[170645] in North American Network Operators' Group
Re: BGPMON Alert Questions
daemon@ATHENA.MIT.EDU (Bret Clark)
Wed Apr 2 17:26:01 2014
Date: Wed, 02 Apr 2014 17:08:06 -0400
From: Bret Clark <bclark@spectraaccess.com>
To: nanog@nanog.org
In-Reply-To: <CAAARkv+9cLqzqL8oY+REnBW_UgG7Bneog-3WV9u-B97yHWetfg@mail.gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
They are advertising one of /22 right now as well,
Bret
On 04/02/2014 04:21 PM, Bryan Tong wrote:
> They have advertised all of ours now.
>
>
> On Wed, Apr 2, 2014 at 2:16 PM, Bob Evans <bob@fiberinternetcenter.com>wrote:
>
>> Yes, I too have alerts for some of our prefixes from the same offending
>> origin 4761
>>
>> On Wednesday April 2nd 2014 at 19:59 UTC we detected a Origin AS Change
>> event for your prefix (66.201.48.0/20 slash 20 bottom of nor cal)
>> The detected prefix: 66.201.48.0/20, was announced by AS4761
>> (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID)
>> Alert description: Origin AS Change
>> Detected Prefix: 66.201.48.0/20
>> Detected Origin AS: 4761
>> Expected Origin AS: 26803
>>
>> Bob Evans
>> CTO
>>
>>
>>
>>
>>> So I setup BGPMON for my prefixes and got an alert about someone in
>>> Thailand announcing my prefix. Everything looks fine to me and I've
>>> checked a bunch of different Looking Glasses and everything announcing
>>> correctly.
>>>
>>> I am assuming I should be contacting the provider about their
>>> misconfiguration and announcing my prefixes and get them to fix it. Any
>>> other recommendations?
>>>
>>> Is there a way I can verify what they are announcing just to make sure
>>> they
>>> are still doing it?
>>>
>>> Here is the alert for reference:
>>>
>>> Your prefix: 8.37.93.0/24:
>>>
>>> Update time: 2014-04-02 18:26 (UTC)
>>>
>>> Detected by #peers: 2
>>>
>>> Detected prefix: 8.37.93.0/24
>>>
>>> Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
>>> Provider,ID)
>>>
>>> Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority
>> of
>>> Thailand(CAT),TH)
>>>
>>> ASpath: 18356 9931 4651 4761
>>>
>>
>>
>>
>
--
Spectra Access
25 Lowell Street
Manchester, NH 03042
603-296-0760
www.spectraaccess.net
