Mailing List Archive: NANOG: users

Re: Fwd: RE: Potential Prefix Hijack

Index | Next | Previous | View Threaded

surfer at mauigateway

Nov 10, 2008, 9:29 PM

Post #1 of 2 (372 views)
Permalink

Re: Fwd: RE: Potential Prefix Hijack

Using bgplay.routeviews.org/bgplay for my prefixes (also hijacked) it looks like the damage is only to ASs downstream of either (or both) ASN 3130 and/or ASN 2914.

Given the large number of respondents to the thread, it looks like a possible case of no filtering by upstreams and full table announcements/withdrawals over a period of about 40 minutes beginning 23:22 11/10/2008 GMT. There was also a problem at 17:09:30 2008 GMT for our prefixes.

scott

ps.

subthread on what's working and how with these prefix hijack alert systems: BGPmon alerted on this and PHAS did not. They're the only two I am on at this time.

The 3.5 hour period has not happened for PHAS's damping technique to work. I have 10 separate emails from BGPmon

hank at efes

Nov 10, 2008, 10:30 PM

Post #2 of 2 (333 views)
Permalink

Re: Fwd: RE: Potential Prefix Hijack [In reply to]

On Mon, 10 Nov 2008, Scott Weeks wrote:

>
>
>
> Using bgplay.routeviews.org/bgplay for my prefixes (also hijacked) it looks like the damage is only to ASs downstream of either (or both) ASN 3130 and/or ASN 2914.
>
> Given the large number of respondents to the thread, it looks like a possible case of no filtering by upstreams and full table announcements/withdrawals over a period of about 40 minutes beginning 23:22 11/10/2008 GMT. There was also a problem at 17:09:30 2008 GMT for our prefixes.

AS378 and AS1680 suffered as well.

-Hank

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads