Potential Prefix Hijack

Charlie Allom charlie at playloudermsp.com
Mon Nov 10 21:06:18 CST 2008


On Tue, Nov 11, 2008 at 10:54:01AM +0800, Mark Tinka wrote:
> Hi all.
> 
> Anyone know how we can contact AS16735 and their upstream 
> AS27664. We think they are hijacking a number of our 
> prefixes (AS24218- and AS17992-originated). Thanks BGPmon:

Mine too - 

94.228.64.0/20
89.200.216.0/21
193.34.28.0/23

Except I see it as AS16735: (47998 is me)


        BGP routing table entry for 94.228.64.0/20
        Paths: (3 available, best #3, table Default-IP-Routing-Table)
          Advertised to non peer-group peers:
          193.0.0.71
          27664 16735
            200.219.130.21 from 200.219.130.21 (200.160.127.255)
              Origin IGP, localpref 100, valid, external
              Last update: Tue Nov 11 02:54:12 2008

          19089 12956 5511 8928 47998
            200.219.130.10 from 200.219.130.10 (200.225.95.3)
              Origin IGP, localpref 100, valid, external
              Community: 12956:65535
              Last update: Mon Nov 10 18:40:54 2008

          22548 16735
            200.160.0.130 from 200.160.0.130 (200.160.0.137)
              Origin IGP, localpref 100, valid, external, best
              Last update: Tue Nov 11 02:51:57 2008

> RIPE's RIS BGPlay confirms the same, for about the last 
> hour.

yep since 2am GMT.

  C.
-- 
 020 7729 4797
 http://blog.playlouder.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 163 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20081111/582f3bd0/attachment.bin>


More information about the NANOG mailing list