AS4134/AS4847 - Appear to be hijacking some ip space.

Christopher Morrow morrowc.lists at gmail.com
Fri Apr 5 15:02:56 UTC 2019


Howdy gentle folks:

It looks like AS4847 - "China Networks Inter-Exchange"

Is taking some time to announce reachability for at least:
  136.38.33.0/24

which they ought not, given that this /24 is part of a /11 assigned to
AS16591 (google fiber)... Looking at routeviews data, I see the
following as-paths for this one /24:
$ grep -A1 Refresh /tmp/x | grep 4847
  1239 174 4134 4847
  3549 3356 174 4134 4847
  701 174 4134 4847
  4901 6079 3257 4134 4847
  20912 174 4134 4847
  1221 4637 4134 4847
  1351 11164 4134 4847
  6079 1299 4134 4847
  6079 3257 4134 4847
  7018 4134 4847
  6939 1299 4134 4847
  3561 209 4134 4847
  3303 4134 4847
  3277 39710 9002 4134 4847
  2497 4134 4847
  4826 1299 4134 4847
  54728 20130 23352 2914 4134 4847
  19214 3257 4134 4847
  101 101 11164 4134 4847
  1403 6453 4134 4847
  852 6453 4134 4847
  1403 6453 4134 4847
  286 4134 4847
  3333 1273 4134 4847
  57866 3491 4134 4847
  3267 1299 4134 4847
  49788 174 4134 4847
  53767 3257 4134 4847
  53364 3257 4134 4847
  8283 57866 3491 4134 4847
  7660 2516 4134 4847

>From that I think the following AS should have filtered this prefix and are not:
$ grep -A1 Refresh /tmp/x | grep 4847 | sed 's/ 4134 4847//' | awk
'{print $NF}' | sort -n | uniq

174  - Cogent
209 - Qwest
286 - KPN
1273 - Vodafone
1299 - Telia
2497 - IIJ
2516 - KDDI
2914 - NTT
3257 - GTT
3303 - Swisscom
3491 - PCCW
4637 - Telstra
6453 - TATA
7018 - ATT
9002 - RETN
11164 - Internet2

It'd be great if the listed folk could filter AS4134 :)

-Chris



More information about the NANOG mailing list