[52506] in North American Network Operators' Group
Re: Hunting for bogus BGP announcement for 204.106.93.155
daemon@ATHENA.MIT.EDU (Marshall Eubanks)
Thu Oct 3 13:22:49 2002
Date: Thu, 03 Oct 2002 13:22:10 -0400
From: Marshall Eubanks <tme@multicasttech.com>
To: "David G. Andersen" <dga@lcs.mit.edu>
Cc: Jesper Skriver <jesper@skriver.dk>, Michael.Dillon@radianz.com,
nanog@merit.edu
Errors-To: owner-nanog-outgoing@merit.edu
We did _not_ see 204.106.93.155
here at AS 16517 in our multicast status
runs in either BGP or MBGP announcements - this means that Sprint and
UUNet were not announcing it (nor was Internet2).
--
Regards
Marshall Eubanks
David G. Andersen wrote:
> On Thu, Oct 03, 2002 at 06:48:53PM +0200, Jesper Skriver mooed:
>
>>On Thu, Oct 03, 2002 at 04:35:45PM +0100, Michael.Dillon@radianz.com
>>wrote:
>>
>>
>>>For the last two days, between approximately 7pm to 2am Eastern
>>>time, a spammer hijacked a piece of our address space, presumably
>>>by announcing some size of aggregate containing the IP address
>>>204.106.93.155. During the time that the spammer had connectivity
>>>using this bogus announcement,
>>>
>>RIS didn't pick anything up
>>
> Nor did our BGP monitors, nor our db of Routeviews.
>
> http://bgp.lcs.mit.edu/
>
> Interestingly, we se _no_ announcements of any netblock containing
> this address, ever. I assume you haven't brought this address space
> on-line yet?
>
> -Dave
>
>
T.M. Eubanks
Multicast Technologies, Inc
10301 Democracy Lane, Suite 410
Fairfax, Virginia 22030
Phone : 703-293-9624 Fax : 703-293-9609
e-mail : tme@multicasttech.com
http://www.multicasttech.com
Test your network for multicast :
http://www.multicasttech.com/mt/
Status of Multicast on the Web :
http://www.multicasttech.com/status/index.html
