Re: Potential Prefix Hijack

From: Nuno Vieira - nfsi telecom (no email)
Date: Tue Nov 11 2008 - 07:33:43 EST

  • Next message: Raymond Dijkxhoorn: "Re: Potential Prefix Hijack"

    Howdy,

    We were hijacked aswell, by 27664 16735

    Our affected prefixes were:

    94.46.0.0/16
    194.88.142.0/23
    194.11.23.0/24
    82.102.0.0/18
    195.246.238.0/23
    194.107.127.0/24
    81.92.192.0/19
    193.227.238.0/23

    We are trying to contact them in order to get some feedback, and some good explanation for this.

    In the meanwhile, there are lots of evidence spread around (thanks to RIS RIPE, Routeviews, BGPmon and others)

    http://www.ris.ripe.net/dashboard/27664
    http://www.ris.ripe.net/dashboard/16735

    In the meanwhile we are sending notices to the Upstreams of those ASN's, in order for them to apply proper filtering to their downstream customers to avoid situations like this.

    On the List i was able to found:

    AS8167 - TELESC
    AS6762 - SEABONE
    AS12956 - TELEFONICA
    AS3549 - GLOBAL CROSSING
    AS17379 - Interlig

    I welcome others to do the same, in order to avoid replicas for this situation.

    Regards,

    ---
    Nuno Vieira
    nfsi telecom, lda.
    Tel. (+351) 21 949 2300 - Fax (+351) 21 949 2301
    http://www.nfsi.pt/
    ----- "Network Fortius" <> wrote:
    > Same problems here, for AS26028
    > Stefan
    > 
    > On Mon, Nov 10, 2008 at 8:54 PM, Mark Tinka
    > <>wrote:
    > 
    > > Hi all.
    > >
    > > Anyone know how we can contact AS16735 and their upstream
    > > AS27664. We think they are hijacking a number of our
    > > prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
    > >
    > > e.g.,
    > >
    > > ====================
    > > Possible Prefix Hijack (Code: 11)
    > > 1 number of peer(s) detected this updates for your prefix
    > > 61.11.208.0/20:
    > > Update details: 2008-11-11 02:24 (UTC)
    > > 61.11.208.0/20
    > > Announced by: AS16735 (Companhia de Telecomunicacoes do
    > > Brasil Central)
    > > Transit AS: 27664 (CTBC Multimídia)
    > > ASpath: 27664 16735
    > > =====================
    > >
    > > RIPE's RIS BGPlay confirms the same, for about the last
    > > hour.
    > >
    > > E-mails to them won't get there (of course), so our NOC are
    > > contacting them via Gmail/Yahoo.
    > >
    > > All help appreciated.
    > >
    > > Cheers,
    > >
    > > Mark.
    > >
    

  • Next message: Raymond Dijkxhoorn: "Re: Potential Prefix Hijack"





    Hosted Email Solutions

    Invaluement Anti-Spam DNSBLs



    Powered By FreeBSD   Powered By FreeBSD