[170631] in North American Network Operators' Group
Re: BGPMON Alert Questions
daemon@ATHENA.MIT.EDU (Andrew (Andy) Ashley)
Wed Apr 2 16:34:39 2014
From: "Andrew (Andy) Ashley" <andrew.a@aware.co.th>
To: "nanog@nanog.org" <nanog@nanog.org>
Date: Wed, 2 Apr 2014 19:33:33 +0000
In-Reply-To: <533C5F64.8020401@ramapo.edu>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
--B_3479319211_15237623
Content-type: text/plain;
charset="US-ASCII"
Content-transfer-encoding: 7bit
Hi All,
I am a network admin for Aware Corporation AS18356 (Thailand), as
mentioned in the alert.
We operate a BGPMon PeerMon node on our network, which peers with the
BGPMon service as a collector.
It is likely that AS4761 (INDOSAT) has somehow managed to hijack these
prefixes and CAT (Communications Authority of Thailand AS4651) is not
filtering them,
hence they are announced to us and are triggering these BGPMon alerts.
I have had several mails to our NOC about this already and have responded
directly to those.
I suggest contacting Indosat directly to get this resolved.
AS18356 is a stub AS, so we are not actually advertising these learned
hijacked prefixes to anyone but BGPMon for data collection purposes.
Thanks.
Regards,
Andrew Ashley
Office: +27 21 673 6841
E-mail: andrew.a@aware.co.th
Web: www.aware.co.th
On 2014/04/02, 21:05, "Vlade Ristevski" <vristevs@ramapo.edu> wrote:
>I just got the same alert for one of my prefixes one minute ago.
>
>On 4/2/2014 2:59 PM, Frank Bulk wrote:
>> I received a similar notification about one of our prefixes also a few
>> minutes ago. I couldn't find a looking glass for AS4761 or AS4651.
>>But I
>> also couldn't hit the websites for either AS, either.
>>
>> Frank
>>
>> -----Original Message-----
>> From: Joseph Jenkins [mailto:joe@breathe-underwater.com]
>> Sent: Wednesday, April 02, 2014 1:52 PM
>> To: nanog@nanog.org
>> Subject: BGPMON Alert Questions
>>
>> So I setup BGPMON for my prefixes and got an alert about someone in
>> Thailand announcing my prefix. Everything looks fine to me and I've
>> checked a bunch of different Looking Glasses and everything announcing
>> correctly.
>>
>> I am assuming I should be contacting the provider about their
>> misconfiguration and announcing my prefixes and get them to fix it. Any
>> other recommendations?
>>
>> Is there a way I can verify what they are announcing just to make sure
>>they
>> are still doing it?
>>
>> Here is the alert for reference:
>>
>> Your prefix: 8.37.93.0/24:
>>
>> Update time: 2014-04-02 18:26 (UTC)
>>
>> Detected by #peers: 2
>>
>> Detected prefix: 8.37.93.0/24
>>
>> Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
>> Provider,ID)
>>
>> Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority
>>of
>> Thailand(CAT),TH)
>>
>> ASpath: 18356 9931 4651 4761
>>
>>
>>
>
>--
>Vlad
>
>
--B_3479319211_15237623
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
MIIWhgYJKoZIhvcNAQcCoIIWdzCCFnMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B
BwGgghQLMIIGDjCCBPagAwIBAgIQfSI+bh1lCy3t459vY2YCXDANBgkqhkiG9w0BAQUFADCB
kzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMH
U2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENPTU9ETyBD
bGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTAeFw0xMzA5MTgwMDAw
MDBaFw0xNjA5MTcyMzU5NTlaMIIBHjELMAkGA1UEBhMCVEgxDjAMBgNVBBETBTUwMTQwMRMw
EQYDVQQIEwpDaGlhbmcgTWFpMRIwEAYDVQQHEwlBLlNhcmFwZWUxEzARBgNVBAkTCjI1LzEg
TW9vIDIxIjAgBgNVBAoTGUF3YXJlIENvcnBvcmF0aW9uIExpbWl0ZWQxPzA9BgNVBAsTNklz
c3VlZCB0aHJvdWdoIEF3YXJlIENvcnBvcmF0aW9uIExpbWl0ZWQgRS1QS0kgTWFuYWdlcjEf
MB0GA1UECxMWQ29ycG9yYXRlIFNlY3VyZSBFbWFpbDEWMBQGA1UEAxMNQW5kcmV3IEFzaGxl
eTEjMCEGCSqGSIb3DQEJARYUYW5kcmV3LmFAYXdhcmUuY28udGgwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQC00SUs9cTxVa0bQ9KyGHNeBu/+cthrR8ZqO+ddlKCUhbB+lmbq
q+6m203a6SM7jkU40NVVTuw1QBqJzW+XVDZhJQTc3DwKE1bJ3N7c95FBFujP0xc72r4DcrpV
ppDmhdSk1AVujjpl5tyAllQ4zix9cnGVPUCTmAUYVqGdbTgZCP9U0bQqNhzVpiGtGCloMVBP
aYJCRLkps8lgKJY3Wh9dKG/TLxVgjRgVUntaPcJL/r/w4mSP4ljtI+w7J0aNbPW7vOIyPG+L
uByBTdAiq2nhAcBCiGGdDvU7A0378YrqjsHriRWHZAnbCTqjy1do+PAV7ccVoExws3h6gKzX
8AJhAgMBAAGjggHOMIIByjAfBgNVHSMEGDAWgBR6E04AdFvGeGNkJ8Ev4qBbvHnFezAdBgNV
HQ4EFgQU6e0BoOsfvFdUQUHB+tPGw9/jx2wwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQC
MAAwHQYDVR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMEYGA1UdIAQ/MD0wOwYMKwYBBAGy
MQECAQMFMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5uZXQvQ1BTMFcG
A1UdHwRQME4wTKBKoEiGRmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET0NsaWVudEF1
dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcmwwgYgGCCsGAQUFBwEBBHwwejBSBggr
BgEFBQcwAoZGaHR0cDovL2NydC5jb21vZG9jYS5jb20vQ09NT0RPQ2xpZW50QXV0aGVudGlj
YXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29t
b2RvY2EuY29tMB8GA1UdEQQYMBaBFGFuZHJldy5hQGF3YXJlLmNvLnRoMA0GCSqGSIb3DQEB
BQUAA4IBAQA81BYN5mYdzj3/nHfE1Bu1nBoDplpRpSKTtto2UkieQVs4hIxD0Aa5cKSn64fG
tsdPUibE83ZM6Ul/Nl9arO/Xf6O6nGSc/xf5/GUqAaho5vDpfguWkdNb4jaFthn88nn++bep
DZzpSyzGjvzR8bg/DfQBjtoAmPdaFxISfoO+q3zn3ttKfBiTENXEGE5llSlUIzaGxxz/mj7V
aAH9kb9yXrKGtH++51Jqe5W0uauTgm2rbPOpIuDatmmRu+gafI8RhvpMqoQrGv52+t6rPeey
OtnILDJQLJIOTBDjzCvO1QC4ti3GGfrV5zZAhvPZy18XY50UMNFrUyY54QZovat8MIIFGjCC
BAKgAwIBAgIQbRnqpxlPajMi5iIyeqpx3jANBgkqhkiG9w0BAQUFADCBrjELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhl
IFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20x
NjA0BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFp
bDAeFw0xMTA0MjgwMDAwMDBaFw0yMDA1MzAxMDQ4MzhaMIGTMQswCQYDVQQGEwJHQjEbMBkG
A1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFD
T01PRE8gQ0EgTGltaXRlZDE5MDcGA1UEAxMwQ09NT0RPIENsaWVudCBBdXRoZW50aWNhdGlv
biBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
koSEW0tXmNReL4uk4UDIo1NYX2Zl8TJO958yfVXQeExVt0KU4PkncQfFxmmkuTLE8UAakMwn
VmJ/F7Vxaa7lIBvky2NeYMqiQfZq4aP/uN8fSG1lQ4wqLitjOHffsReswtqCAtbUMmrUZ28g
E49cNfrlVICv2HEKHTcKAlBTbJUdqRAUtJmVWRIx/wmi0kzcUtve4kABW0ho3cVKtODtJB86
r3FfB+OsvxQ7sCVxaD30D9YXWEYVgTxoi4uDD216IVfmNLDbMn7jSuGlUnJkJpFOpZIP/+Cx
YP0ab2hRmWONGoulzEKbm30iY9OpoPzOnpDfRBn0XFs1uhbzp5v/wQIDAQABo4IBSzCCAUcw
HwYDVR0jBBgwFoAUiYJnfcSdJnAAS7RQSHzePa4Ebn0wHQYDVR0OBBYEFHoTTgB0W8Z4Y2Qn
wS/ioFu8ecV7MA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBEGA1UdIAQK
MAgwBgYEVR0gADBYBgNVHR8EUTBPME2gS6BJhkdodHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20v
VVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50aWNhdGlvbmFuZEVtYWlsLmNybDB0BggrBgEF
BQcBAQRoMGYwPQYIKwYBBQUHMAKGMWh0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VVE5BZGRU
cnVzdENsaWVudF9DQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5j
b20wDQYJKoZIhvcNAQEFBQADggEBAIXWvnhXVW0zf0RS/kLVBqgBA4CK+w2y/Uq/9q9BSfUb
WsXSrRtzbj7pJnzmTJjBMCjfy/tCPKElPgp11tA9OYZm0aGbtU2bb68obB2v5ep0WqjascDx
dXovnrqTecr+4pEeVnSy+I3T4ENyG+2P/WA5IEf7i686ZUg8mD2lJb+972DgSeUWyOs/Q4Pw
4O4NwdPNM1+b0L1garM7/vrUyTo8H+2b/5tJM75CKTmD7jNpLoKdRU2oadqAGx490hpdfEeZ
pZsIbRKZhtZdVwcbpzC+S0lEuJB+ytF5OOu0M/qgOl0mWJ5hVRi0IdWZ1eBDQEIwvuql55TS
sP7zdfl/bucwggSdMIIDhaADAgECAhA0PekrrCc0/4/LNJT7zHBUMA0GCSqGSIb3DQEBBQUA
MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1
c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENB
IFJvb3QwHhcNMDUwNjA3MDgwOTEwWhcNMjAwNTMwMTA0ODM4WjCBrjELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVT
RVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0
BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALI5haTyfatBO2JGN67NwWB1vDll+Uoa
R6K5zEjMapjVTTUZuaRC5c5J4oovHnzSMQfHTrSDZJ0uKdWiZMSFvYVRNXmkTmiQexx6pJKo
F/KYFfKTzMmkMpW7DE8wvZigC4vlbhuiRvp4vKJvq1lepS/Pytptqi/rrKGzaqq3Lmc1i3nh
HmmI4uZGzaCl6r4LznY6eg6b6vzaJ1s9cx8i5khhxkzzabGoLhu21DEgLLyCio6kDqXXiUP8
FlqvHXHXEVnauocNr/rz4cLwpMVnjNbWVDreCqS6A3ezZcj9HtN0YqoYymiTHqGFfvVHZcv4
TVcodNI0/zC27vZiMBSMLOsCAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTv
A73gJMtUGjAdBgNVHQ4EFgQUiYJnfcSdJnAAS7RQSHzePa4Ebn0wDgYDVR0PAQH/BAQDAgEG
MA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9MDswOaA3oDWG
M2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LmNybDA1
BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20w
DQYJKoZIhvcNAQEFBQADggEBAAG8nONjKLDzMQHC33vdYqABnSMxD5ySc1NR6h9M+tafxMov
Z354Mw90FrmRh5H1iib6ZHAA2B75CwRiUIeTgdTa9SPbNLuFVrRwNG54gzcehRzFERWSX4cX
vaxq/fHC0cyJX7F88D5R8jXzfOxgmGs6K+Dv37N9huu1G/Vb7KJ8mBPXAFC50S1z3gN4dOEF
hTFey5q5nZTGuZQ3dXLcRPtn6PD6JR5Sp9ol6UfgoMc8oE6xCjb7d0if75eK+7T+45QUqIO8
XC0/0mBxYO7CcYIM6Yg249ogtKOgbKqWS7iAjnXKSQf2OxS639wF2Z/b4LLmTaB4JufnLW5/
X8YeiBUwggQ2MIIDHqADAgECAgEBMA0GCSqGSIb3DQEBBQUAMG8xCzAJBgNVBAYTAlNFMRQw
EgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5l
dHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3QwHhcNMDAwNTMwMTA0
ODM4WhcNMjAwNTMwMTA0ODM4WjBvMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3Qg
QUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlB
ZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAt/caM+byAAQtOeBOW+0fvGwPzbX6I7bO3psRM5ekKUx9k5+9SryT7QMa44/P5W1QWtaX
KZRagLBJetsulf24yr83OC0ePpFBrXBWx/BPP+gynnTKyJBU6cZfD3idmkA8Dqxhql4Uj56H
oWpQ3NeaTq8Fs6ZxlJxxs1BgCscTnTgHhgKo6ahpJhiQq0ywTyOrOk+E2N/On+Fpb7vXQtdr
ROTHre5tQV9yWnEIN7N5ZaRZoJQ39wAvDcKSctrQOHLbFKhFxF0qfbe01sTurM0TRLfJK91D
ACX6YblpalgjEbenM49WdVn1zSnXRrcKK2W200JvFbK4e/vv6V1T1TRaJwIDAQABo4HcMIHZ
MB0GA1UdDgQWBBStvZh6NLQm9/rEJlTvA73gJMtUGjALBgNVHQ8EBAMCAQYwDwYDVR0TAQH/
BAUwAwEB/zCBmQYDVR0jBIGRMIGOgBStvZh6NLQm9/rEJlTvA73gJMtUGqFzpHEwbzELMAkG
A1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRl
cm5hbCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdIIB
ATANBgkqhkiG9w0BAQUFAAOCAQEAsJvghSXC1iPiD5YGkp1BmJzZhHmB2R5bFAcjNmWPsNh3
u6xBbEdgg1Gw+TI95/z2JhPHgBalv1r8h894eYkhmuJMBwqGNbzy3lHE0pa33H5O7nD9HDnr
DAJRFC2OvRbgwd9Gdeckrez0QrSFk3AQZ7qdBjVKGNMresxRQqF6Y9Hmu6HFK8I2vhMN5r1j
fnl7pwkNQKtq3Y+Kw/b2jBpCBVHURfWfp2IhaBUgQzyZ53y9JNipkRdziD9WGzE4GLRxD5rN
yA6eji4b4YyYg8sfMfFETMYEc0l2YA/H+L0XgGsu6cxMDlqaeQ8gCi7VnmMmHlWSlNiCF1p7
0LzHj06GBDGCAj8wggI7AgEBMIGoMIGTMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRl
ciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGlt
aXRlZDE5MDcGA1UEAxMwQ09NT0RPIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJl
IEVtYWlsIENBAhB9Ij5uHWULLe3jn29jZgJcMA0GCWCGSAFlAwQCAQUAoGkwLwYJKoZIhvcN
AQkEMSIEILMz2dE9/hRoc5YE22j+1h83xfUXssV59D9D0OT7MaGIMBgGCSqGSIb3DQEJAzEL
BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE0MDQwMjE5MzMzMVowDQYJKoZIhvcNAQEB
BQAEggEAJOhevyU5RwRtKdLrij26uncUm5PjxQ0biRUZC8FbKUt8OCb51HjwHuE95BxzF225
Cx9zI5JuTUkpMaxREm9mQVhbLHS/y+Anm0G88XgqxlzUfgWwsdsOF7VdpA2srgs9tAGE0eQk
bjV6oI4HJELgP7/3ffLOseGoUJm2X9QSbhhBp0EBKj+TbJmCbgD6Xwf9gjOCAmGLsciMjpuW
eAoZtkxhRPz/pdwQgHc5c04WWq7cD9zFwVRCkuERVtSA1TJLi+MaVjkMTIgugvhO97LlXmnY
qdjVgdwn8bzD3ReZVMBtgS00dm+CKGsz5F96Pssa+WyZctoHfIeNKuuWrnmUgA==
--B_3479319211_15237623--
