[108062] in North American Network Operators' Group
comparison of hijack alert systems [was]: prefix hijack by ASN 8997
daemon@ATHENA.MIT.EDU (Scott Weeks)
Tue Sep 23 09:09:08 2008
Date: Tue, 23 Sep 2008 06:08:46 -0700
From: "Scott Weeks" <surfer@mauigateway.com>
To: <nanog@merit.edu>
Reply-To: surfer@mauigateway.com
Errors-To: nanog-bounces@nanog.org
On Mon, 22 Sep 2008, Scott Weeks wrote:
>
> I am hoping to confirm a short-duration prefix hijack
<snip>
--- hank@efes.iucc.ac.il wrote:
From: Hank Nussbacher <hank@efes.iucc.ac.il>
I too spotted this via PHAS for a large number of prefixes, but have not
received alerts from IAR, Watchmy.Net nor does RIPE RIS show this hijack:
http://www.ris.ripe.net/perl-risapp/risearch.html I would have expected
with so many RRC boxes that RIPE RIS would have caught it. I had thought
it was a false positive from PHAS but now that you and others have seen it
- I guess it is for real.
----------------------------------------
It'd be very interesting to compare said systems using this event. I have not subscribed to MyASN or watchmy.net yet, so I can't do that. I do note, however, that PHAS took 4 hours and 20 minutes to email me, which is within the specs noted on their site.
scott
