[108083] in North American Network Operators' Group
Re: prefix hijack by ASN 8997
daemon@ATHENA.MIT.EDU (Jim Popovitch)
Tue Sep 23 15:56:01 2008
Date: Tue, 23 Sep 2008 15:55:45 -0400
From: "Jim Popovitch" <yahoo@jimpop.com>
To: nanog@merit.edu
In-Reply-To: <7ff145960809221913o1298820asf883adad7ce85628@mail.gmail.com>
Errors-To: nanog-bounces@nanog.org
On Mon, Sep 22, 2008 at 22:13, Jim Popovitch <yahoo@jimpop.com> wrote:
> On Mon, Sep 22, 2008 at 21:06, Scott Weeks <surfer@mauigateway.com> wrote:
>>
>> I am hoping to confirm a short-duration prefix hijack of 72.234.0.0/15 (and another of our
>> prefixes) by ASN 8997 ("OJSC North-West Telecom" in Russia) in using ASN 3267
>> (Russian Federal University Network) to advertise our space to ASN 3277 (Regional
>> University and Scientific Network (RUSNet) of North-Western and Saint-Petersburg
>> Area of Russia).
>
> Yep, saw this for 69.61.0.0/17 GlobalCompass (my upstream) this AM:
>
> SEQUENCE_NUMBER: 1222091638
> TYPE: last-hop
> BGP-UPDATE-TIME: 1222075864
> PHAS-DETECT-TIME: 1222091637
> PHAS-NOTIFY-TIME: 1222091637
> PREFIX: 69.61.0.0/17
> SET: 3561,3267,3356,3491
> GAINED: 3267 <- Russian Federal University Network
> LOST:
>
> SEQUENCE_NUMBER: 1222091638
> TYPE: origin
> BGP-UPDATE-TIME: 1222075864
> PHAS-DETECT-TIME: 1222091637
> PHAS-NOTIFY-TIME: 1222091637
> PREFIX: 69.61.0.0/17
> SET: 8997,22653
> GAINED: 8997 <- OJSC North-West Telecom, St.-Petersburg, Russia
> LOST:
>
> SEQUENCE_NUMBER: 1222096125
> TYPE: origin
> BGP-UPDATE-TIME: 1222076569
> PHAS-DETECT-TIME: 1222092415
> PHAS-NOTIFY-TIME: 1222096124
> PREFIX: 69.61.0.0/17
> SET: 22653 <- GlobalCrossing
Small typo on my part above... 22653 is GlobalCompass, not
GlobalCrossing as I mistakenly typed above.
-Jim P.
