North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Potential Prefix Hijack

  • From: Charlie Allom
  • Date: Mon Nov 10 22:07:59 2008 
On Tue, Nov 11, 2008 at 10:54:01AM +0800, Mark Tinka wrote:
> Hi all.
> 
> Anyone know how we can contact AS16735 and their upstream 
> AS27664. We think they are hijacking a number of our 
> prefixes (AS24218- and AS17992-originated). Thanks BGPmon:

Mine too - 

94.228.64.0/20
89.200.216.0/21
193.34.28.0/23

Except I see it as AS16735: (47998 is me)


        BGP routing table entry for 94.228.64.0/20
        Paths: (3 available, best #3, table Default-IP-Routing-Table)
          Advertised to non peer-group peers:
          193.0.0.71
          27664 16735
            200.219.130.21 from 200.219.130.21 (200.160.127.255)
              Origin IGP, localpref 100, valid, external
              Last update: Tue Nov 11 02:54:12 2008

          19089 12956 5511 8928 47998
            200.219.130.10 from 200.219.130.10 (200.225.95.3)
              Origin IGP, localpref 100, valid, external
              Community: 12956:65535
              Last update: Mon Nov 10 18:40:54 2008

          22548 16735
            200.160.0.130 from 200.160.0.130 (200.160.0.137)
              Origin IGP, localpref 100, valid, external, best
              Last update: Tue Nov 11 02:51:57 2008

> RIPE's RIS BGPlay confirms the same, for about the last 
> hour.

yep since 2am GMT.

  C.
-- 
 020 7729 4797
 http://blog.playlouder.com/

Attachment: pgp00012.pgp
Description: PGP signature