Re: prefix hijack by ASN 8997

["Christian Koch" <christian () broknrobot com>]

Bgplay on routeviews, not the ripe one :)

Christian



On 9/23/08, Hank Nussbacher <hank () efes iucc ac il> wrote:
> On Mon, 22 Sep 2008, Christian Koch wrote:
>
> Strange that RIPE RIS search doesn't show it:
> http://www.ris.ripe.net/perl-risapp/risearch.html
> but yet you say BGPlay does show it.
>
> -Hank
>
> > I received a phas notification about this today as well...
> >
> > I couldn't find any relevant data confirming the announcement of one
> > of my /19 blocks, until a few minutes ago when i checked the route
> > views bgplay (ripe bgplay turns up nothing) and can now see 8997
> > announcing and quickly withdrawing my prefix
> >
> >
> >
> >
> > On Mon, Sep 22, 2008 at 9:06 PM, Scott Weeks <surfer () mauigateway com>
> > wrote:
> > > I am hoping to confirm a short-duration prefix hijack of 72.234.0.0/15
> > > (and another of our prefixes) by ASN 8997 ("OJSC North-West Telecom" in
> > > Russia) in using ASN 3267 (Russian Federal University Network) to
> > > advertise our space to ASN 3277 (Regional University and Scientific
> > > Network (RUSNet) of North-Western and Saint-Petersburg Area of Russia).
> > >
> > > Is that what I'm seeing when I go to "bgplay.routeviews.org/bgplay", put
> > > in prefix 72.234.0.0/15 and select the dates:
> > >
> > > 22/9/2008  9:00:00   and   22/9/2008  15:00:00
> > >
> > > If so, am I understanding it correctly if I say ASN 3267 saw a shorter
> > > path from ASN 8997, so refused the proper announcement from ASN 36149
> > > (me) it normally hears from ASN 174 (Cogent).
> > >
> > > If the above two are correct, would it be correct to say only the
> > > downstream customers of ASN 3267 were affected?
> > >
> > > scott

-- 
Sent from my mobile device