prefix hijack by ASN 8997

Tue Sep 23 15:54:21 UTC 2008

------ tme at multicasttech.com wrote: ----------
From: Marshall Eubanks <tme at multicasttech.com>

So, do you think this was lots of little tests / hijacks / mistakes ?  
Or did it just not propagate very far ?
---------------------------------------------

According to Andree Toonk (and someone confirmed privately) ASN 8997 leaked a full table to ASN 3267 (who didn't filter!).  The only upstream of ASN 3267 I saw in bgplay was ASN 174 (Cogent) who seems to have filtered, but I can't confirm.  So I guess that the impact would've only been to the peers downstream of ASN 3267.

scott

---------------------------------------------
Andree Toonk <andree+nanog at toonk.nl>

Not a false positive, It actually was detected by the RIS box in Moscow 
(rrc13). Strange that it's not visible in RIS search website, but it's 
definitely in the raw data files.
Looking at that raw data from both routeviews and Ripe, it looks like 
they (AS8997) 'leaked' a  full table,  i.e. :
----------------------------------------------