China prefix hijack
Frank Pater
fpater at dca.net
Thu Apr 8 17:19:35 UTC 2010
Hi,
We received BGPmon notifications for all of our prefixes as well. Not sure if it's relevant, but this is also announced upstream from us by 3491. Example:
====================================================================
Possible Prefix Hijack (Code: 10)
====================================================================
Your prefix: 216.158.0.0/18:
Update time: 2010-04-08 15:58 (UTC)
Detected by #peers: 1
Detected prefix: 216.158.0.0/18
Announced by: AS23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation)
Upstream AS: AS4134 (CHINANET-BACKBONE No.31,Jin-rong Street)
ASpath: 39792 4134 23724 23724
--
Frank Pater
DCANet
http://www.dca.net
voice: 888-4-DCANET (888-432-2638)
fax: 302-426-6386
On Thu, Apr 08, 2010 at 12:39:57PM -0400, Chris McDonald wrote:
> i think so yeah
>
> AS 23724 is now announcing 63.218.188.0/22 which is historically announced
> by ASes: 3491.
> Time: Thu Apr 8 16:55:02 2010 GMT
> Observed path: 812 174 4134 23724 23724
>
>
> On Thu, Apr 8, 2010 at 12:33 PM, Grzegorz Janoszka <Grzegorz at janoszka.pl>wrote:
>
> >
> > Just half an hour ago China Telecom hijacked one of our prefixes:
> >
> > Your prefix: X.Y.Z.0/19:
> > Prefix Description: NETNAME
> > Update time: 2010-04-08 15:58 (UTC)
> > Detected by #peers: 1
> > Detected prefix: X.Y.Z.0/19
> > Announced by: AS23724 (CHINANET-IDC-BJ-AP IDC, China
> > Telecommunications Corporation)
> > Upstream AS: AS4134 (CHINANET-BACKBONE No.31,Jin-rong Street)
> > ASpath: 39792 4134 23724 23724
> >
> > Luckily it had to be limited as only one BGPmon peer saw it. Anyone else
> > noticed it?
> >
> > --
> > Grzegorz Janoszka
> >
> >
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20100408/66e51286/attachment.sig>
More information about the NANOG
mailing list