Anomalies with AS13214 ?

Mon May 11 16:46:01 UTC 2009

It looks like Cyclops is seeing these from AS 48285, but I see no indication
they are being advertised to any production upstream provider. Our /16 is
being alerted in Cyclops, but I can not find any advert on any looking
glass.

>From Cyclops:
BGP protocol Time (UTC) W/A/B Peer IP Peer ASN Prefix AS_PATH Origin
NEXT_HOP LOCAL_PREF MED Community Atomic Agg Aggregator 
BGP4MP 1242044196 A 194.71.0.1 48285 128.227.0.0/16 48285 13214 INCOMPLETE
194.71.0.1 0 0  NAG  

Robert D. Scott                 Robert at ufl.edu
Senior Network Engineer         352-273-0113 Phone
CNS - Network Services          352-392-2061 CNS Phone Tree
University of Florida           352-392-9440 FAX
Florida Lambda Rail             352-294-3571 FLR NOC
Gainesville, FL  32611          321-663-0421 Cell

-----Original Message-----
From: James Kelty [mailto:jkelty at pandora.com] 
Sent: Monday, May 11, 2009 12:20 PM
To: nanog at nanog.org
Subject: Re: Anomalies with AS13214 ?

Seeing the same issues with AS13214 and no corresponding drop in  
traffic, route views doesn't show any rogue adverts for out prefixes  
either.

-James

On May 11, 2009, at 9:01 AM, Vincent Hoffman wrote:

> On 11/5/09 16:30, Jay Hennigan wrote:
>> We're getting cyclops[1] alerts that AS13214 is advertising itself as
>> origin for all of our prefixes.  Their anomaly report shows thousands
>> of prefixes originating there.
>>
>> Anyone else seeing evidence of this or being affected?
>>
>>
>> [1] http://cyclops.cs.ucla.edu/
>>
>
> I'm seeing alerts for AS13214 advertising our prefixes from
> cyclops also.  However a quick look at a few looking glasses and route
> servers doesnt seem to show any rogue advertisments, and we havent see
> any drop in traffic as yet.
>
> Vince
>
>>
>> -- 
>> Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net
>> Impulse Internet Service  -  http://www.impulse.net/
>> Your local telephone and internet company - 805 884-6323 - WB6RDV
>
>

"Ravioli is the square root of pasta."
- Max K., Age 11