nanog mailing list archives
Re: prefix hijack by ASN 8997
From: Hank Nussbacher <hank () efes iucc ac il>
Date: Tue, 23 Sep 2008 09:53:17 +0300 (IDT)
On Tue, 23 Sep 2008, Andree Toonk wrote:
Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files. Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a full table, i.e. : * 217.208 unique prefixes detected by the RIS server in Moscow (ASpath: 2895 3267 8997) * 250495 seen by routeviews (ASpath: 2895 3267 8997). (results of quick query: where AS-path contained '3267 8997' update type = advertisement). ASpath: 2895 3267 8997
Is that the only ASpath that leaked it? There are others - did they filter properly and only that path failed to filter?
Regards, Hank
Current thread:
- Re: prefix hijack by ASN 8997, (continued)
- Re: prefix hijack by ASN 8997 Justin Shore (Sep 22)
- Re: prefix hijack by ASN 8997 Christian Koch (Sep 22)
- RE: prefix hijack by ASN 8997 Church, Charles (Sep 23)
- Re: prefix hijack by ASN 8997 Justin Shore (Sep 22)
- Re: prefix hijack by ASN 8997 Hank Nussbacher (Sep 22)
- Re: prefix hijack by ASN 8997 Christian Koch (Sep 22)
- Re: prefix hijack by ASN 8997 Jim Popovitch (Sep 22)
- Re: prefix hijack by ASN 8997 Jim Popovitch (Sep 23)
- Re: prefix hijack by ASN 8997 Hank Nussbacher (Sep 22)
- Re: prefix hijack by ASN 8997 Andree Toonk (Sep 22)
- Re: prefix hijack by ASN 8997 Christian Koch (Sep 22)
- Re: prefix hijack by ASN 8997 Hank Nussbacher (Sep 22)
- Re: prefix hijack by ASN 8997 Andree Toonk (Sep 23)
- Re: prefix hijack by ASN 8997 Ingo Flaschberger (Sep 23)
- Re: prefix hijack by ASN 8997 Ingo Flaschberger (Sep 23)
- Re: prefix hijack by ASN 8997 Andree Toonk (Sep 22)
- Re: prefix hijack by ASN 8997 Christian Koch (Sep 22)
- Re: prefix hijack by ASN 8997 Marshall Eubanks (Sep 23)
- Re: prefix hijack by ASN 8997 Marshall Eubanks (Sep 23)