Re: Potential Prefix Hijack

[Nuno Vieira - nfsi telecom <nuno.vieira () nfsi pt>]

Howdy,

We were hijacked aswell, by 27664 16735 

Our affected prefixes were:

94.46.0.0/16
194.88.142.0/23
194.11.23.0/24
82.102.0.0/18
195.246.238.0/23
194.107.127.0/24
81.92.192.0/19
193.227.238.0/23

We are trying to contact them in order to get some feedback, and some good explanation for this.

In the meanwhile, there are lots of evidence spread around (thanks to RIS RIPE, Routeviews, BGPmon and others)

http://www.ris.ripe.net/dashboard/27664
http://www.ris.ripe.net/dashboard/16735

In the meanwhile we are sending notices to the Upstreams of those ASN's, in order for them to apply proper filtering to 
their downstream customers to avoid situations like this.

On the List i was able to found:

AS8167 - TELESC
AS6762 - SEABONE
AS12956 - TELEFONICA
AS3549 - GLOBAL CROSSING
AS17379 - Interlig

I welcome others to do the same, in order to avoid replicas for this situation.

Regards,
---
Nuno Vieira
nfsi telecom, lda.

nuno.vieira () nfsi pt
Tel. (+351) 21 949 2300 - Fax (+351) 21 949 2301
http://www.nfsi.pt/



----- "Network Fortius" <netfortius () gmail com> wrote:

> Same problems here, for AS26028
> Stefan
>
> On Mon, Nov 10, 2008 at 8:54 PM, Mark Tinka
> <mtinka () globaltransit net>wrote:
>
> > Hi all.
> >
> > Anyone know how we can contact AS16735 and their upstream
> > AS27664. We think they are hijacking a number of our
> > prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
> >
> > e.g.,
> >
> > ====================
> > Possible Prefix Hijack (Code: 11)
> > 1 number of peer(s) detected this updates for your prefix
> > 61.11.208.0/20:
> > Update details: 2008-11-11 02:24 (UTC)
> > 61.11.208.0/20
> > Announced by: AS16735 (Companhia de Telecomunicacoes do
> > Brasil Central)
> > Transit AS: 27664 (CTBC Multimídia)
> > ASpath: 27664 16735
> > =====================
> >
> > RIPE's RIS BGPlay confirms the same, for about the last
> > hour.
> >
> > E-mails to them won't get there (of course), so our NOC are
> > contacting them via Gmail/Yahoo.
> >
> > All help appreciated.
> >
> > Cheers,
> >
> > Mark.