[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
China prefix hijack
Hi,
We received BGPmon notifications for all of our prefixes as well. Not sure if it's relevant, but this is also announced upstream from us by 3491. Example:
====================================================================
Possible Prefix Hijack (Code: 10)
====================================================================
Your prefix: 216.158.0.0/18:
Update time: 2010-04-08 15:58 (UTC)
Detected by #peers: 1
Detected prefix: 216.158.0.0/18
Announced by: AS23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation)
Upstream AS: AS4134 (CHINANET-BACKBONE No.31,Jin-rong Street)
ASpath: 39792 4134 23724 23724
--
Frank Pater
DCANet
http://www.dca.net
voice: 888-4-DCANET (888-432-2638)
fax: 302-426-6386
On Thu, Apr 08, 2010 at 12:39:57PM -0400, Chris McDonald wrote:
> i think so yeah
>
> AS 23724 is now announcing 63.218.188.0/22 which is historically announced
> by ASes: 3491.
> Time: Thu Apr 8 16:55:02 2010 GMT
> Observed path: 812 174 4134 23724 23724
>
>
> On Thu, Apr 8, 2010 at 12:33 PM, Grzegorz Janoszka <Grzegorz at janoszka.pl>wrote:
>
> >
> > Just half an hour ago China Telecom hijacked one of our prefixes:
> >
> > Your prefix: X.Y.Z.0/19:
> > Prefix Description: NETNAME
> > Update time: 2010-04-08 15:58 (UTC)
> > Detected by #peers: 1
> > Detected prefix: X.Y.Z.0/19
> > Announced by: AS23724 (CHINANET-IDC-BJ-AP IDC, China
> > Telecommunications Corporation)
> > Upstream AS: AS4134 (CHINANET-BACKBONE No.31,Jin-rong Street)
> > ASpath: 39792 4134 23724 23724
> >
> > Luckily it had to be limited as only one BGPmon peer saw it. Anyone else
> > noticed it?
> >
> > --
> > Grzegorz Janoszka
> >
> >
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20100408/66e51286/attachment.bin>