[109197] in North American Network Operators' Group
RE: Potential Prefix Hijack
daemon@ATHENA.MIT.EDU (Frank Bulk)
Tue Nov 11 01:12:55 2008
From: "Frank Bulk" <frnkblk@iname.com>
To: "'Tim Peiffer'" <peiffer@umn.edu>,
<mtinka@globaltransit.net>
In-Reply-To: <4918F63D.3060407@umn.edu>
Date: Tue, 11 Nov 2008 00:12:07 -0600
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
More contact people here:
http://www.bovespa.com.br/Companies/FormConsultaImpressao.asp?CodCVM=3D21=
032
If I knew someone (readily available) who spoke Portuguese I would call =
them, but alas, they are sleeping and not technical.
Frank
-----Original Message-----
From: Tim Peiffer [mailto:peiffer@umn.edu]=20
Sent: Monday, November 10, 2008 9:04 PM
To: mtinka@globaltransit.net
Cc: nanog@nanog.org
Subject: Re: Potential Prefix Hijack
Mark Tinka wrote:
> Hi all.
>
> Anyone know how we can contact AS16735 and their upstream
> AS27664. We think they are hijacking a number of our
> prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
>
>
All 19 of my prefixes for AS57, AS217 and AS1998 are being hijacked by
the same ASN. I sent a note to the ASN contact
adrianamr@CTBCTELECOM.NET.BR. I can't seem to contact lacnic for more
than a few queries without being blacked out.
Tim Peiffer
Network Support Engineer
Office of Information Technology
University of Minnesota/NorthernLights GigaPOP
% Joint Whois - whois.lacnic.net
% This server accepts single ASN, IPv4 or IPv6 queries
% LACNIC resource: whois.lacnic.net
% Copyright LACNIC lacnic.net
% The data below is provided for information purposes
% and to assist persons in obtaining information about or
% related to AS and IP numbers registrations
% By submitting a whois query, you agree to use this data
% only for lawful purposes.
% 2008-11-11 00:51:09 (BRST -02:00)
aut-num: AS16735
owner: Companhia de Telecomunicacoes do Brasil Central
ownerid: BR-CTBC1-LACNIC
responsible: Adriana Maria Rocha Paula
address: Av Jo=EF=BF=BDo Pinheiro, 620, Centro
address: 38400-126 - Uberl=EF=BF=BDndia - MG
country: BR
phone: +34 3256 2575 [2575]
owner-c: AMP
routing-c: AMP
abuse-c: AMP
created: 20000605
changed: 20040415
nic-hdl: AMP
person: Adriana Maria Rocha Paula
e-mail: adrianamr@CTBCTELECOM.NET.BR
address: Rua Jos=EF=BF=BD Alves Garcia, 415,
address: 38400710 - Uberl=EF=BF=BDndia -
country: BR
phone: +34 3256 2575 [2575]
created: 20040628
changed: 20040628
% whois.lacnic.net accepts only direct match queries.
% Types of queries are: POCs, ownerid, CIDR blocks, IP
% and AS numbers.
> e.g.,
>
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> Possible Prefix Hijack (Code: 11)
> 1 number of peer(s) detected this updates for your prefix
> 61.11.208.0/20:
> Update details: 2008-11-11 02:24 (UTC)
> 61.11.208.0/20
> Announced by: AS16735 (Companhia de Telecomunicacoes do
> Brasil Central)
> Transit AS: 27664 (CTBC Multim=EF=BF=BDdia)
> ASpath: 27664 16735
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>
> RIPE's RIS BGPlay confirms the same, for about the last
> hour.
>
> E-mails to them won't get there (of course), so our NOC are
> contacting them via Gmail/Yahoo.
>
> All help appreciated.
>
> Cheers,
>
> Mark.
>
