Re: [EXT] AS hijacking (Philosophy, rants, GeoMind)

[Chuck Anderson <cra () WPI EDU>]

Go back to them and tell them that a hijacked prefix is different from a hijacked AS.

On Fri, May 29, 2020 at 11:39:46AM -0400, Justin Wilson (Lists) wrote:
> One of the companies I work for recently had an issue with AS 2 (University of Delaware) hijacking a prefix.  Due to 
> Origin AS, good upstreams, and the like this has not really affected the traffic to the legit blocks.  However, 
> GeoMind picked this up almost immediately it seems.  The IP blocks when you go to speedtest.net come back to the 
> university of Delaware. This seems to be the only issue at the moment so we are working through contacting the peers 
> of AS2 and asking them to look into this.  We had also contacted University of Delaware.
>
> Here is where the philosophy comes into play.  The very terse e-mail we received back was basically “As2 gets 
> hijacked a lot and it’s not our problem”. So my question for the NANOG folks.  At what point do you say “it’s not 
> your problem” when it involves your ASN?
>
> Rant
> I almost always have issues with GeoMind and others when it comes to IP space.  Several of my folks have received 
> allocations from Arin in March.  A few are still fighting with geolocation stuff with a few of the providers.  So why 
> does GeoMind atomically accept a hijacked prefix as correct? All the right boxes have been ticked.  Origin 
> Validiation, registry sets, etc.