<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8">Hi Ross,<div><br></div><div>Just to confirm the AS1221 incident (INC000094009293) was resolved approx. 20:32 29/09/20 (UTC).</div><div><br></div><div>If anyone has further issues feel free to email me off-thread.</div><div><br></div><div>Regards,</div><div><br></div><div>-Mark</div><div>Senior Network Engineer</div><div>AS1221</div><div><br><br><div dir="ltr">Sent from my iPhone</div><div dir="ltr"><br><blockquote type="cite">On 30 Sep 2020, at 07:30, Ross Tajvar <ross@tajvar.io> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">Bad prefixes are all gone. This looks resolved from my point of view.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 29, 2020 at 5:18 PM Ross Tajvar <<a href="mailto:ross@tajvar.io">ross@tajvar.io</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">I'm still seeing bad prefixes from Cogent, but our other upstreams (NTT, GTT, Telia) blocked them.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 29, 2020 at 5:09 PM Sadiq Saif <<a href="mailto:lists@sadiqsaif.com" target="_blank">lists@sadiqsaif.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, 29 Sep 2020, at 16:36, Ross Tajvar wrote:<br>
> I'm surprised no one else has mentioned this yet, but Telstra is <br>
> hijacking a lot of prefixes:<br>
> <br>
> <a href="https://rpki.cloudflare.com/?view=bgp&prefix=&asn=1221&validState=Invalid" rel="noreferrer" target="_blank">https://rpki.cloudflare.com/?view=bgp&prefix=&asn=1221&validState=Invalid</a> <br>
> <br>
> Since we don't have RPKI filtering in our network (yet), we are <br>
> currently filtering everything with the path ".* 4637 1221$". <br>
> <br>
> This is of course taking a while...<br>
<br>
My employer's prefixes were affected, I posted about it on the AusNOG list so I could get some assistance. It has cleared up now but it took about two hours or so.<br>
<br>
I saw AS paths like this from HE's looking glass:<br>
6461x4, 4637x11, 1221<br>
<br>
I would love to know what the root cause of the leak was.<br>
<br>
-- <br>
Sadiq Saif<br>
</blockquote></div>
</blockquote></div>
</div></blockquote></div></div></div></body></html>