shtel.com.cn"},{"roles":["technical"],"kind":"individual","name":"Gu Xiao Han","email":"gxh999@sh163.net"}],"allocation":{"rir":"apnic","registry":"APNIC","cc":"CN","country":"China","date":"1996-01-09","status":"allocated","range":"AS4812 – AS4813","opaque_id":"A914EAE4","special":null}},"title":"Registration","tool":"whois","tool_input":{"query":"AS4812"},"summary":{"level":"pass","title":"Found at :server.","params":{"server":"rdap.apnic.net"}}},"peering":{"status":"warn","findings":[{"level":"warn","title":"PeeringDB did not answer: :error","params":{"error":"HTTP 404"},"fix":"Try again in a minute."}],"data":{"asn":4812,"error":"HTTP 404","ix":[],"fac":[]},"title":"PeeringDB","tool":"peeringdb","tool_input":{"asn":"4812"},"summary":{"level":"warn","title":"PeeringDB did not answer: :error","params":{"error":"HTTP 404"}}}},"fixes":[{"tool":["rpki",{"prefix":"43.242.96.0/23","asn":"4812"}],"guide":"create-rpki-roas","level":"fail","title":":count of :total announced prefixes are RPKI invalid: :list.","params":{"count":3,"total":600,"list":"43.242.96.0/23, 45.253.26.0/24, 45.253.27.0/24"},"detail":"A ROA covers them but does not allow this origin or prefix length, so networks that filter (most large ones do) drop these routes.","fix":"Fix the ROAs (origin AS and max length) at your RIR, or stop announcing the routes.","section":"routing"},{"tool":["rpki",{"prefix":"43.254.220.0/24","asn":"4812"}],"guide":"create-rpki-roas","level":"warn","title":":count of :total announced prefixes have no ROA (RPKI not found): :list.","params":{"count":8,"total":600,"list":"43.254.220.0/24, 43.254.221.0/24, 43.254.222.0/24, 43.254.223.0/24, 45.115.144.0/22 (+3)","asn":4812},"detail":"Without a ROA, networks cannot tell your routes from a hijack.","fix":"Create a ROA for each at your RIR portal, with origin AS:asn and a max length equal to the prefix length:","record":"43.254.220.0/24 AS4812 max-length /24\n43.254.221.0/24 AS4812 max-length /24\n43.254.222.0/24 AS4812 max-length /24\n43.254.223.0/24 AS4812 max-length /24\n45.115.144.0/22 AS4812 max-length /22\n45.124.124.0/22 AS4812 max-length /22\n61.151.0.0/16 AS4812 max-length /16\n61.151.128.0/17 AS4812 max-length /17","section":"routing"},{"level":"warn","title":":count of :total announced prefixes have no IRR route object: :list.","params":{"count":14,"total":600,"list":"45.253.26.0/24, 221.133.232.0/24, 180.235.64.0/21, 103.222.40.0/24, 103.116.78.0/24 (+9)","asn":4812},"detail":"Many networks build their prefix filters from IRR data; without route objects some of them drop the routes.","fix":"Create route (IPv4) and route6 (IPv6) objects with origin AS:asn in your RIR’s IRR database (or RADB).","record":"route: 45.253.26.0/24\norigin: AS4812\n\nroute: 221.133.232.0/24\norigin: AS4812\n\nroute: 180.235.64.0/21\norigin: AS4812","section":"routing"},{"level":"warn","title":"PeeringDB did not answer: :error","params":{"error":"HTTP 404"},"fix":"Try again in a minute.","section":"peering"}]},"url":"https://thenetworkery.com/tools/network-report?query=AS4812"}