[109190] in North American Network Operators' Group
Re: Potential Prefix Hijack
daemon@ATHENA.MIT.EDU (Charlie Allom)
Mon Nov 10 22:07:54 2008
Date: Tue, 11 Nov 2008 03:06:18 +0000
From: Charlie Allom <charlie@playloudermsp.com>
To: Mark Tinka <mtinka@globaltransit.net>
In-Reply-To: <200811111054.09473.mtinka@globaltransit.net>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
--i7F3eY7HS/tUJxUd
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Tue, Nov 11, 2008 at 10:54:01AM +0800, Mark Tinka wrote:
> Hi all.
>=20
> Anyone know how we can contact AS16735 and their upstream=20
> AS27664. We think they are hijacking a number of our=20
> prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
Mine too -=20
94.228.64.0/20
89.200.216.0/21
193.34.28.0/23
Except I see it as AS16735: (47998 is me)
BGP routing table entry for 94.228.64.0/20
Paths: (3 available, best #3, table Default-IP-Routing-Table)
Advertised to non peer-group peers:
193.0.0.71
27664 16735
200.219.130.21 from 200.219.130.21 (200.160.127.255)
Origin IGP, localpref 100, valid, external
Last update: Tue Nov 11 02:54:12 2008
19089 12956 5511 8928 47998
200.219.130.10 from 200.219.130.10 (200.225.95.3)
Origin IGP, localpref 100, valid, external
Community: 12956:65535
Last update: Mon Nov 10 18:40:54 2008
22548 16735
200.160.0.130 from 200.160.0.130 (200.160.0.137)
Origin IGP, localpref 100, valid, external, best
Last update: Tue Nov 11 02:51:57 2008
> RIPE's RIS BGPlay confirms the same, for about the last=20
> hour.
yep since 2am GMT.
C.
--=20
020 7729 4797
http://blog.playlouder.com/
--i7F3eY7HS/tUJxUd
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
iEYEARECAAYFAkkY9qoACgkQlXJxiNe4tg9RmQCbBOFUO2socstwO9B+DIKSs9dy
IMwAoJDX6tT6ZdZs0/03AhD3mO6NGMH9
=mun3
-----END PGP SIGNATURE-----
--i7F3eY7HS/tUJxUd--
