Re: prefix hijack by ASN 8997

[Andree Toonk <andree+nanog () toonk nl>]

Hi Hank,

.-- My secret spy satellite informs me that at Tue, 23 Sep 2008, Hank Nussbacher wrote:

> > Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a  full table,  i.e. :
> > * 217.208 unique prefixes detected by the RIS server in Moscow (ASpath: 2895 3267 8997)
> > * 250495 seen by routeviews (ASpath: 2895 3267 8997).
> > (results of quick query: where AS-path contained '3267 8997' update type = advertisement).
> >
> > ASpath: 2895 3267 8997
>
> Is that the only ASpath that leaked it?  There are others - did they  
> filter properly and only that path failed to filter?

Again:
* 217.208 unique prefixes detected by the RIS server in Moscow (ASpath: 2895 3267 8997 & ASpath 2895 5431 3267 8997)
* 250495 seen by routeviews (ASpath: 3277 3267 8997).

Looks like those are the only ones, but this is just a quick egrep, awk, and sort on the rawdata so I might have missed 
something (It's getting late here, so no guarantees ;))

Cheers,
 Andree