Kenyan Route Hijack

Mon Mar 17 07:43:04 UTC 2008

On 17 Mar 2008 04:12:13 +0000, Paul Vixie <vixie at isc.org> wrote:
>  i think, at this stage and at this date, that bringing up the ORBS/abovenet
>  debacle constitutes a "canard", and should be avoided, for the good of all.

Completely unrelated to l'affaire ORBS of course, but in this more
recent example, was uunet kenya a transit customer (or customer of a
customer) of abovenet?  And quoting from a previous email -

--------

An interesting bit is that the current announcement on routeviews
directly from AS 6461 has Community 6461:5999 attached:
...
  6461
    64.125.0.137 from 64.125.0.137 (64.125.0.137)
      Origin IGP, metric 0, localpref 100, valid, external, best
      Community: 6461:5999
...

According to this, that community is used for "internal prefixes":

http://onesc.net/communities/as6461/

"6461:5999 internal prefix"

A "sh ip bgp community 6461:5999" currently yields 130 prefixes
with Origin AS of 6461 and that community.  Nothing more specific
than a /24, although many many adjacent prefixes that would
presumably be aggregated normally are announced as well.

-------

anybody see similar routing loops for those other prefixes that'd make
it look like 5999 is a blackhole community at abovenet, so this dude
is seeing what ORBS saw way back when (2000, right) - that is, he had
abuse issues, was downstream of a downstream of abovenet and got his
/24 blackholed?

srs