Potential Prefix Hijack
swm at emanon.com
Mon Nov 10 22:01:05 CST 2008
I sent e-mails to the AS contacts, but don't expect that to do much in the
middle of the night. No live person at the phone numbers. I can't even
get their web site to come up, although if they're re-routing the entire BGP
table internally, go figure. :)
BGPMon's a great thing though!
Somebody's been bad tonight.
From: jamie [mailto:j at arpa.com]
Sent: Monday, November 10, 2008 10:37 PM
To: Network Fortius
Cc: nanog at nanog.org
Subject: Re: Potential Prefix Hijack
Obvious, since I posted about it earlier, but confirmed here as well. Has
anyone made contact with these guys? I have yet to...
On Mon, Nov 10, 2008 at 9:32 PM, Network Fortius
<netfortius at gmail.com>wrote:
> Same problems here, for AS26028
> On Mon, Nov 10, 2008 at 8:54 PM, Mark Tinka <mtinka at globaltransit.net
> > Hi all.
> > Anyone know how we can contact AS16735 and their upstream AS27664.
> > We think they are hijacking a number of our prefixes (AS24218- and
> > AS17992-originated). Thanks BGPmon:
> > e.g.,
> > ====================
> > Possible Prefix Hijack (Code: 11)
> > 1 number of peer(s) detected this updates for your prefix
> > 22.214.171.124/20:
> > Update details: 2008-11-11 02:24 (UTC) 126.96.36.199/20 Announced by:
> > AS16735 (Companhia de Telecomunicacoes do Brasil Central) Transit
> > AS: 27664 (CTBC Multimídia)
> > ASpath: 27664 16735
> > =====================
> > RIPE's RIS BGPlay confirms the same, for about the last hour.
> > E-mails to them won't get there (of course), so our NOC are
> > contacting them via Gmail/Yahoo.
> > All help appreciated.
> > Cheers,
> > Mark.
More information about the NANOG