[179047] in North American Network Operators' Group
Re: Prefix hijack by INDOSAT AS4795 / AS4761
daemon@ATHENA.MIT.EDU (Pierre Emeriaud)
Thu Mar 26 10:58:25 2015
X-Original-To: nanog@nanog.org
In-Reply-To: <b8636bc52cdc7f7f595ff96c7b078445@mailbox.fastserv.com>
Date: Thu, 26 Mar 2015 15:46:51 +0100
From: Pierre Emeriaud <petrus.lt@gmail.com>
To: amps@djlab.com
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
Hi,
2015-03-26 15:08 GMT+01:00 Randy <amps@djlab.com>:
> On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing more
> specifics on one of our prefixes. Anyone else seeing similar or is it just
> us?
>
> 198.98.180.0/23 4795 4795 4761 9304 40633 18978 4436 29889
> 198.98.182.0/23 4795 4795 4761 9304 40633 18978 4436 29889
We (as3215) are seeing almost the same path with 40633 18978 3257
3215, for some quite a lot of prefixes.
Some alerts from bgpmon:
193.251.32.0/20 271 6939 40633 18978 3257 3215
193.251.32.0/20 271 6939 40633 18978 3257 3215
We are not directly connected to 3257. Looks like 18978 deaggregated
to /20 and reannounced to 40633 (LAIX).
Rgds,
pierre
