North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: prefix hijack by ASN 8997

  • From: Hank Nussbacher
  • Date: Tue Sep 23 02:53:26 2008
On Tue, 23 Sep 2008, Andree Toonk wrote:

Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files.
Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a  full table,  i.e. :
* 217.208 unique prefixes detected by the RIS server in Moscow (ASpath: 2895 3267 8997)
* 250495 seen by routeviews (ASpath: 2895 3267 8997).
(results of quick query: where AS-path contained '3267 8997' update type = advertisement).

ASpath: 2895 3267 8997

Is that the only ASpath that leaked it? There are others - did they filter properly and only that path failed to filter?

Regards,
Hank