Dodgy AS327933 ...?

Thu Aug 10 13:22:56 UTC 2023

On 10/08/2023 16:02, Mark Tinka wrote:
> 
> We are seeing some weird routing from them, and the AS2 they are 
> attached to (University of Delaware) seems odd.
> 
> Not sure if any of the American folk on this list can verify AS2 is 
> really part of the University of Delaware...
> 
> Mark.

ouch!
I see in your LG that this AS 2 is originating 197.157.254.0/24 .

which seems to mean that it's not just a plain "we want to prepend 2 
times, put the number 2 into config and the NOS takes this as the ASN to 
insert"

putting someone from  AS37451 into BCC.

ouch again!
looking for "show ip bgp regexp _37451 2_" in Mark's LG, i see there are 
many originated and downstream's prefixes of AS37451 affected.

So i'd now thing it's a AS37451 issue, not AS327933 alone.

Frank