[109202] in North American Network Operators' Group
Re: Potential Prefix Hijack
daemon@ATHENA.MIT.EDU (Nuno Vieira - nfsi telecom)
Tue Nov 11 07:37:28 2008
Date: Tue, 11 Nov 2008 12:33:43 +0000 (WET)
From: Nuno Vieira - nfsi telecom <nuno.vieira@nfsi.pt>
To: Network Fortius <netfortius@gmail.com>
In-Reply-To: <316672631.33721226406276486.JavaMail.root@zimbra.nfsi.pt>
Cc: nanog@nanog.org
Reply-To: Nuno Vieira - nfsi telecom <nuno.vieira@nfsi.pt>
Errors-To: nanog-bounces@nanog.org
Howdy,
We were hijacked aswell, by 27664 16735=20
Our affected prefixes were:
94.46.0.0/16
194.88.142.0/23
194.11.23.0/24
82.102.0.0/18
195.246.238.0/23
194.107.127.0/24
81.92.192.0/19
193.227.238.0/23
We are trying to contact them in order to get some feedback, and some good =
explanation for this.
In the meanwhile, there are lots of evidence spread around (thanks to RIS R=
IPE, Routeviews, BGPmon and others)
http://www.ris.ripe.net/dashboard/27664
http://www.ris.ripe.net/dashboard/16735
In the meanwhile we are sending notices to the Upstreams of those ASN's, in=
order for them to apply proper filtering to their downstream customers to =
avoid situations like this.
On the List i was able to found:
AS8167 - TELESC
AS6762 - SEABONE
AS12956 - TELEFONICA
AS3549 - GLOBAL CROSSING
AS17379 - Interlig
I welcome others to do the same, in order to avoid replicas for this situat=
ion.
Regards,
---
Nuno Vieira
nfsi telecom, lda.
nuno.vieira@nfsi.pt
Tel. (+351) 21 949 2300 - Fax (+351) 21 949 2301
http://www.nfsi.pt/
----- "Network Fortius" <netfortius@gmail.com> wrote:
> Same problems here, for AS26028
> Stefan
>=20
> On Mon, Nov 10, 2008 at 8:54 PM, Mark Tinka
> <mtinka@globaltransit.net>wrote:
>=20
> > Hi all.
> >
> > Anyone know how we can contact AS16735 and their upstream
> > AS27664. We think they are hijacking a number of our
> > prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
> >
> > e.g.,
> >
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> > Possible Prefix Hijack (Code: 11)
> > 1 number of peer(s) detected this updates for your prefix
> > 61.11.208.0/20:
> > Update details: 2008-11-11 02:24 (UTC)
> > 61.11.208.0/20
> > Announced by: AS16735 (Companhia de Telecomunicacoes do
> > Brasil Central)
> > Transit AS: 27664 (CTBC Multim=C3=ADdia)
> > ASpath: 27664 16735
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> >
> > RIPE's RIS BGPlay confirms the same, for about the last
> > hour.
> >
> > E-mails to them won't get there (of course), so our NOC are
> > contacting them via Gmail/Yahoo.
> >
> > All help appreciated.
> >
> > Cheers,
> >
> > Mark.
> >
