North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: prefix hijack by ASN 8997

  • From: Jim Popovitch
  • Date: Tue Sep 23 15:55:57 2008

On Mon, Sep 22, 2008 at 22:13, Jim Popovitch <[email protected]> wrote:
> On Mon, Sep 22, 2008 at 21:06, Scott Weeks <[email protected]> wrote:
>>
>> I am hoping to confirm a short-duration prefix hijack of 72.234.0.0/15 (and another of our
>> prefixes) by ASN 8997 ("OJSC North-West Telecom" in Russia) in using ASN 3267
>> (Russian Federal University Network) to advertise our space to ASN 3277 (Regional
>> University and Scientific Network (RUSNet) of North-Western and Saint-Petersburg
>> Area of Russia).
>
> Yep, saw this for 69.61.0.0/17 GlobalCompass (my upstream) this AM:
>
> SEQUENCE_NUMBER: 1222091638
> TYPE: last-hop
> BGP-UPDATE-TIME: 1222075864
> PHAS-DETECT-TIME: 1222091637
> PHAS-NOTIFY-TIME: 1222091637
> PREFIX: 69.61.0.0/17
> SET: 3561,3267,3356,3491
> GAINED: 3267  <- Russian Federal University Network
> LOST:
>
> SEQUENCE_NUMBER: 1222091638
> TYPE: origin
> BGP-UPDATE-TIME: 1222075864
> PHAS-DETECT-TIME: 1222091637
> PHAS-NOTIFY-TIME: 1222091637
> PREFIX: 69.61.0.0/17
> SET: 8997,22653
> GAINED: 8997 <- OJSC North-West Telecom, St.-Petersburg, Russia
> LOST:
>
> SEQUENCE_NUMBER: 1222096125
> TYPE: origin
> BGP-UPDATE-TIME: 1222076569
> PHAS-DETECT-TIME: 1222092415
> PHAS-NOTIFY-TIME: 1222096124
> PREFIX: 69.61.0.0/17
> SET: 22653   <- GlobalCrossing

Small typo on my part above...  22653 is GlobalCompass, not
GlobalCrossing as I mistakenly typed above.

-Jim P.