[110586] in North American Network Operators' Group
Re: Anyone notice strange announcements for 174.128.31.0/24
daemon@ATHENA.MIT.EDU (Kevin Oberman)
Mon Jan 12 14:07:53 2009
To: "Paul Stewart" <pstewart@nexicomgroup.net>
In-Reply-To: Your message of "Mon, 12 Jan 2009 13:52:17 EST."
<89D27DE3375BB6428DDCC2927489826A01E70678@nexus.nexicomgroup.net>
Date: Mon, 12 Jan 2009 11:07:40 -0800
From: "Kevin Oberman" <oberman@es.net>
X-To: "Paul Stewart" <pstewart@nexicomgroup.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
--==_Exmh_1231787260_17004P
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
> Date: Mon, 12 Jan 2009 13:52:17 -0500
> From: "Paul Stewart" <pstewart@nexicomgroup.net>
>
> Same here.. got a notice this morning and while it's false, I still have
> no response from Randy neither on this matter...
>
> If they are going to involve our AS numbers and trigger alarms it would
> be nice to notify us first... especially on something as major as a
> prefix hijacking (potentially)
>
> Paul
>
>
>
> -----Original Message-----
> From: Majdi S. Abbas [mailto:msa@latt.net]
> Sent: Monday, January 12, 2009 1:49 PM
> To: Michienne Dixon
> Cc: nanog@nanog.org
> Subject: Re: Anyone notice strange announcements for 174.128.31.0/24
>
> On Mon, Jan 12, 2009 at 12:40:42PM -0600, Michienne Dixon wrote:
> > I'm not entirely certain what is going on but has anyone noticed some
> > strange announcements for 174.128.31.0/24?
> >
> > I received a hijack notice that my AS (AS11708) was announcing the
> above
> > IP range. I verified that I was not when I started noticing some
> > strange announcements for that range. Around 10 Am CST AS11911 was
> > announcing it (AS_PATH: 1239 2914 3130 11911) then around 11:30 AM
> CST
> > I observed AS12083 announcing it (AS_PATH: 1239 2914 3130 12083).
> >
> > Interestingly enough, ARIN indicates this is a part of range they have
> > assigned for reachability testing.
> > http://ws.arin.net/whois/?queryinput=174.128.31.0
>
> randy lied but
> no packets died
> enough now
>
> More seriously, this is indeed reachability research. Try
> emailing
> the AS 3130 contacts although I'd imagine Randy will see this.
http://psg.com/173-174/ explains what is going on.
--
R. Kevin Oberman, Network Engineer
Energy Sciences Network (ESnet)
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)
E-mail: oberman@es.net Phone: +1 510 486-8634
Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751
--==_Exmh_1231787260_17004P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (FreeBSD)
Comment: Exmh version 2.5 06/03/2002
iD8DBQFJa5T8kn3rs5h7N1ERAmxUAJ0Vgj57tPf3qvTPrt/egdsItqF61gCfee6M
exZDM6SJwhzbyhTIX5QKVks=
=gjoR
-----END PGP SIGNATURE-----
--==_Exmh_1231787260_17004P--
