[108041] in North American Network Operators' Group
Re: prefix hijack by ASN 8997
daemon@ATHENA.MIT.EDU (Christian Koch)
Mon Sep 22 21:20:53 2008
Date: Mon, 22 Sep 2008 21:20:36 -0400
From: "Christian Koch" <christian@broknrobot.com>
To: surfer@mauigateway.com
In-Reply-To: <20080922180658.7901E5DA@resin11.mta.everyone.net>
Cc: nanog@merit.edu
Errors-To: nanog-bounces@nanog.org
I received a phas notification about this today as well...
I couldn't find any relevant data confirming the announcement of one
of my /19 blocks, until a few minutes ago when i checked the route
views bgplay (ripe bgplay turns up nothing) and can now see 8997
announcing and quickly withdrawing my prefix
On Mon, Sep 22, 2008 at 9:06 PM, Scott Weeks <surfer@mauigateway.com> wrote:
>
>
>
> I am hoping to confirm a short-duration prefix hijack of 72.234.0.0/15 (and another of our prefixes) by ASN 8997 ("OJSC North-West Telecom" in Russia) in using ASN 3267 (Russian Federal University Network) to advertise our space to ASN 3277 (Regional University and Scientific Network (RUSNet) of North-Western and Saint-Petersburg Area of Russia).
>
> Is that what I'm seeing when I go to "bgplay.routeviews.org/bgplay", put in prefix 72.234.0.0/15 and select the dates:
>
> 22/9/2008 9:00:00 and 22/9/2008 15:00:00
>
> If so, am I understanding it correctly if I say ASN 3267 saw a shorter path from ASN 8997, so refused the proper announcement from ASN 36149 (me) it normally hears from ASN 174 (Cogent).
>
> If the above two are correct, would it be correct to say only the downstream customers of ASN 3267 were affected?
>
> scott
>
>
