[170644] in North American Network Operators' Group
Re: BGPMON Alert Questions
daemon@ATHENA.MIT.EDU (Andrew (Andy) Ashley)
Wed Apr 2 17:22:01 2014
From: "Andrew (Andy) Ashley" <andrew.a@aware.co.th>
To: Aris Lambrianidis <effulgence@gmail.com>
Date: Wed, 2 Apr 2014 21:05:47 +0000
In-Reply-To: <CAHRe1_Rd9jyY0K5bET8idqjYsHsingrX__B8dcq-3bvjgj4e2Q@mail.gmail.com>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
--B_3479324744_15588931
Content-type: text/plain;
charset="ISO-8859-1"
Content-transfer-encoding: quoted-printable
I got a bounce from Indosat saying:
"Dear Senders,
Thank you for your email, started March,1st 2012 email address for
correspondence with Indosat IP Support & All Support INP will be change and
not active with detail information as follows :
1. Correspondence and complain handling for Indosat Corporate customers
(INP, IDIA and INIX services) please kindly address to :
corporatesolution@indosat.com (Service Desk MIDI Indosat Corporate Solution=
)
2. Correspondence and coordination for upstream and peering purpose please
kindly address to : SNOCIPSurv@indosat.com (SNOC IP Surveillance)
Thank you for your kind cooperation and understanding.
Indosat IP Support"
Perhaps the =B3SNOC IP Surveillance=B2 address is better?
For CAT Thailand, the contact details I have are:
NOC call center
CAT Telecom
Tel: 66 2 104 2382
FAX: 66 2 104 2281
e-mail: cusserv@cattelecom.com
As someone mentioned, English may be an issue, especially at this time of
the morning over there.
Regards,
Andrew Ashley
Office: +27 21 673 6841
E-mail: andrew.a@aware.co.th
Web: www.aware.co.th
From: Aris Lambrianidis <effulgence@gmail.com>
Date: Wednesday 02 April 2014 at 22:40
To: Andrew Ashley <andrew.a@aware.co.th>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Subject: Re: BGPMON Alert Questions
Contacted ip.tac@indosat.com about this, I urge others to do the same.
--Aris
On Wed, Apr 2, 2014 at 9:33 PM, Andrew (Andy) Ashley <andrew.a@aware.co.th>
wrote:
> Hi All,
>=20
> I am a network admin for Aware Corporation AS18356 (Thailand), as
> mentioned in the alert.
> We operate a BGPMon PeerMon node on our network, which peers with the
> BGPMon service as a collector.
>=20
> It is likely that AS4761 (INDOSAT) has somehow managed to hijack these
> prefixes and CAT (Communications Authority of Thailand AS4651) is not
> filtering them,
> hence they are announced to us and are triggering these BGPMon alerts.
>=20
> I have had several mails to our NOC about this already and have responded
> directly to those.
> I suggest contacting Indosat directly to get this resolved.
> AS18356 is a stub AS, so we are not actually advertising these learned
> hijacked prefixes to anyone but BGPMon for data collection purposes.
>=20
> Thanks.
>=20
> Regards,
>=20
> Andrew Ashley
>=20
> Office: +27 21 673 6841 <tel:%2B27%2021%20673%206841>
> E-mail: andrew.a@aware.co.th
> Web: www.aware.co.th <http://www.aware.co.th>
>=20
>=20
>=20
> On 2014/04/02, 21:05, "Vlade Ristevski" <vristevs@ramapo.edu> wrote:
>=20
>> >I just got the same alert for one of my prefixes one minute ago.
>> >
>> >On 4/2/2014 2:59 PM, Frank Bulk wrote:
>>> >> I received a similar notification about one of our prefixes also a f=
ew
>>> >> minutes ago. I couldn't find a looking glass for AS4761 or AS4651.
>>> >>But I
>>> >> also couldn't hit the websites for either AS, either.
>>> >>
>>> >> Frank
>>> >>
>>> >> -----Original Message-----
>>> >> From: Joseph Jenkins [mailto:joe@breathe-underwater.com]
>>> >> Sent: Wednesday, April 02, 2014 1:52 PM
>>> >> To: nanog@nanog.org
>>> >> Subject: BGPMON Alert Questions
>>> >>
>>> >> So I setup BGPMON for my prefixes and got an alert about someone in
>>> >> Thailand announcing my prefix. Everything looks fine to me and I've
>>> >> checked a bunch of different Looking Glasses and everything announci=
ng
>>> >> correctly.
>>> >>
>>> >> I am assuming I should be contacting the provider about their
>>> >> misconfiguration and announcing my prefixes and get them to fix it. =
Any
>>> >> other recommendations?
>>> >>
>>> >> Is there a way I can verify what they are announcing just to make su=
re
>>> >>they
>>> >> are still doing it?
>>> >>
>>> >> Here is the alert for reference:
>>> >>
>>> >> Your prefix: 8.37.93.0/24 <http://8.37.93.0/24> :
>>> >>
>>> >> Update time: 2014-04-02 18:26 (UTC)
>>> >>
>>> >> Detected by #peers: 2
>>> >>
>>> >> Detected prefix: 8.37.93.0/24 <http://8.37.93.0/24>
>>> >>
>>> >> Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Networ=
k
>>> >> Provider,ID)
>>> >>
>>> >> Upstream AS: AS4651 (THAI-GATEWAY The Communications Author=
ity
>>> >>of
>>> >> Thailand(CAT),TH)
>>> >>
>>> >> ASpath: 18356 9931 4651 4761
>>> >>
>>> >>
>>> >>
>> >
>> >--
>> >Vlad
>> >
>> >
--B_3479324744_15588931
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
MIIWhgYJKoZIhvcNAQcCoIIWdzCCFnMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B
BwGgghQLMIIGDjCCBPagAwIBAgIQfSI+bh1lCy3t459vY2YCXDANBgkqhkiG9w0BAQUFADCB
kzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMH
U2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENPTU9ETyBD
bGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTAeFw0xMzA5MTgwMDAw
MDBaFw0xNjA5MTcyMzU5NTlaMIIBHjELMAkGA1UEBhMCVEgxDjAMBgNVBBETBTUwMTQwMRMw
EQYDVQQIEwpDaGlhbmcgTWFpMRIwEAYDVQQHEwlBLlNhcmFwZWUxEzARBgNVBAkTCjI1LzEg
TW9vIDIxIjAgBgNVBAoTGUF3YXJlIENvcnBvcmF0aW9uIExpbWl0ZWQxPzA9BgNVBAsTNklz
c3VlZCB0aHJvdWdoIEF3YXJlIENvcnBvcmF0aW9uIExpbWl0ZWQgRS1QS0kgTWFuYWdlcjEf
MB0GA1UECxMWQ29ycG9yYXRlIFNlY3VyZSBFbWFpbDEWMBQGA1UEAxMNQW5kcmV3IEFzaGxl
eTEjMCEGCSqGSIb3DQEJARYUYW5kcmV3LmFAYXdhcmUuY28udGgwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQC00SUs9cTxVa0bQ9KyGHNeBu/+cthrR8ZqO+ddlKCUhbB+lmbq
q+6m203a6SM7jkU40NVVTuw1QBqJzW+XVDZhJQTc3DwKE1bJ3N7c95FBFujP0xc72r4DcrpV
ppDmhdSk1AVujjpl5tyAllQ4zix9cnGVPUCTmAUYVqGdbTgZCP9U0bQqNhzVpiGtGCloMVBP
aYJCRLkps8lgKJY3Wh9dKG/TLxVgjRgVUntaPcJL/r/w4mSP4ljtI+w7J0aNbPW7vOIyPG+L
uByBTdAiq2nhAcBCiGGdDvU7A0378YrqjsHriRWHZAnbCTqjy1do+PAV7ccVoExws3h6gKzX
8AJhAgMBAAGjggHOMIIByjAfBgNVHSMEGDAWgBR6E04AdFvGeGNkJ8Ev4qBbvHnFezAdBgNV
HQ4EFgQU6e0BoOsfvFdUQUHB+tPGw9/jx2wwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQC
MAAwHQYDVR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMEYGA1UdIAQ/MD0wOwYMKwYBBAGy
MQECAQMFMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5uZXQvQ1BTMFcG
A1UdHwRQME4wTKBKoEiGRmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET0NsaWVudEF1
dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcmwwgYgGCCsGAQUFBwEBBHwwejBSBggr
BgEFBQcwAoZGaHR0cDovL2NydC5jb21vZG9jYS5jb20vQ09NT0RPQ2xpZW50QXV0aGVudGlj
YXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29t
b2RvY2EuY29tMB8GA1UdEQQYMBaBFGFuZHJldy5hQGF3YXJlLmNvLnRoMA0GCSqGSIb3DQEB
BQUAA4IBAQA81BYN5mYdzj3/nHfE1Bu1nBoDplpRpSKTtto2UkieQVs4hIxD0Aa5cKSn64fG
tsdPUibE83ZM6Ul/Nl9arO/Xf6O6nGSc/xf5/GUqAaho5vDpfguWkdNb4jaFthn88nn++bep
DZzpSyzGjvzR8bg/DfQBjtoAmPdaFxISfoO+q3zn3ttKfBiTENXEGE5llSlUIzaGxxz/mj7V
aAH9kb9yXrKGtH++51Jqe5W0uauTgm2rbPOpIuDatmmRu+gafI8RhvpMqoQrGv52+t6rPeey
OtnILDJQLJIOTBDjzCvO1QC4ti3GGfrV5zZAhvPZy18XY50UMNFrUyY54QZovat8MIIFGjCC
BAKgAwIBAgIQbRnqpxlPajMi5iIyeqpx3jANBgkqhkiG9w0BAQUFADCBrjELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhl
IFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20x
NjA0BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFp
bDAeFw0xMTA0MjgwMDAwMDBaFw0yMDA1MzAxMDQ4MzhaMIGTMQswCQYDVQQGEwJHQjEbMBkG
A1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFD
T01PRE8gQ0EgTGltaXRlZDE5MDcGA1UEAxMwQ09NT0RPIENsaWVudCBBdXRoZW50aWNhdGlv
biBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
koSEW0tXmNReL4uk4UDIo1NYX2Zl8TJO958yfVXQeExVt0KU4PkncQfFxmmkuTLE8UAakMwn
VmJ/F7Vxaa7lIBvky2NeYMqiQfZq4aP/uN8fSG1lQ4wqLitjOHffsReswtqCAtbUMmrUZ28g
E49cNfrlVICv2HEKHTcKAlBTbJUdqRAUtJmVWRIx/wmi0kzcUtve4kABW0ho3cVKtODtJB86
r3FfB+OsvxQ7sCVxaD30D9YXWEYVgTxoi4uDD216IVfmNLDbMn7jSuGlUnJkJpFOpZIP/+Cx
YP0ab2hRmWONGoulzEKbm30iY9OpoPzOnpDfRBn0XFs1uhbzp5v/wQIDAQABo4IBSzCCAUcw
HwYDVR0jBBgwFoAUiYJnfcSdJnAAS7RQSHzePa4Ebn0wHQYDVR0OBBYEFHoTTgB0W8Z4Y2Qn
wS/ioFu8ecV7MA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBEGA1UdIAQK
MAgwBgYEVR0gADBYBgNVHR8EUTBPME2gS6BJhkdodHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20v
VVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50aWNhdGlvbmFuZEVtYWlsLmNybDB0BggrBgEF
BQcBAQRoMGYwPQYIKwYBBQUHMAKGMWh0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VVE5BZGRU
cnVzdENsaWVudF9DQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5j
b20wDQYJKoZIhvcNAQEFBQADggEBAIXWvnhXVW0zf0RS/kLVBqgBA4CK+w2y/Uq/9q9BSfUb
WsXSrRtzbj7pJnzmTJjBMCjfy/tCPKElPgp11tA9OYZm0aGbtU2bb68obB2v5ep0WqjascDx
dXovnrqTecr+4pEeVnSy+I3T4ENyG+2P/WA5IEf7i686ZUg8mD2lJb+972DgSeUWyOs/Q4Pw
4O4NwdPNM1+b0L1garM7/vrUyTo8H+2b/5tJM75CKTmD7jNpLoKdRU2oadqAGx490hpdfEeZ
pZsIbRKZhtZdVwcbpzC+S0lEuJB+ytF5OOu0M/qgOl0mWJ5hVRi0IdWZ1eBDQEIwvuql55TS
sP7zdfl/bucwggSdMIIDhaADAgECAhA0PekrrCc0/4/LNJT7zHBUMA0GCSqGSIb3DQEBBQUA
MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1
c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENB
IFJvb3QwHhcNMDUwNjA3MDgwOTEwWhcNMjAwNTMwMTA0ODM4WjCBrjELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVT
RVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0
BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALI5haTyfatBO2JGN67NwWB1vDll+Uoa
R6K5zEjMapjVTTUZuaRC5c5J4oovHnzSMQfHTrSDZJ0uKdWiZMSFvYVRNXmkTmiQexx6pJKo
F/KYFfKTzMmkMpW7DE8wvZigC4vlbhuiRvp4vKJvq1lepS/Pytptqi/rrKGzaqq3Lmc1i3nh
HmmI4uZGzaCl6r4LznY6eg6b6vzaJ1s9cx8i5khhxkzzabGoLhu21DEgLLyCio6kDqXXiUP8
FlqvHXHXEVnauocNr/rz4cLwpMVnjNbWVDreCqS6A3ezZcj9HtN0YqoYymiTHqGFfvVHZcv4
TVcodNI0/zC27vZiMBSMLOsCAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTv
A73gJMtUGjAdBgNVHQ4EFgQUiYJnfcSdJnAAS7RQSHzePa4Ebn0wDgYDVR0PAQH/BAQDAgEG
MA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9MDswOaA3oDWG
M2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LmNybDA1
BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20w
DQYJKoZIhvcNAQEFBQADggEBAAG8nONjKLDzMQHC33vdYqABnSMxD5ySc1NR6h9M+tafxMov
Z354Mw90FrmRh5H1iib6ZHAA2B75CwRiUIeTgdTa9SPbNLuFVrRwNG54gzcehRzFERWSX4cX
vaxq/fHC0cyJX7F88D5R8jXzfOxgmGs6K+Dv37N9huu1G/Vb7KJ8mBPXAFC50S1z3gN4dOEF
hTFey5q5nZTGuZQ3dXLcRPtn6PD6JR5Sp9ol6UfgoMc8oE6xCjb7d0if75eK+7T+45QUqIO8
XC0/0mBxYO7CcYIM6Yg249ogtKOgbKqWS7iAjnXKSQf2OxS639wF2Z/b4LLmTaB4JufnLW5/
X8YeiBUwggQ2MIIDHqADAgECAgEBMA0GCSqGSIb3DQEBBQUAMG8xCzAJBgNVBAYTAlNFMRQw
EgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5l
dHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3QwHhcNMDAwNTMwMTA0
ODM4WhcNMjAwNTMwMTA0ODM4WjBvMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3Qg
QUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlB
ZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAt/caM+byAAQtOeBOW+0fvGwPzbX6I7bO3psRM5ekKUx9k5+9SryT7QMa44/P5W1QWtaX
KZRagLBJetsulf24yr83OC0ePpFBrXBWx/BPP+gynnTKyJBU6cZfD3idmkA8Dqxhql4Uj56H
oWpQ3NeaTq8Fs6ZxlJxxs1BgCscTnTgHhgKo6ahpJhiQq0ywTyOrOk+E2N/On+Fpb7vXQtdr
ROTHre5tQV9yWnEIN7N5ZaRZoJQ39wAvDcKSctrQOHLbFKhFxF0qfbe01sTurM0TRLfJK91D
ACX6YblpalgjEbenM49WdVn1zSnXRrcKK2W200JvFbK4e/vv6V1T1TRaJwIDAQABo4HcMIHZ
MB0GA1UdDgQWBBStvZh6NLQm9/rEJlTvA73gJMtUGjALBgNVHQ8EBAMCAQYwDwYDVR0TAQH/
BAUwAwEB/zCBmQYDVR0jBIGRMIGOgBStvZh6NLQm9/rEJlTvA73gJMtUGqFzpHEwbzELMAkG
A1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRl
cm5hbCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdIIB
ATANBgkqhkiG9w0BAQUFAAOCAQEAsJvghSXC1iPiD5YGkp1BmJzZhHmB2R5bFAcjNmWPsNh3
u6xBbEdgg1Gw+TI95/z2JhPHgBalv1r8h894eYkhmuJMBwqGNbzy3lHE0pa33H5O7nD9HDnr
DAJRFC2OvRbgwd9Gdeckrez0QrSFk3AQZ7qdBjVKGNMresxRQqF6Y9Hmu6HFK8I2vhMN5r1j
fnl7pwkNQKtq3Y+Kw/b2jBpCBVHURfWfp2IhaBUgQzyZ53y9JNipkRdziD9WGzE4GLRxD5rN
yA6eji4b4YyYg8sfMfFETMYEc0l2YA/H+L0XgGsu6cxMDlqaeQ8gCi7VnmMmHlWSlNiCF1p7
0LzHj06GBDGCAj8wggI7AgEBMIGoMIGTMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRl
ciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGlt
aXRlZDE5MDcGA1UEAxMwQ09NT0RPIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJl
IEVtYWlsIENBAhB9Ij5uHWULLe3jn29jZgJcMA0GCWCGSAFlAwQCAQUAoGkwLwYJKoZIhvcN
AQkEMSIEIB39M+TdJUcLF0Hu37FbO5a9FmOMXZxOmVuh7XvkHJNFMBgGCSqGSIb3DQEJAzEL
BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE0MDQwMjIxMDU0NFowDQYJKoZIhvcNAQEB
BQAEggEAq1LCgqCZHyUScnjYlGlR9LHnsQcz+1Riwz1acE7/qSRmfYPxw1KSWt2nEYyuEqE+
Sz6sG9yiC+8hym7ZbjlsGYnobUlmZkljsYAt62s7ktPsoF8OCPPiKS8okVqzDN2OOGh1qZfp
/H/Oumn6khYiuIPT6+QNa/fYHzLNarj+Mok1GtbATjL0nB24hlivHPPGM3jzXTeatNnzL3xg
PkcKlnXEwqdhlnF/bnCNT11yYUy3KUqRpMvbz8mgVYmzfeuB1gw6ihF2dsEoYPS7kdw+UYnU
EV4NbiP3Whdnc6NtpV7Y6s9GljJKjt2G/6Lorp4gwSaa4qRNxbNpRF7hF2ov3A==
--B_3479324744_15588931--
