Anomalies with AS13214 ?

Mon May 11 18:39:38 UTC 2009

On Mon, May 11, 2009 at 2:29 PM, Andree Toonk <andree+nanog at toonk.nl> wrote:
> .-- My secret spy satellite informs me that at Mon, 11 May 2009, Jay Hennigan wrote:
>
>> We're getting cyclops[1] alerts that AS13214 is advertising itself as
>> origin for all of our prefixes.  Their anomaly report shows thousands of
>> prefixes originating there.
>>
>> Anyone else seeing evidence of this or being affected?
>
> It seems it was picked up by route-views4. Non of the RIS peers seem to have seen this.
>
> Looking at the raw bgp data from route-views4:
> AS13214 leaked a full table (~266294 prefixes) with 13214  as OriginAS to AS48285 which is a routeviews4 peer.
> Routeviews4 saw these announcements as: ASpath 48285 13214.
>

Since 48285 == robtex, is it possible TPB was just setting up a
monitoring/route-feed session to robtex and either missed their
outbound policy or sent them the wrong form of outbound policy (full
routes not customer only routes)??

-chris