Anyone notice strange announcements for 174.128.31.0/24

Mon Jan 12 20:33:00 UTC 2009

I agree with Paul and Michienne, having the courtesy to notify next time
would be very much appreciated.  I was headed into a family member's
funeral when I received the hijack notification.  I took the 15 minutes
to do some quick investigation, fire off a few emails informing my
colleagues of the issue and "arrived" at the funeral a bit late. 

Perhaps in the future it would be better not to play with my toys
without asking my permission first?

- - - -
Joshua Fiske '03, '04
Network and Security Engineer
Clarkson University, Office of Information Technology
(315) 268-6722 -- Fax:  (315) 268-6570
I route, therefore you are.

  Think before you print.

CONFIDENTIALITY:  This e-mail (including any attachments) may contain
confidential, proprietary and privileged information, and unauthorized
disclosure or use is prohibited.  If you received this e-mail in error,
please notify the sender and delete this e-mail from your system.

-----Original Message-----
From: Paul Stewart [mailto:pstewart at nexicomgroup.net] 
Sent: Monday, January 12, 2009 2:29 PM
To: Michienne Dixon; nanog at nanog.org
Subject: RE: Anyone notice strange announcements for 174.128.31.0/24

Absolutely - according to their website " No real or production prefixes
or data packets are being harmed in this experiment. If you become aware
that this experiment causes any actual real operational problem, please
write to us immediately. "

I have asked them to have some courtesy next time before wasting a lot
of people's time...

Paul

-----Original Message-----
From: Michienne Dixon [mailto:mdixon at nkc.org] 
Sent: Monday, January 12, 2009 2:20 PM
To: nanog at nanog.org
Subject: RE: Anyone notice strange announcements for 174.128.31.0/24

The IAR was the source of my notice as well and is what started me down
this path of cat herding.
I would think that it would only be polite to notify people about what
is going on so that other people do not waste their time looking for
phantom issues.

-
Michienne Dixon
Network Administrator
liNKCity
312 Armour Rd.
North Kansas City, MO  64116
www.linkcity.org <http://www.linkcity.org/> 
(816) 412-7990

________________________________

From: karlinjf at gmail.com [mailto:karlinjf at gmail.com] On Behalf Of Josh
Karlin
Sent: Monday, January 12, 2009 12:57 PM
To: Paul Stewart
Cc: Majdi S. Abbas; Michienne Dixon; nanog at nanog.org
Subject: Re: Anyone notice strange announcements for 174.128.31.0/24

At some point 3130 announced these prefixes, and is now prepending other
ASes to them.  Pretty Good BGP (and hence the IAR) sees them as prefix
hijacks.  If you'd like to see the entire list of prefixes, check out:
http://iar.cs.unm.edu/search.php and enter in 3130 as the "Victim AS"

Josh

On Mon, Jan 12, 2009 at 11:52 AM, Paul Stewart
<pstewart at nexicomgroup.net> wrote:

	Same here.. got a notice this morning and while it's false, I
still have
	no response from Randy neither on this matter...

	If they are going to involve our AS numbers and trigger alarms
it would
	be nice to notify us first... especially on something as major
as a
	prefix hijacking (potentially)

	Paul

------------------------------------------------------------------------
----

"The information transmitted is intended only for the person or entity
to which it is addressed and contains confidential and/or privileged
material. If you received this in error, please contact the sender
immediately and then destroy this transmission, including all
attachments, without copying, distributing or disclosing same. Thank
you."