prefix hijack by ASN 8997

Tue Sep 23 06:53:17 UTC 2008

On Tue, 23 Sep 2008, Andree Toonk wrote:

> Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files.
> Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a  full table,  i.e. :
> * 217.208 unique prefixes detected by the RIS server in Moscow (ASpath: 2895 3267 8997)
> * 250495 seen by routeviews (ASpath: 2895 3267 8997).
> (results of quick query: where AS-path contained '3267 8997' update type = advertisement).
>
> ASpath: 2895 3267 8997

Is that the only ASpath that leaked it?  There are others - did they 
filter properly and only that path failed to filter?

Regards,
Hank