[170622] in North American Network Operators' Group
Re: Prefix hijack by AS4761 (was Re: BGPMON Alert Questions)
daemon@ATHENA.MIT.EDU (joel jaeggli)
Wed Apr 2 15:59:39 2014
Date: Wed, 02 Apr 2014 12:41:14 -0700
From: joel jaeggli <joelja@bogus.com>
To: Stephen Fulton <sf@lists.esoteric.ca>, nanog@nanog.org
In-Reply-To: <533C60B1.6080702@lists.esoteric.ca>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Kg1Skfsp4nefPAXQ0h2cWANooThpsAqbE
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
yeah you're seeing the impact of a pretty broad prefix injection
indosat's upstream filters seem to be working for the most part.
On 4/2/14, 12:10 PM, Stephen Fulton wrote:
> I'm seeing the same hijack of prefixes by multiple networks under my
> watch, at 18:40 UTC and 19:06 UTC.
>=20
> -- Stephen
>=20
>=20
> On 2014-04-02 2:51 PM, Joseph Jenkins wrote:
>> So I setup BGPMON for my prefixes and got an alert about someone in
>> Thailand announcing my prefix. Everything looks fine to me and I've
>> checked a bunch of different Looking Glasses and everything announcing=
>> correctly.
>>
>> I am assuming I should be contacting the provider about their
>> misconfiguration and announcing my prefixes and get them to fix it. A=
ny
>> other recommendations?
>>
>> Is there a way I can verify what they are announcing just to make sure=
>> they
>> are still doing it?
>>
>> Here is the alert for reference:
>>
>> Your prefix: 8.37.93.0/24:
>>
>> Update time: 2014-04-02 18:26 (UTC)
>>
>> Detected by #peers: 2
>>
>> Detected prefix: 8.37.93.0/24
>>
>> Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
>> Provider,ID)
>>
>> Upstream AS: AS4651 (THAI-GATEWAY The Communications
>> Authority of
>> Thailand(CAT),TH)
>>
>> ASpath: 18356 9931 4651 4761
>>
>=20
--Kg1Skfsp4nefPAXQ0h2cWANooThpsAqbE
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlM8Z9oACgkQ8AA1q7Z/VrKViwCeOvPHANNQPoIQJBUMOod3+23a
6sQAn3csJ5hBPbr+j1Hh+YHweXpHcuNW
=vWa4
-----END PGP SIGNATURE-----
--Kg1Skfsp4nefPAXQ0h2cWANooThpsAqbE--
