Re: AS16387 leaking routes

[Christopher Morrow <morrowc.lists () gmail com>]

On Mon, Feb 15, 2010 at 5:32 PM, Ernest Andrew McCracken (emccrckn)
<emccrckn () memphis edu> wrote:
> Has anyone seen the strange activity from AS16387?  Did they leak their entire table?  Our route collectors are 
> showing AS16387 originating large numbers of prefixes.  It looks like we caught the tail end of this activity as they 
> are now announcing updates with  massive amounts of prepending.

16387 is a uunet customer, it seems, who's only annoucing (now) 2
prefixes... Robtex seems to support them only having a single upstream
(701). I think 701 still prefix-lists all their customers.

You saw this through 3303 without 701 (it seems?) in the path, The
orignal prefix looks actually like 95.79.192.0/19 in the path: 34533
16387
that looks like ESamara trying to poison their paths toward 'healthy
directions, LLC".

maybe ESamara saw something they disliked from this part of the network?

-Chris