BGP Hijack by AT&T... was: Need Help Getting IP Unblocked by AT&T

Thu Sep 3 14:46:52 UTC 2009

No is just seems to die in their core network.

Dorn Hetzel wrote:
> If you traceroute from someplace that sees the announcement from ATT,
> does it actually go anywhere beyond the core in ATT (as if they are
> sending it to any customer circuit of their) ?
>
> On Thu, Sep 3, 2009 at 10:23 AM, Brian Raaen <braaen at zcorum.com
> <mailto:braaen at zcorum.com>> wrote:
>
>     I have not seen any changes yet, although I did get an automated
>     response from their abuse address that they received my message.
>      Also,
>     to answer another question I have not changed backbones in over two
>     years.  I largely suspect that this is an issue of a simple typo
>     and not
>     anything malicious.
>
>     --
>     -----------------
>     Brian Raaen
>     Network Engineer
>     email: /braaen at zcorum.com/ <http://[email protected]/>
>     <mailto:braaen at zcorum.com <mailto:braaen at zcorum.com>>
>
>
>     Gustavo Rodrigues Ramos wrote:
>     > Hi Brian, has someone from at&t contacted you or have you
>     noticed any change?
>     >
>     > Thanks,
>     > Gustavo.
>     >
>     >
>     > On Thu, Sep 3, 2009 at 9:43 AM, Brian Raaen<braaen at zcorum.com
>     <mailto:braaen at zcorum.com>> wrote:
>     >
>     >> I have sent a complaint to the AT&T abuse contact from my ARIN
>     contact
>     >> address asking them to stop announcing the route.
>     >>
>     >> --
>     >> -----------------
>     >> Brian Raaen
>     >> Network Engineer
>     >> email: /braaen at zcorum.com/ <http://[email protected]/>
>     <mailto:braaen at zcorum.com <mailto:braaen at zcorum.com>>
>     >>
>     >> Brian Raaen wrote:
>     >>
>     >>> I appreciate the offline replies.  After doing some more
>     research myself
>     >>> the issue appears to be related to the fact that AT&T is
>     announcing the
>     >>> block directly.  I did show "ip bgp 72.14.76.0" in a couple
>     routers and
>     >>> some showed the route originating in 701 (they were able to
>     reach it)
>     >>> and others showed it originating in 7018 (and they could not
>     reach it).
>     >>>
>     >>> Here is my question, since I am an ARIN admin contact for the
>     IP block
>     >>> how is the best way to get AT&T to quit announcing the block.
>     >>>
>     >>>
>     >>>
>
>

-- 
-----------------
Brian Raaen
Network Engineer
email: /braaen at zcorum.com/ <mailto:braaen at zcorum.com>
Telephone /678-507-5000x5574/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: braaen.vcf
Type: text/x-vcard
Size: 206 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20090903/df001777/attachment.vcf>