RE: Invalid prefix announcement from AS9035 for 129.77.0.0/16

[Dylan Ebner <dylan.ebner () crlmed com>]

Does anyone know why it takes BGPMon so long to send out an email. It looks like it BGPMon detected the AS9035 
announcements at the right time (around 7:00 UTC) but I didn't get a notification until around 13:00 UTC. It seems like 
many people rely on BGPMon to do this type of detection, so the long delay is frustrating.

Thanks 


Dylan Ebner

-----Original Message-----
From: Jim Cowie [mailto:cowie () renesys com] 
Sent: Friday, October 09, 2009 9:11 AM
To: Adam Kennedy
Cc: NANOG
Subject: Re: Invalid prefix announcement from AS9035 for 129.77.0.0/16

Lots of people were affected, but none significantly.   They originated
86,747 networks very briefly (less than a minute at 7:23 UTC), and I don't
think anyone outside Telecom Italia's customer cone even saw them.   So the
impact was really, really limited.  The correct origins were being reasserted even before the last of the announcements 
came over the wire.

It always irks me when I see "routing alerts" that arrive hours after the event is over, without any of the context 
that would allow you to know
whether it had any real impact.   Your instinct to check looking glasses is
the right one, but you have to move quickly and know where to look.

Of course, I'm biased.    --jim



On Fri, Oct 9, 2009 at 9:20 AM, Adam Kennedy <akennedy () cyberlinktech com>wrote:

> Agreed. Our prefixes at AS40060 were announced as well. I received a 
> notification around 7:00am EDT that our prefixes were detected 
> announced from AS9035 with the same upstream AS1267.
>
>
> On 10/9/09 8:34 AM, "Wouter Prins" <wp () null0 nl> wrote:
>
> > Hi Matthew,
> > You are not the only one having this issue. They are announcing some
> other
> > prefixes as well!
> >
> > 2009/10/9 Matthew Huff <mhuff () ox com>
> >
> > > About 4 hours ago BGPmon picked up a rogue announcement of 
> > > 129.77.0.0
> from
> > > AS9035 (ASN-WIND Wind Telecomunicazioni spa) with an upstream of 
> > > AS1267 (ASN-INFOSTRADA Infostrada S.p.A.). I don't see it now on 
> > > any looking
> glass
> > > sites. Hopefully this was just a typo that was quickly corrected. I
> would
> > > appreciate if people have time and can double check let me know if 
> > > any announcements are active except from our AS6128/AS6395 upstreams.
> > >
> > > If this were to persist, what would be the best course of action to
> resolve
> > > it, especially given that the AS was within RIPE.
> > >
> > >
> > > ----
> > > Matthew Huff       | One Manhattanville Rd
> > > OTA Management LLC | Purchase, NY 10577 http://www.ox.com  | Phone: 
> > > 914-460-4039
> > > aim: matthewbhuff  | Fax:   914-460-4139
>
> --
> Adam Kennedy
> Senior Network Administrator
> Cyberlink Technologies, Inc.
> Phone: 888-293-3693 x4352
> Fax: 574-855-5761