nanog mailing list archives
Re: prefix hijack by ASN 8997
From: "Scott Weeks" <surfer () mauigateway com>
Date: Tue, 23 Sep 2008 08:54:21 -0700
------ tme () multicasttech com wrote: ---------- From: Marshall Eubanks <tme () multicasttech com> So, do you think this was lots of little tests / hijacks / mistakes ? Or did it just not propagate very far ? --------------------------------------------- According to Andree Toonk (and someone confirmed privately) ASN 8997 leaked a full table to ASN 3267 (who didn't filter!). The only upstream of ASN 3267 I saw in bgplay was ASN 174 (Cogent) who seems to have filtered, but I can't confirm. So I guess that the impact would've only been to the peers downstream of ASN 3267. scott --------------------------------------------- Andree Toonk <andree+nanog () toonk nl> Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files. Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a full table, i.e. : ----------------------------------------------
Current thread:
- Re: prefix hijack by ASN 8997, (continued)
- Re: prefix hijack by ASN 8997 Christian Koch (Sep 22)
- Re: prefix hijack by ASN 8997 Hank Nussbacher (Sep 22)
- Re: prefix hijack by ASN 8997 Andree Toonk (Sep 23)
- Re: prefix hijack by ASN 8997 Ingo Flaschberger (Sep 23)
- Re: prefix hijack by ASN 8997 Ingo Flaschberger (Sep 23)
- Re: prefix hijack by ASN 8997 Christian Koch (Sep 22)
- Re: prefix hijack by ASN 8997 Marshall Eubanks (Sep 23)
- Re: prefix hijack by ASN 8997 Marshall Eubanks (Sep 23)
- Re: prefix hijack by ASN 8997 Larry Blunk (Sep 23)