prefix hijack by ASN 8997

Scott Weeks surfer at
Tue Sep 23 10:54:21 CDT 2008

------ tme at wrote: ----------
From: Marshall Eubanks <tme at>

So, do you think this was lots of little tests / hijacks / mistakes ?  
Or did it just not propagate very far ?

According to Andree Toonk (and someone confirmed privately) ASN 8997 leaked a full table to ASN 3267 (who didn't filter!).  The only upstream of ASN 3267 I saw in bgplay was ASN 174 (Cogent) who seems to have filtered, but I can't confirm.  So I guess that the impact would've only been to the peers downstream of ASN 3267.


Andree Toonk <andree+nanog at>

Not a false positive, It actually was detected by the RIS box in Moscow 
(rrc13). Strange that it's not visible in RIS search website, but it's 
definitely in the raw data files.
Looking at that raw data from both routeviews and Ripe, it looks like 
they (AS8997) 'leaked' a  full table,  i.e. :

More information about the NANOG mailing list