nanog mailing list archives
Re: Cisco/Level3 takedown
From: Blake Hudson <blake () ispn net>
Date: Thu, 09 Apr 2015 10:55:43 -0500
Reading the article, I assumed that perhaps Level 3 was an upstream carrier, but RIPE stats shows that the covering prefix (103.41.120.0/22) is announced by AS63509, an Indonesian organization. It looks like they're fighting back by announcing their own /24 now.
I love the AS's address: descr:Jl. Marcedes Bens No.258 descr:Gunung Putri, Bogor descr:Jawa Barat 16964 country:IDWhile a Level 3 /24 announcement will certainly have a world wide impact, I agree that it seems misguided when the originating AS can announce their own /24. It does make one wonder why Cisco or Level 3 is involved, why they feel they have the authority to hijack someone else's IP space, and why they didn't go through law enforcement. This is especially true for the second netblock (43.255.190.0/23), announced by a US company (AS26484).
--Blake Sameer Khosla wrote on 4/9/2015 10:31 AM:
Was just reading http://blogs.cisco.com/security/talos/sshpsychos then checking my routing tables. Looks like the two /23's they mention are now being advertised as /24's, and I'm also not sure why cisco published the ssh attack dictionary. It seems to me that this is something that if they want to do, they should be working with entire service provider community, not just one provider. Thanks Sameer Khosla Managing Director Neutral Data Centers Corp. Twitter: @skhoslaTO
Current thread:
- Cisco/Level3 takedown Sameer Khosla (Apr 09)
- Re: Cisco/Level3 takedown Christopher Morrow (Apr 09)
- RE: Cisco/Level3 takedown Naslund, Steve (Apr 09)
- RE: Cisco/Level3 takedown Josh Luthman (Apr 09)
- RE: Cisco/Level3 takedown Naslund, Steve (Apr 09)
- RE: Cisco/Level3 takedown Naslund, Steve (Apr 09)
- Re: Cisco/Level3 takedown Christopher Morrow (Apr 09)
- Re: Cisco/Level3 takedown Blake Hudson (Apr 09)
- Re: Cisco/Level3 takedown Steve Noble (Apr 09)
- macomnet weird dns record Colin Johnston (Apr 14)
- Re: macomnet weird dns record Nikolay Shopik (Apr 14)
- Re: macomnet weird dns record Stephane Bortzmeyer (Apr 14)
- Re: macomnet weird dns record Colin Johnston (Apr 14)
- Re: macomnet weird dns record Stephane Bortzmeyer (Apr 14)
- RE: macomnet weird dns record Chuck Church (Apr 14)
- Re: macomnet weird dns record Nikolay Shopik (Apr 14)
- Re: macomnet weird dns record Pavel Odintsov (Apr 14)
- Re: macomnet weird dns record Nikolay Shopik (Apr 14)
- Re: Cisco/Level3 takedown Steve Noble (Apr 09)