[108069] in North American Network Operators' Group
Re: prefix hijack by ASN 8997
daemon@ATHENA.MIT.EDU (Marshall Eubanks)
Tue Sep 23 12:04:17 2008
From: Marshall Eubanks <tme@multicasttech.com>
To: surfer@mauigateway.com
In-Reply-To: <20080923085421.79007543@resin11.mta.everyone.net>
Date: Tue, 23 Sep 2008 12:03:54 -0400
Cc: nanog@merit.edu
Errors-To: nanog-bounces@nanog.org
Note that my bgp was through Cogent - my guess is they did filter.
Marshall
On Sep 23, 2008, at 11:54 AM, Scott Weeks wrote:
>
> ------ tme@multicasttech.com wrote: ----------
> From: Marshall Eubanks <tme@multicasttech.com>
>
> So, do you think this was lots of little tests / hijacks / mistakes ?
> Or did it just not propagate very far ?
> ---------------------------------------------
>
> According to Andree Toonk (and someone confirmed privately) ASN 8997
> leaked a full table to ASN 3267 (who didn't filter!). The only
> upstream of ASN 3267 I saw in bgplay was ASN 174 (Cogent) who seems
> to have filtered, but I can't confirm. So I guess that the impact
> would've only been to the peers downstream of ASN 3267.
>
> scott
>
>
>
>
>
> ---------------------------------------------
> Andree Toonk <andree+nanog@toonk.nl>
>
> Not a false positive, It actually was detected by the RIS box in
> Moscow
> (rrc13). Strange that it's not visible in RIS search website, but it's
> definitely in the raw data files.
> Looking at that raw data from both routeviews and Ripe, it looks like
> they (AS8997) 'leaked' a full table, i.e. :
> ----------------------------------------------
>
