Anomalies with AS13214 ?

Christopher Morrow morrowc.lists at
Mon May 11 13:39:38 CDT 2009

On Mon, May 11, 2009 at 2:29 PM, Andree Toonk <andree+nanog at> wrote:
> .-- My secret spy satellite informs me that at Mon, 11 May 2009, Jay Hennigan wrote:
>> We're getting cyclops[1] alerts that AS13214 is advertising itself as
>> origin for all of our prefixes.  Their anomaly report shows thousands of
>> prefixes originating there.
>> Anyone else seeing evidence of this or being affected?
> It seems it was picked up by route-views4. Non of the RIS peers seem to have seen this.
> Looking at the raw bgp data from route-views4:
> AS13214 leaked a full table (~266294 prefixes) with 13214  as OriginAS to AS48285 which is a routeviews4 peer.
> Routeviews4 saw these announcements as: ASpath 48285 13214.

Since 48285 == robtex, is it possible TPB was just setting up a
monitoring/route-feed session to robtex and either missed their
outbound policy or sent them the wrong form of outbound policy (full
routes not customer only routes)??


More information about the NANOG mailing list