[114413] in North American Network Operators' Group
RE: Anomalies with AS13214 ?
daemon@ATHENA.MIT.EDU (Robert D. Scott)
Mon May 11 12:47:03 2009
From: "Robert D. Scott" <robert@ufl.edu>
To: <nanog@nanog.org>
In-Reply-To: <8FDD3859-44C7-4865-A61F-01F5D978C13D@pandora.com>
Date: Mon, 11 May 2009 12:46:01 -0400
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
It looks like Cyclops is seeing these from AS 48285, but I see no indication
they are being advertised to any production upstream provider. Our /16 is
being alerted in Cyclops, but I can not find any advert on any looking
glass.
>From Cyclops:
BGP protocol Time (UTC) W/A/B Peer IP Peer ASN Prefix AS_PATH Origin
NEXT_HOP LOCAL_PREF MED Community Atomic Agg Aggregator
BGP4MP 1242044196 A 194.71.0.1 48285 128.227.0.0/16 48285 13214 INCOMPLETE
194.71.0.1 0 0 NAG
Robert D. Scott Robert@ufl.edu
Senior Network Engineer 352-273-0113 Phone
CNS - Network Services 352-392-2061 CNS Phone Tree
University of Florida 352-392-9440 FAX
Florida Lambda Rail 352-294-3571 FLR NOC
Gainesville, FL 32611 321-663-0421 Cell
-----Original Message-----
From: James Kelty [mailto:jkelty@pandora.com]
Sent: Monday, May 11, 2009 12:20 PM
To: nanog@nanog.org
Subject: Re: Anomalies with AS13214 ?
Seeing the same issues with AS13214 and no corresponding drop in
traffic, route views doesn't show any rogue adverts for out prefixes
either.
-James
On May 11, 2009, at 9:01 AM, Vincent Hoffman wrote:
> On 11/5/09 16:30, Jay Hennigan wrote:
>> We're getting cyclops[1] alerts that AS13214 is advertising itself as
>> origin for all of our prefixes. Their anomaly report shows thousands
>> of prefixes originating there.
>>
>> Anyone else seeing evidence of this or being affected?
>>
>>
>> [1] http://cyclops.cs.ucla.edu/
>>
>
> I'm seeing alerts for AS13214 advertising our prefixes from
> cyclops also. However a quick look at a few looking glasses and route
> servers doesnt seem to show any rogue advertisments, and we havent see
> any drop in traffic as yet.
>
> Vince
>
>>
>> --
>> Jay Hennigan - CCIE #7880 - Network Engineering - jay@impulse.net
>> Impulse Internet Service - http://www.impulse.net/
>> Your local telephone and internet company - 805 884-6323 - WB6RDV
>
>
"Ravioli is the square root of pasta."
- Max K., Age 11
