What's going on with AS147028?

Tue Jul 12 22:30:14 UTC 2022

Just to name few others with the same issue.

AS140731
AS141011
AS141237

Best regards
August Yang

> On Jul 12, 2022, at 6:20 PM, Mike Leber via NANOG <nanog at nanog.org> wrote:
> 
> This kind of thing is a problem from time to time with the data we get from route collectors.
> 
> When we see it we have to add the culprit ASN to a filter list we keep in bgp.he.net.
> 
> It tends to be a repeat problem with some collectors and some ASNs.
> 
> We haven't really figured out why people send junk routes to route collectors.
> 
> The things we've seen aren't just route leaks.  We've seen a variety of AS path spoofing.
> 
> We've already added this specific ASN to the filter list and pushed an update for bgp.he.net.
> 
> Note, this email is specifically talking about routes received from route collectors and not routes operationally received by he.net via BGP sessions with actual networks.
> 
> Mike.
> 
> On 7/12/22 12:49 PM, Eric Dugas via NANOG wrote:
>> A friend of mine mentioned that both our Canadian ASNs were listed in AS147028's peer list on https://bgp.he.net/AS147028 but we have no adjacency to this network.
>> 
>> Their peer count jumped from 1 in May 2022 to 1,800 and just a few days ago jumped to 8,800. Beside NL-IX, all the IX they are listed on are virtual IX with a few dozen "hobby networks".
>> 
>> The only lead I have is they use HE as transit and they're pumping back BGP feed to route collectors like RIPE RIS or Route Views with routes stripped of HE's ASN.
>> 
>> Eric
>> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4372 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20220712/c60f3b8d/attachment.bin>