AS21299 - 46.42.196.0/24 ASN prepending 255 times

Fri Mar 25 04:45:49 UTC 2022

On 3/24/2022 5:43 PM, Erik Sundberg wrote:
If anyone from AS21299 is lurking on Nanog. Please reduce your AS prepends for 46.42.196.0/24 from 255 prepends to a more reasonable number of prepends let's say 20. Thanks!

This is a Kazakhstan register IP Block and ASN

  Network   Next Hop   Metric LocPrf Weight Path
*> 46.42.196.0/24  x.x.x.x     0  100   0 2914 174 3216 3216 35168 21299 <many prepends snipped>

------------------------------------------------------------

This is the one I was asking about in:
https://mailman.nanog.org/pipermail/nanog/2022-March/217925.html

There're a lot more prefixes from them.

86.107.128.0/21
92.49.252.0/24
176.222.164.0/23
176.222.166.0/23
176.222.181.0/24
37.99.2.0/23
5.34.106.0/23

In that email I was worried they were probing for attack vectors, but when I looked into it I found it has been happening off and on for a fairly long time. 

My bet is the network guys don't want to do anything until told by non-tech managers as the Kazakhstan people just went through (are still going through?) an authoritarian beat down from the Kazakhstan government helped by the Russian government just before the invasion of Ukraine.

scott