Anomalies with AS13214 ?
morrowc.lists at gmail.com
Mon May 11 13:39:38 CDT 2009
On Mon, May 11, 2009 at 2:29 PM, Andree Toonk <andree+nanog at toonk.nl> wrote:
> .-- My secret spy satellite informs me that at Mon, 11 May 2009, Jay Hennigan wrote:
>> We're getting cyclops alerts that AS13214 is advertising itself as
>> origin for all of our prefixes. Their anomaly report shows thousands of
>> prefixes originating there.
>> Anyone else seeing evidence of this or being affected?
> It seems it was picked up by route-views4. Non of the RIS peers seem to have seen this.
> Looking at the raw bgp data from route-views4:
> AS13214 leaked a full table (~266294 prefixes) with 13214 as OriginAS to AS48285 which is a routeviews4 peer.
> Routeviews4 saw these announcements as: ASpath 48285 13214.
Since 48285 == robtex, is it possible TPB was just setting up a
monitoring/route-feed session to robtex and either missed their
outbound policy or sent them the wrong form of outbound policy (full
routes not customer only routes)??
More information about the NANOG