China prefix hijack

Thu Apr 8 17:27:40 UTC 2010

Just wondering if this was a "Fat fingered" mistake or intentional...

-J

> -----Original Message-----
> From: Frank Pater [mailto:fpater at dca.net] 
> Sent: Thursday, April 08, 2010 1:20 PM
> To: nanog at nanog.org
> Subject: Re: China prefix hijack
> 
> 
> Hi,
> 
> We received BGPmon notifications for all of our prefixes as 
> well. Not sure if it's relevant, but this is also announced 
> upstream from us by 3491. Example:
> 
> ====================================================================
> Possible Prefix Hijack (Code: 10) 
> ====================================================================
> Your prefix:          216.158.0.0/18:
> Update time:          2010-04-08 15:58 (UTC)
> Detected by #peers:   1
> Detected prefix:      216.158.0.0/18
> Announced by:         AS23724 (CHINANET-IDC-BJ-AP IDC, China 
> Telecommunications Corporation)
> Upstream AS:          AS4134 (CHINANET-BACKBONE No.31,Jin-rong Street)
> ASpath:               39792 4134 23724 23724
> 
> 
> --
> Frank Pater
> DCANet
> http://www.dca.net
> voice: 888-4-DCANET (888-432-2638)
> fax: 302-426-6386
> 
> 
> On Thu, Apr 08, 2010 at 12:39:57PM -0400, Chris McDonald wrote:
> > i think so yeah
> > 
> > AS 23724 is now announcing 63.218.188.0/22 which is historically 
> > announced by ASes: 3491.
> > Time: Thu Apr  8 16:55:02 2010 GMT
> > Observed path: 812 174 4134 23724 23724
> > 
> > 
> > On Thu, Apr 8, 2010 at 12:33 PM, Grzegorz Janoszka 
> > <Grzegorz at janoszka.pl>wrote:
> > 
> > >
> > > Just half an hour ago China Telecom hijacked one of our prefixes:
> > >
> > > Your prefix:          X.Y.Z.0/19:
> > > Prefix Description:   NETNAME
> > > Update time:          2010-04-08 15:58 (UTC)
> > > Detected by #peers:   1
> > > Detected prefix:      X.Y.Z.0/19
> > > Announced by:         AS23724 (CHINANET-IDC-BJ-AP IDC, China
> > > Telecommunications Corporation)
> > > Upstream AS:          AS4134 (CHINANET-BACKBONE 
> No.31,Jin-rong Street)
> > > ASpath:               39792 4134 23724 23724
> > >
> > > Luckily it had to be limited as only one BGPmon peer saw 
> it. Anyone 
> > > else noticed it?
> > >
> > > --
> > > Grzegorz Janoszka
> > >
> > >
> 
> 