Re: Anomalies with AS13214 ?

[Christopher Morrow <morrowc.lists () gmail com>]

On Mon, May 11, 2009 at 2:29 PM, Andree Toonk <andree+nanog () toonk nl> wrote:
> .-- My secret spy satellite informs me that at Mon, 11 May 2009, Jay Hennigan wrote:
>
> > We're getting cyclops[1] alerts that AS13214 is advertising itself as
> > origin for all of our prefixes.  Their anomaly report shows thousands of
> > prefixes originating there.
> >
> > Anyone else seeing evidence of this or being affected?
>
> It seems it was picked up by route-views4. Non of the RIS peers seem to have seen this.
>
> Looking at the raw bgp data from route-views4:
> AS13214 leaked a full table (~266294 prefixes) with 13214  as OriginAS to AS48285 which is a routeviews4 peer.
> Routeviews4 saw these announcements as: ASpath 48285 13214.

Since 48285 == robtex, is it possible TPB was just setting up a
monitoring/route-feed session to robtex and either missed their
outbound policy or sent them the wrong form of outbound policy (full
routes not customer only routes)??

-chris