Re: Suspecious anycast prefixes

[bmanning () vacation karoshi com]

On Mon, May 02, 2011 at 08:40:01PM -0400, Christopher Morrow wrote:
> On Mon, May 2, 2011 at 3:35 PM, Joe Abley <jabley () hopcount ca> wrote:
> > On 2011-05-02, at 21:16, Yaoqing(Joey) Liu wrote:
> >
> > > I found the following prefixes are often originated by many ASNs more than
> > > five, wonder if they provide global anycast service, if so what specific
> > > service they provide?
> > >
> > > 12.64.255.0/24
> >
> > CERNET.
> >
> > > 70.37.135.0/24
> >
> > Microsoft/Hotmail.
> >
> > > 198.32.176.0/24
> >
> > Yahoo!
>
> as a note, this is bmanning/ep.net exchange space, no? so this could
> be just people leaking this into their table/global-table by mistake?


        used to be.  ep.net has fragmented into little bits.  most of the prefixes have
        been transfered to the clients who were using them, the ones who are still around
        are outside the ARIN region and there is no clean way to move them given ARIN and
        other RIR policy.   

This particular prefix was used as a public exchange, operated by Switch & Data. Not sure 
what they have done w/ it since then.

Switch and Data Management Company LLC NET-PAIX-V4 (NET-198-32-175-0-1) 198.32.175.0 - 198.32.177.255
EP.NET, LLC. NET-EP-176 (NET-198-32-176-0-1) 198.32.176.0 - 198.32.176.255


/bill