[179045] in North American Network Operators' Group
Re: Prefix hijack by INDOSAT AS4795 / AS4761
daemon@ATHENA.MIT.EDU (Christopher Morrow)
Thu Mar 26 10:51:23 2015
X-Original-To: nanog@nanog.org
In-Reply-To: <44c3b7398b0c46b8a842c44da3f379be@APP02.start.local>
Date: Thu, 26 Mar 2015 10:45:09 -0400
From: Christopher Morrow <morrowc.lists@gmail.com>
To: Peter Rocca <rocca@start.ca>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
On Thu, Mar 26, 2015 at 10:43 AM, Peter Rocca <rocca@start.ca> wrote:
> We just received a similar alert from bgpmon - part of 108.168.0.0/17 is being advertised as /20's - although we're still listed as the origin. We are 40788.
>
> 108.168.64.0/20 4795 4795 4761 9304 40633 18978 6939 40788
> 108.168.80.0/20 4795 4795 4761 9304 40633 18978 6939 40788
> 108.168.96.0/20 4795 4795 4761 9304 40633 18978 6939 40788
> 108.168.112.0/20 4795 4795 4761 9304 40633 18978 6939 40788
>
common point looks like LAIX ? their routeserver go crazy perhaps? or
did they change in/out prefix management information?
> -----Original Message-----
> From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Randy
> Sent: March-26-15 10:08 AM
> To: nanog@nanog.org
> Subject: Prefix hijack by INDOSAT AS4795 / AS4761
>
> On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing
> more specifics on one of our prefixes. Anyone else seeing similar or
> is it just us?
>
> 198.98.180.0/23 4795 4795 4761 9304 40633 18978 4436 29889
> 198.98.182.0/23 4795 4795 4761 9304 40633 18978 4436 29889
>
> --
> Randy
