Dreamhost hijacking my prefix...

Fri Jan 11 16:01:12 UTC 2013

Here at/as AS5580 I no longer see it announced as a /20, only your own /18:

#sh ip bgp routes 150.182.192.0 255.255.192.0 longer-prefixes
Number of BGP Routes matching display condition : 4
Searching for matching routes, use ^C to quit...
Status A:AGGREGATE B:BEST b:NOT-INSTALLED-BEST C:CONFED_EBGP D:DAMPED
        E:EBGP H:HISTORY I:IBGP L:LOCAL M:MULTIPATH 
m:NOT-INSTALLED-MULTIPATH
        S:SUPPRESSED F:FILTERED s:STALE
        Prefix             Next Hop        MED        LocPrf Weight Status
1      150.182.192.0/18   80.94.64.10                400 0      BMI
          AS_PATH: 11164 10490 3450 14209
2      150.182.192.0/18   80.94.64.10                400 0      MI
          AS_PATH: 11164 10490 3450 14209
3      150.182.192.0/18   80.94.64.10                400 0      MI
          AS_PATH: 11164 10490 3450 14209
4      150.182.192.0/18   80.94.64.10                400 0      MI
          AS_PATH: 11164 10490 3450 14209

On 1/11/13 4:49 PM, Jeff Kell wrote:
> Robtex would beg to differ... you show peered with AS42861, perhaps
> someone (else) is looping their advertisements?
>
> _R_egistered
> _O_ther side
> _B_GP visible 	Peer
> OB 	AS174 COGENT /PSI
> B 	AS4323 TWTC Autonomous system for tw telecom .
> B 	AS4826 VOCUS-BACKBONE-AS Vocus Connect International Backbone Vocus
> Communications Level 2, Vocus House 189 Miller Street North Sydney NSW 2060
> B 	AS5580 ATRATO-IP / Atrato IP Networks
> B 	AS6461 MFNX MFN - Metromedia Fiber Network
> B 	AS6939 HURRICANE Electric
> B 	AS7575 AARNET-AS-AP Australia's Research and Education Network (AARNet3)
> B 	AS7922 COMCAST-IBONE Comcast Cable Communications, Inc. 1800 Bishops
> Gate Blvd Mt Laurel, NJ 08054 US
> B 	AS8359 MTS Dummy description for
> B 	AS10912 INTERNAP-BLK Internap Network Services
> B 	AS10913 INTERNAP-BLK Internap Network Services
> B 	AS12989 HWNG Eweka Internet Services B.V.
> B 	AS36351 SOFTLAYER Technologies Inc.
> B 	AS42861 PRIME-LINE-AS Dummy description for
>
>
>
> On 1/11/2013 10:42 AM, Kenneth McRae wrote:
>> Jeff,
>>
>> We are not announcing the prefix in question nor do we peer with AS42861.
>>
>>
>> -- 
>> Best Regards,
>>
>>
>>
>> Kenneth McRae
>> *Director, Network Operations*
>> kenneth.mcrae at dreamhost.com
>> Ph: 818-447-2589
>> www.dreamhost.com
>>
>>
>>
>> On Fri, Jan 11, 2013 at 7:23 AM, Jeff Kell <jeff-kell at utc.edu> wrote:
>>
>>      Not sure how widespread their "leakage" may be, but Dreamhost just
>>      hijacked one of my prefixes...
>>
>>      > ====================================================================
>>      > Possible Prefix Hijack (Code: 10)
>>      > ====================================================================
>>      > Your prefix:          150.182.192.0/18:
>>      > Update time:          2013-01-11 14:14 (UTC)
>>      > Detected by #peers:   11
>>      > Detected prefix:      150.182.208.0/20
>>      > Announced by:         AS26347 (DREAMHOST-AS - New Dream Network,
>>      LLC)
>>      > Upstream AS:          AS42861 (PRIME-LINE-AS JSC "Prime-Line")
>>      > ASpath:               8331 42861 42861 42861 26347
>>
>>      Anyone have a contact there?  ASinfo gives netops at dreamhost.com
>>      where I
>>      have submitted a report, but so far no joy...
>>
>>      Jeff
>>
>>
>>
>>
>>
>>
>> -- 
>> Best Regards,
>>
>>
>>
>> Kenneth McRae
>> *Sr. Network Engineer*
>> kenneth.mcrae at dreamhost.com
>> Ph: 323-375-3814
>> www.dreamhost.com
>>
>>
>>

-- 

Jeroen Wunnink
Network Engineer
Atrato IP Networks
jeroen.wunnink at atrato-ip.com
Phone: +31 20 82 00 623