Suspecious anycast prefixes

Mon May 2 19:35:20 UTC 2011

On 2011-05-02, at 21:16, Yaoqing(Joey) Liu wrote:

> I found the following prefixes are often originated by many ASNs more than
> five, wonder if they provide global anycast service, if so what specific
> service they provide?
> 
> 12.64.255.0/24

CERNET.

> 70.37.135.0/24

Microsoft/Hotmail.

> 198.32.176.0/24

Yahoo!

> 199.7.49.0/24

VeriSign.

> 199.7.80.0/24

VeriSign.

> 199.16.93.0/24

VeriSign.

> 199.16.94.0/24

VeriSign.

> 199.16.95.0/24

VeriSign.

> 206.223.115.0/24

Yahoo!

These to me are all organisations that might reasonably be distributing services using anycast. It's difficult to tell whether all the origin ASes you see for those prefixes are legitimate, of course.

It's perhaps worth noting that there is work in the IETF to recommend that every prefix originated as part of an anycast cloud uses a unique origin AS (see <http://tools.ietf.org/html/draft-ietf-grow-unique-origin-as-00>). I'm not personally convinced of the arguments in the draft, but mentioning it in this thread seems reasonable.

Joe