[118024] in North American Network Operators' Group
Re: Invalid prefix announcement from AS9035 for 129.77.0.0/16
daemon@ATHENA.MIT.EDU (christian)
Fri Oct 9 10:36:43 2009
In-Reply-To: <017265BF3B9640499754DD48777C3D20664ECB076B@MBX9.EXCHPROD.USA.NET>
Date: Fri, 9 Oct 2009 07:35:34 -0700
From: christian <christian@automatick.net>
To: Dylan Ebner <dylan.ebner@crlmed.com>
Cc: NANOG <nanog@nanog.org>, Jim Cowie <cowie@renesys.com>
Reply-To: ck@automatick.net
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
there are multiple systems available, sign up for a few
i've noticed cyclops alerts are sent faster than bgpon
PHAS was fast, but the project is over and something new is going to be rel=
eased
there is ripe MyASN
there is watchmynet
and IAR
On Fri, Oct 9, 2009 at 7:23 AM, Dylan Ebner <dylan.ebner@crlmed.com> wrote:
> Does anyone know why it takes BGPMon so long to send out an email. It loo=
ks like it BGPMon detected the AS9035 announcements at the right time (arou=
nd 7:00 UTC) but I didn't get a notification until around 13:00 UTC. It see=
ms like many people rely on BGPMon to do this type of detection, so the lon=
g delay is frustrating.
>
> Thanks
>
>
> Dylan Ebner
>
> -----Original Message-----
> From: Jim Cowie [mailto:cowie@renesys.com]
> Sent: Friday, October 09, 2009 9:11 AM
> To: Adam Kennedy
> Cc: NANOG
> Subject: Re: Invalid prefix announcement from AS9035 for 129.77.0.0/16
>
> Lots of people were affected, but none significantly. =A0 They originated
> 86,747 networks very briefly (less than a minute at 7:23 UTC), and I don'=
t
> think anyone outside Telecom Italia's customer cone even saw them. =A0 So=
the
> impact was really, really limited. =A0The correct origins were being reas=
serted even before the last of the announcements came over the wire.
>
> It always irks me when I see "routing alerts" that arrive hours after the=
event is over, without any of the context that would allow you to know
> whether it had any real impact. =A0 Your instinct to check looking glasse=
s is
> the right one, but you have to move quickly and know where to look.
>
> Of course, I'm biased. =A0 =A0--jim
>
>
>
> On Fri, Oct 9, 2009 at 9:20 AM, Adam Kennedy <akennedy@cyberlinktech.com>=
wrote:
>
>> Agreed. Our prefixes at AS40060 were announced as well. I received a
>> notification around 7:00am EDT that our prefixes were detected
>> announced from AS9035 with the same upstream AS1267.
>>
>>
>> On 10/9/09 8:34 AM, "Wouter Prins" <wp@null0.nl> wrote:
>>
>> > Hi Matthew,
>> > You are not the only one having this issue. They are announcing some
>> other
>> > prefixes as well!
>> >
>> > 2009/10/9 Matthew Huff <mhuff@ox.com>
>> >
>> >> About 4 hours ago BGPmon picked up a rogue announcement of
>> >> 129.77.0.0
>> from
>> >> AS9035 (ASN-WIND Wind Telecomunicazioni spa) with an upstream of
>> >> AS1267 (ASN-INFOSTRADA Infostrada S.p.A.). I don't see it now on
>> >> any looking
>> glass
>> >> sites. Hopefully this was just a typo that was quickly corrected. I
>> would
>> >> appreciate if people have time and can double check let me know if
>> >> any announcements are active except from our AS6128/AS6395 upstreams.
>> >>
>> >> If this were to persist, what would be the best course of action to
>> resolve
>> >> it, especially given that the AS was within RIPE.
>> >>
>> >>
>> >> ----
>> >> Matthew Huff =A0 =A0 =A0 | One Manhattanville Rd
>> >> OTA Management LLC | Purchase, NY 10577 http://www.ox.com =A0| Phone:
>> >> 914-460-4039
>> >> aim: matthewbhuff =A0| Fax: =A0 914-460-4139
>> >>
>> >>
>> >>
>> >>
>> >
>>
>> --
>> Adam Kennedy
>> Senior Network Administrator
>> Cyberlink Technologies, Inc.
>> Phone: 888-293-3693 x4352
>> Fax: 574-855-5761
>>
>>
>>
>
>
>
