prefix hijack by ASN 8997
hank at efes.iucc.ac.il
Tue Sep 23 01:53:17 CDT 2008
On Tue, 23 Sep 2008, Andree Toonk wrote:
> Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files.
> Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a full table, i.e. :
> * 217.208 unique prefixes detected by the RIS server in Moscow (ASpath: 2895 3267 8997)
> * 250495 seen by routeviews (ASpath: 2895 3267 8997).
> (results of quick query: where AS-path contained '3267 8997' update type = advertisement).
> ASpath: 2895 3267 8997
Is that the only ASpath that leaked it? There are others - did they
filter properly and only that path failed to filter?
More information about the NANOG