[181662] in North American Network Operators' Group
Re: Route leak in Bangladesh
daemon@ATHENA.MIT.EDU (Andree Toonk)
Tue Jun 30 11:49:42 2015
X-Original-To: nanog@nanog.org
Date: Tue, 30 Jun 2015 08:46:51 -0700
From: Andree Toonk <andree+nanog@toonk.nl>
To: Matsuzaki Yoshinobu <maz@iij.ad.jp>
In-Reply-To: <20150630.192625.498571400847043127.maz@iij.ad.jp>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
Some more data from BGPmon.net:
This affected close to 28,000 prefixes from 4,477 unique Autonomous systems.
The hijacks were originated by AS58587 and propagated via AS45796
(15,002 prefixes) and AS6939 (25,841). The AS45796 paths were only seen
via one of our peers, while the AS6939 path had a more significant
visibility.
The event started at 07:37 UTC and lasted for a few minutes.
Cheers
Andree
.-- My secret spy satellite informs me that at 2015-06-30 3:26 AM
Matsuzaki Yoshinobu wrote:
> A friend in AS58587 confirmed that this was caused by a configuration
> error - it seems like related to redistribution, and they already
> fixed that.
>
> -----
> Matsuzaki Yoshinobu <maz@iij.ad.jp>
> - IIJ/AS2497 INOC-DBA: 2497*629
>
> In message <559252E9.6030703@Janoszka.pl>
> Date: Tue, 30 Jun 2015 10:27:21 +0200
> Grzegorz Janoszka <Grzegorz@Janoszka.pl> wrote
>> We have just received alert from bgpmon that AS58587 Fiber @
>> Home Limited has hijacked most of our (AS43996) prefixes and
>> Hurricane Electric gladly accepted them.
>>
>> Anybody see their prefixes hijacked as well?
>>
>> --
>> Grzegorz Janoszka
>
