Re: Hijacking machine: ASAS201640 / AS200002

[Bryan Socha <bryan () digitalocean com>]

BGPlay found at https://stat.ripe.net/ is back and I find easier to look
back at bgp tables and find events like another AS or more specific route
appearing.

Also if you never looked, bgpmon.net is a decent service to monitor import
announcements and AS numbers to get near real time alerts of routing
changes.  Doesn't help this situation but can help you get alerted when it
happens next.


Bryan Socha
Network Engineer
DigitalOcean
646-450-0472

On Sat, Nov 1, 2014 at 9:57 AM, Jared Mauch <jared () puck nether net> wrote:

> On Fri, Oct 31, 2014 at 08:57:09PM -0700, Ronald F. Guilmette wrote:
> > In message <54542174.30809 () ghostnet de>,
> > Armin Kneip <ak () ghostnet de> wrote:
> >
> > > http://bgpupdates.potaroo.net/cgi-bin/generate_as_log?as=201640
> > > http://bgpupdates.potaroo.net/cgi-bin/generate_as_log?as=200002
> > >
> > > or
> > >
> > > http://www.cidr-report.org/cgi-bin/as-report?as=AS201640&view=2.0
> > > http://www.cidr-report.org/cgi-bin/as-report?as=AS200002&view=2.0
> >
> >
> > Thank you.
> >
> > Unfortunately, the former pair of links only seems to provide data
> > going back about one week, while the latter pair of links only seems
> > to provide current data as of today.
> >
> > I am hoping to be able to find a list of all route announcements
> > made by ASAS201640 going all the way back to its creation, which
> > appears to possibly have occured on or about 2014-08-27.
>
>         You have to parse the UPDATES data, eg: located at
> archive.routeviews.org or something else, not the rib snapshots.
>
>         - Jared
>
> --
> Jared Mauch  | pgp key available via finger from jared () puck nether net
> clue++;      | http://puck.nether.net/~jared/  My statements are only
> mine.