Hijacked Network Ranges

Tue Jan 31 19:13:46 UTC 2012

I can routes are wrong for all /24 annoucements.

May be contacting Level3+Telia+AboveNet+Hurricane Electric since all these
are upstream providers of AS29791 which is your upstream carrier? I guess
they would be able to neutralize effect significantly by filtering those
routes?

On Wed, Feb 1, 2012 at 12:27 AM, Tony McCrory <tony.mccrory at gmail.com>wrote:

> Surely something is better than nothing.  Advertise the /24's and the
> /25's, see what happens.
>
> At the least it's a step forwards until you get their routes filtered.
>
> Tony
>
> On 31 January 2012 18:22, Kelvin Williams <kwilliams at altuscgi.com> wrote:
>
> > Upstream requirements. Additionally, I don't believe it would do us any
> > good. If they're announcing /24 now, why would they not announce a /25.
> > On Jan 31, 2012 1:19 PM, "Grant Ridder" <shortdudey123 at gmail.com> wrote:
> >
> > > Hi,
> > >
> > > What is keeping you from advertising a more specific route (i.e /25's)?
> > >
> > > -Grant
> > >
> > > On Tue, Jan 31, 2012 at 12:00 PM, Kelvin Williams <
> > kwilliams at altuscgi.com>wrote:
> > >
> > >> Greetings all.
> > >>
> > >> We've been in a 12+ hour ordeal requesting that AS19181 (Cavecreek
> > >> Internet
> > >> Exchange) immediately filter out network blocks that are being
> > advertised
> > >> by ASAS33611 (SBJ Media, LLC) who provided to them a forged LOA.
> > >>
> > >> The routes for networks: 208.110.48.0/20, 63.246.112.0/20, and
> > >> 68.66.112.0/20 are registered in various IRRs all as having an origin
> > AS
> > >> 11325 (ours), and are directly allocated to us.
> > >>
> > >> The malicious hijacking is being announced as /24s therefore making
> > route
> > >> selection pick them.
> > >>
> > >> Our customers and services have been impaired.  Does anyone have any
> > >> contacts for anyone at Cavecreek that would actually take a look at
> > ARINs
> > >> WHOIS, and IRRs so the networks can be restored and our services back
> in
> > >> operation?
> > >>
> > >> Additionally, does anyone have any suggestion for mitigating in the
> > >> interim?  Since we can't announce as /25s and IRRs are apparently a
> pipe
> > >> dream.
> > >>
> > >> --
> > >> Kelvin Williams
> > >> Sr. Service Delivery Engineer
> > >> Broadband & Carrier Services
> > >> Altus Communications Group, Inc.
> > >>
> > >>
> > >> "If you only have a hammer, you tend to see every problem as a nail."
> --
> > >> Abraham Maslow
> > >>
> > >
> > >
> >
>

-- 

Anurag Bhatia
anuragbhatia.com
or simply - http://[2001:470:26:78f::5] if you are on IPv6 connected
network!

Twitter: @anurag_bhatia <https://twitter.com/#!/anurag_bhatia>
Linkedin: http://linkedin.anuragbhatia.com