Suspecious anycast prefixes

Joe Abley jabley at hopcount.ca
Mon May 2 14:35:20 CDT 2011


On 2011-05-02, at 21:16, Yaoqing(Joey) Liu wrote:

> I found the following prefixes are often originated by many ASNs more than
> five, wonder if they provide global anycast service, if so what specific
> service they provide?
> 
> 12.64.255.0/24

CERNET.

> 70.37.135.0/24

Microsoft/Hotmail.

> 198.32.176.0/24

Yahoo!

> 199.7.49.0/24

VeriSign.

> 199.7.80.0/24

VeriSign.

> 199.16.93.0/24

VeriSign.

> 199.16.94.0/24

VeriSign.

> 199.16.95.0/24

VeriSign.

> 206.223.115.0/24

Yahoo!

These to me are all organisations that might reasonably be distributing services using anycast. It's difficult to tell whether all the origin ASes you see for those prefixes are legitimate, of course.

It's perhaps worth noting that there is work in the IETF to recommend that every prefix originated as part of an anycast cloud uses a unique origin AS (see <http://tools.ietf.org/html/draft-ietf-grow-unique-origin-as-00>). I'm not personally convinced of the arguments in the draft, but mentioning it in this thread seems reasonable.


Joe



More information about the NANOG mailing list