Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

[Harry Hoffman <hhoffman () ip-solutions net>]

I'm currently looking into AS3 in an attempt to figure out what's going on.

Always interested to hear what others have found out.

Cheers,
Harry

On Nov 30, 2014 8:57 AM, Simon Leinen <simon.leinen () switch ch> wrote:
> cidr-report  writes: 
> > BGP Update Report 
> > Interval: 20-Nov-14 -to- 27-Nov-14 (7 days) 
> > Observation Point: BGP Peering with AS131072 
>
> > TOP 20 Unstable Origin AS 
> > Rank ASN                Upds     %  Upds/Pfx    AS-Name 
> [...] 
> > 11 - AS5               38861  0.6%       7.0 -- SYMBOLICS - Symbolics, Inc.,US 
>
> Disappointing to see Symbolics (AS5) on this list.  I would expect these 
> Lisp Machines to have very stable BGP implementations, especially given 
> the leisurely release rhythm for Genera for the past few decades.  Has 
> the size of the IPv4 unicast table started triggering global GCs? 
>
> Seriously, all these low-numbered ASes in the report look fishy.  I 
> would have liked this to be an artifact of the reporting software (maybe 
> an issue with 4-byte ASes?), but I do see some strange paths in the BGP 
> table that make it look like (accidental or malicious) hi-hacking of 
> these low-numbered ASes. 
>
> Now the fact that these AS numbers are low makes me curious.  If I 
> wanted to hijack other folks' ASes deliberately, I would probably avoid 
> such numbers because they stand out.  Maybe these are just non-standard 
> "private-use" ASes that are leaked? 
>
> Some suspicious paths I'm seeing right now: 
>
>   133439 5 
>   197945 4 
>
> Hm, maybe 32-bit ASes do have something to do with this... 
>
> Any ideas? 
> -- 
> Simon. (Just curious) 
>
> [...] 
> > 17 - AS3               30043  0.4%    3185.0 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 
> [...] 
>
> > TOP 20 Unstable Origin AS (Updates per announced prefix) 
> > Rank ASN                Upds     %  Upds/Pfx    AS-Name 
> [...] 
> > 13 - AS5               38861  0.6%       7.0 -- SYMBOLICS - Symbolics, Inc.,US 
> [...] 
> > 15 - AS4               21237  0.3%     871.0 -- ISI-AS - University of Southern California,US 
> [...] 
> > 19 - AS4                5345  0.1%    1437.0 -- ISI-AS - University of Southern California,US 
> > 20 - AS4                8784  0.1%    2303.0 -- ISI-AS - University of Southern California,US