[108055] in North American Network Operators' Group
Re: prefix hijack by ASN 8997
daemon@ATHENA.MIT.EDU (Hank Nussbacher)
Tue Sep 23 02:53:30 2008
Date: Tue, 23 Sep 2008 09:53:17 +0300 (IDT)
From: Hank Nussbacher <hank@efes.iucc.ac.il>
To: Andree Toonk <andree+nanog@toonk.nl>
In-Reply-To: <20080923063353.GA3558@toonk.nl>
Cc: nanog@merit.edu
Errors-To: nanog-bounces@nanog.org
On Tue, 23 Sep 2008, Andree Toonk wrote:
> Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files.
> Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a full table, i.e. :
> * 217.208 unique prefixes detected by the RIS server in Moscow (ASpath: 2895 3267 8997)
> * 250495 seen by routeviews (ASpath: 2895 3267 8997).
> (results of quick query: where AS-path contained '3267 8997' update type = advertisement).
>
> ASpath: 2895 3267 8997
Is that the only ASpath that leaked it? There are others - did they
filter properly and only that path failed to filter?
Regards,
Hank