Re: Anyone notice strange announcements for 174.128.31.0/24

["Josh Karlin" <karlinjf () cs unm edu>]

At some point 3130 announced these prefixes, and is now prepending other
ASes to them.  Pretty Good BGP (and hence the IAR) sees them as prefix
hijacks.  If you'd like to see the entire list of prefixes, check out:
http://iar.cs.unm.edu/search.php and enter in 3130 as the "Victim AS"

Josh

On Mon, Jan 12, 2009 at 11:52 AM, Paul Stewart <pstewart () nexicomgroup net>wrote:

> Same here.. got a notice this morning and while it's false, I still have
> no response from Randy neither on this matter...
>
> If they are going to involve our AS numbers and trigger alarms it would
> be nice to notify us first... especially on something as major as a
> prefix hijacking (potentially)
>
> Paul
>
>
>
> -----Original Message-----
> From: Majdi S. Abbas [mailto:msa () latt net]
> Sent: Monday, January 12, 2009 1:49 PM
> To: Michienne Dixon
> Cc: nanog () nanog org
> Subject: Re: Anyone notice strange announcements for 174.128.31.0/24
>
> On Mon, Jan 12, 2009 at 12:40:42PM -0600, Michienne Dixon wrote:
> > I'm not entirely certain what is going on but has anyone noticed some
> > strange announcements for 174.128.31.0/24?
> >
> > I received a hijack notice that my AS (AS11708) was announcing the
> above
> > IP range.  I verified that I was not when I started noticing some
> > strange announcements for that range.  Around 10 Am CST AS11911 was
> > announcing it  (AS_PATH: 1239 2914 3130 11911) then around 11:30 AM
> CST
> > I observed AS12083 announcing it (AS_PATH: 1239 2914 3130 12083).
> >
> > Interestingly enough, ARIN indicates this is a part of range they have
> > assigned for reachability testing.
> > http://ws.arin.net/whois/?queryinput=174.128.31.0
>
>        randy lied but
>        no packets died
>        enough now
>
>        More seriously, this is indeed reachability research.  Try
> emailing
> the AS 3130 contacts although I'd imagine Randy will see this.
>
>        Thanks,
>
>        --msa
>
>
>
>
>
>
> ----------------------------------------------------------------------------
>
> "The information transmitted is intended only for the person or entity to
> which it is addressed and contains confidential and/or privileged material.
> If you received this in error, please contact the sender immediately and
> then destroy this transmission, including all attachments, without copying,
> distributing or disclosing same. Thank you."