Re: BGPMON Alert Questions

["Bob Evans" <bob () FiberInternetCenter com>]

Yes, I too have alerts for some of our prefixes from the same offending
origin 4761

On Wednesday April 2nd 2014 at 19:59 UTC we detected a Origin AS Change
event for your prefix (66.201.48.0/20 slash 20 bottom of nor cal)
The detected prefix: 66.201.48.0/20, was announced by AS4761
(INDOSAT-INP-AP INDOSAT Internet Network Provider,ID)
Alert description:       Origin AS Change
Detected Prefix:         66.201.48.0/20
Detected Origin AS:   4761
Expected Origin AS:   26803

Bob Evans
CTO




> So I setup BGPMON for my prefixes and got an alert about someone in
> Thailand announcing my prefix.  Everything looks fine to me and I've
> checked a bunch of different Looking Glasses and everything announcing
> correctly.
>
> I am assuming I should be contacting the provider about their
> misconfiguration and announcing my prefixes and get them to fix it.  Any
> other recommendations?
>
> Is there a way I can verify what they are announcing just to make sure
> they
> are still doing it?
>
> Here is the alert for reference:
>
> Your prefix:          8.37.93.0/24:
>
> Update time:          2014-04-02 18:26 (UTC)
>
> Detected by #peers:   2
>
> Detected prefix:      8.37.93.0/24
>
> Announced by:         AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
> Provider,ID)
>
> Upstream AS:          AS4651 (THAI-GATEWAY The Communications Authority of
> Thailand(CAT),TH)
>
> ASpath:               18356 9931 4651 4761