prefix hijack by ASN 8997
christian at broknrobot.com
Tue Sep 23 00:00:27 CDT 2008
Bgplay on routeviews, not the ripe one :)
On 9/23/08, Hank Nussbacher <hank at efes.iucc.ac.il> wrote:
> On Mon, 22 Sep 2008, Christian Koch wrote:
> Strange that RIPE RIS search doesn't show it:
> but yet you say BGPlay does show it.
>> I received a phas notification about this today as well...
>> I couldn't find any relevant data confirming the announcement of one
>> of my /19 blocks, until a few minutes ago when i checked the route
>> views bgplay (ripe bgplay turns up nothing) and can now see 8997
>> announcing and quickly withdrawing my prefix
>> On Mon, Sep 22, 2008 at 9:06 PM, Scott Weeks <surfer at mauigateway.com>
>>> I am hoping to confirm a short-duration prefix hijack of 22.214.171.124/15
>>> (and another of our prefixes) by ASN 8997 ("OJSC North-West Telecom" in
>>> Russia) in using ASN 3267 (Russian Federal University Network) to
>>> advertise our space to ASN 3277 (Regional University and Scientific
>>> Network (RUSNet) of North-Western and Saint-Petersburg Area of Russia).
>>> Is that what I'm seeing when I go to "bgplay.routeviews.org/bgplay", put
>>> in prefix 126.96.36.199/15 and select the dates:
>>> 22/9/2008 9:00:00 and 22/9/2008 15:00:00
>>> If so, am I understanding it correctly if I say ASN 3267 saw a shorter
>>> path from ASN 8997, so refused the proper announcement from ASN 36149
>>> (me) it normally hears from ASN 174 (Cogent).
>>> If the above two are correct, would it be correct to say only the
>>> downstream customers of ASN 3267 were affected?
Sent from my mobile device
More information about the NANOG