nanog mailing list archives
Re: Anomalies with AS13214 ?
From: Christopher Morrow <morrowc.lists () gmail com>
Date: Mon, 11 May 2009 14:39:38 -0400
On Mon, May 11, 2009 at 2:29 PM, Andree Toonk <andree+nanog () toonk nl> wrote:
.-- My secret spy satellite informs me that at Mon, 11 May 2009, Jay Hennigan wrote:We're getting cyclops[1] alerts that AS13214 is advertising itself as origin for all of our prefixes. Their anomaly report shows thousands of prefixes originating there. Anyone else seeing evidence of this or being affected?It seems it was picked up by route-views4. Non of the RIS peers seem to have seen this. Looking at the raw bgp data from route-views4: AS13214 leaked a full table (~266294 prefixes) with 13214 as OriginAS to AS48285 which is a routeviews4 peer. Routeviews4 saw these announcements as: ASpath 48285 13214.
Since 48285 == robtex, is it possible TPB was just setting up a monitoring/route-feed session to robtex and either missed their outbound policy or sent them the wrong form of outbound policy (full routes not customer only routes)?? -chris
Current thread:
- RE: Anomalies with AS13214 ?, (continued)
- RE: Anomalies with AS13214 ? Robert D. Scott (May 11)
- Re: Anomalies with AS13214 ? Jay Hennigan (May 11)
- Re: Anomalies with AS13214 ? Russell Heilling (May 11)
- Re: Anomalies with AS13214 ? Jon Lewis (May 11)
- Re: Anomalies with AS13214 ? David Freedman (May 11)
- Re: Anomalies with AS13214 ? Christopher Morrow (May 11)
- Re: Anomalies with AS13214 ? David Freedman (May 11)
- Re: Anomalies with AS13214 ? bmanning (May 11)
- Re: Anomalies with AS13214 ? Hank Nussbacher (May 11)
- Re: Anomalies with AS13214 ? Christopher Morrow (May 11)
- Re: Anomalies with AS13214 ? Andree Toonk (May 11)
- Re: Anomalies with AS13214 ? Christopher Morrow (May 11)
- Re: Anomalies with AS13214 ? Christian Seitz (May 11)
- Re: Anomalies with AS13214 ? Ricardo Oliveira (May 11)