[161401] in North American Network Operators' Group
Re: Odd announcement from AS27048
daemon@ATHENA.MIT.EDU (Jared Mauch)
Tue Mar 12 12:10:42 2013
From: Jared Mauch <jared@puck.nether.net>
In-Reply-To: <CAL9jLaYqBGbzNzP9M5SSuP6Vrx2dAqwUj5wC+PTv6F0cUQ9ssQ@mail.gmail.com>
Date: Tue, 12 Mar 2013 12:10:18 -0400
To: Christopher Morrow <morrowc.lists@gmail.com>
Cc: NANOG list <nanog@nanog.org>, ahebert@pubnix.net
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Mar 12, 2013, at 10:23 AM, Christopher Morrow wrote:
> On Tue, Mar 12, 2013 at 9:55 AM, Alain Hebert <ahebert@pubnix.net> =
wrote:
>> Hi,
>>=20
>> On the 5th we notice that 27048 was announcing 2 of ours /24
>>=20
>> 812 3549 209 721 27064 27047 27047 27047 27048
>>=20
>=20
> maybe 721 doesn't have prefix AND as-path filters? (or 209 maybe?)
> or intentional filtering gone wrong :(
=
http://puck.nether.net/bgp/leakinfo.cgi?search=3Ddo&search_prefix=3D&searc=
h_aspath=3D&search_asn=3D&recent=3D1000&source=3Dnanog20130312
I know I see lots of these cases of intentional filtering gone wrong.
eg: XO(2828) routes being leaked via a customer to Cogent(174)
I didn't see anything related to 27048 in the past few years history at =
all, but there is bad filtering all over the place.
Please combine as-path filtering with your traditional prefix-list =
filtering as well to block these as-paths.
- Jared=