Dodgy AS327933 ...?

Sat Aug 12 03:50:46 UTC 2023

Looking at this I also saw that for a short time some prefixes belonging to AS37451 were announced by AS2454388738 (see [0] and [1]).
Anybody have a smart idea which command could have caused this?

[0] https://stat.ripe.net/ui2013/widget/bgp-update-activity#w.starttime=2023-08-10T23%3A00%3A00&w.endtime=2023-08-11T23%3A00%3A00&w.resource=AS2454388738
[1] https://stat.ripe.net/ui2013/widget/announced-prefixes#w.resource=AS2454388738&w.min_peers_seeing=3

Malte

On 8/11/23 18:26, Nick Hilliard wrote:
> 
> If your asn is 327933, then:
> 
> add chain=foo prefix=192.0.2.0/24 action=accept set-bgp-prepend=2
> 
> ... will produce: "327933 327933", and:
> 
> add chain=foo prefix=192.0.2.0/24 action=accept set-bgp-prepend-path=2
> 
> ... will produce: "327933 2".
> 
> Routeros does command completion on the CLI, so this is finger-slip territory, and the two commands are visually similarly enough to each other that it would be easy not to notice.
> 
> Nick
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x1FE5C61A04A4159F.asc
Type: application/pgp-keys
Size: 3134 bytes
Desc: OpenPGP public key
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20230812/5e79ed1f/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20230812/5e79ed1f/attachment.sig>