prefix hijack by ASN 8997

Tue Sep 23 16:03:54 UTC 2008

Note that my bgp was through Cogent - my guess is they did filter.

Marshall

On Sep 23, 2008, at 11:54 AM, Scott Weeks wrote:

>
> ------ tme at multicasttech.com wrote: ----------
> From: Marshall Eubanks <tme at multicasttech.com>
>
> So, do you think this was lots of little tests / hijacks / mistakes ?
> Or did it just not propagate very far ?
> ---------------------------------------------
>
> According to Andree Toonk (and someone confirmed privately) ASN 8997  
> leaked a full table to ASN 3267 (who didn't filter!).  The only  
> upstream of ASN 3267 I saw in bgplay was ASN 174 (Cogent) who seems  
> to have filtered, but I can't confirm.  So I guess that the impact  
> would've only been to the peers downstream of ASN 3267.
>
> scott
>
>
>
>
>
> ---------------------------------------------
> Andree Toonk <andree+nanog at toonk.nl>
>
> Not a false positive, It actually was detected by the RIS box in  
> Moscow
> (rrc13). Strange that it's not visible in RIS search website, but it's
> definitely in the raw data files.
> Looking at that raw data from both routeviews and Ripe, it looks like
> they (AS8997) 'leaked' a  full table,  i.e. :
> ----------------------------------------------
>