[170623] in North American Network Operators' Group
Re: BGPMON Alert Questions
daemon@ATHENA.MIT.EDU (Bryan Tong)
Wed Apr 2 16:03:20 2014
In-Reply-To: <533C6128.3000802@ripe.net>
Date: Wed, 2 Apr 2014 13:44:48 -0600
From: Bryan Tong <contact@nullivex.com>
To: Rene Wilhelm <wilhelm@ripe.net>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Just got the same for 5 of my prefixes.
====================================================================
Possible Prefix Hijack (Code: 10)
====================================================================
Your prefix: 192.225.232.0/21:
Prefix Description: ARIN direct allocation
Update time: 2014-04-02 19:26 (UTC)
Detected by #peers: 1
Detected prefix: 192.225.232.0/21
Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
Provider,ID)
Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of
Thailand(CAT),TH)
ASpath: 18356 9931 4651 4761
Alert details:
https://portal.bgpmon.net/alerts.php?details&alert_id=41651791
Mark as false alert: https://portal.bgpmon.net/fp.php?aid=41651791
====================================================================
Possible Prefix Hijack (Code: 10)
====================================================================
Your prefix: 199.87.232.0/21:
Prefix Description: Direct ARIN allocation
Update time: 2014-04-02 19:26 (UTC)
Detected by #peers: 1
Detected prefix: 199.87.232.0/21
Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
Provider,ID)
Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of
Thailand(CAT),TH)
ASpath: 18356 9931 4651 4761
Alert details:
https://portal.bgpmon.net/alerts.php?details&alert_id=41651792
Mark as false alert: https://portal.bgpmon.net/fp.php?aid=41651792
====================================================================
Possible Prefix Hijack (Code: 10)
====================================================================
Your prefix: 162.245.228.0/24:
Update time: 2014-04-02 19:26 (UTC)
Detected by #peers: 1
Detected prefix: 162.245.228.0/24
Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
Provider,ID)
Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of
Thailand(CAT),TH)
ASpath: 18356 9931 4651 4761
Alert details:
https://portal.bgpmon.net/alerts.php?details&alert_id=41651793
Mark as false alert: https://portal.bgpmon.net/fp.php?aid=41651793
====================================================================
Possible Prefix Hijack (Code: 10)
====================================================================
Your prefix: 198.44.191.0/24:
Prefix Description: ARIN direct allocation
Update time: 2014-04-02 19:26 (UTC)
Detected by #peers: 1
Detected prefix: 198.44.191.0/24
Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
Provider,ID)
Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of
Thailand(CAT),TH)
ASpath: 18356 9931 4651 4761
Alert details:
https://portal.bgpmon.net/alerts.php?details&alert_id=41651794
Mark as false alert: https://portal.bgpmon.net/fp.php?aid=41651794
====================================================================
Possible Prefix Hijack (Code: 10)
====================================================================
Your prefix: 23.249.176.0/20:
Prefix Description: ARIN direct allocation
Update time: 2014-04-02 19:26 (UTC)
Detected by #peers: 1
Detected prefix: 23.249.176.0/20
Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
Provider,ID)
Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of
Thailand(CAT),TH)
ASpath: 18356 9931 4651 4761
Alert details:
https://portal.bgpmon.net/alerts.php?details&alert_id=41651795
Mark as false alert: https://portal.bgpmon.net/fp.php?aid=41651795
On Wed, Apr 2, 2014 at 1:12 PM, Rene Wilhelm <wilhelm@ripe.net> wrote:
>
> On 4/2/14, 8:51 PM, Joseph Jenkins wrote:
>
>> So I setup BGPMON for my prefixes and got an alert about someone in
>> Thailand announcing my prefix. Everything looks fine to me and I've
>> checked a bunch of different Looking Glasses and everything announcing
>> correctly.
>>
>> I am assuming I should be contacting the provider about their
>> misconfiguration and announcing my prefixes and get them to fix it. Any
>> other recommendations?
>>
>> Is there a way I can verify what they are announcing just to make sure
>> they
>> are still doing it?
>>
> You can check RIPEstat's BGP looking-glass:
>
> https://stat.ripe.net/widget/looking-glass#w.resource=8.37.93.0%2F24
>
> This combines the result of 13 RIPE RIS route collectors.
>
> A minute ago I saw the INDOSAT announcement at 2 locations (Amsterdam,
> Frankfurt) from 3 out of 101 peers, but it seems to have stopped just now.
>
> -- Rene
>
>
>
>
>> Here is the alert for reference:
>>
>> Your prefix: 8.37.93.0/24:
>>
>> Update time: 2014-04-02 18:26 (UTC)
>>
>> Detected by #peers: 2
>>
>> Detected prefix: 8.37.93.0/24
>>
>> Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
>> Provider,ID)
>>
>> Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of
>> Thailand(CAT),TH)
>>
>> ASpath: 18356 9931 4651 4761
>>
>>
>
>
--
eSited LLC
(701) 390-9638
