Potential Prefix Hijack
Charlie Allom
charlie at playloudermsp.com
Tue Nov 11 03:06:18 UTC 2008
On Tue, Nov 11, 2008 at 10:54:01AM +0800, Mark Tinka wrote:
> Hi all.
>
> Anyone know how we can contact AS16735 and their upstream
> AS27664. We think they are hijacking a number of our
> prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
Mine too -
94.228.64.0/20
89.200.216.0/21
193.34.28.0/23
Except I see it as AS16735: (47998 is me)
BGP routing table entry for 94.228.64.0/20
Paths: (3 available, best #3, table Default-IP-Routing-Table)
Advertised to non peer-group peers:
193.0.0.71
27664 16735
200.219.130.21 from 200.219.130.21 (200.160.127.255)
Origin IGP, localpref 100, valid, external
Last update: Tue Nov 11 02:54:12 2008
19089 12956 5511 8928 47998
200.219.130.10 from 200.219.130.10 (200.225.95.3)
Origin IGP, localpref 100, valid, external
Community: 12956:65535
Last update: Mon Nov 10 18:40:54 2008
22548 16735
200.160.0.130 from 200.160.0.130 (200.160.0.137)
Origin IGP, localpref 100, valid, external, best
Last update: Tue Nov 11 02:51:57 2008
> RIPE's RIS BGPlay confirms the same, for about the last
> hour.
yep since 2am GMT.
C.
--
020 7729 4797
http://blog.playlouder.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 163 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20081111/582f3bd0/attachment.sig>
More information about the NANOG
mailing list