On Mon, Feb 15, 2010 at 5:32 PM, Ernest Andrew McCracken (emccrckn) <[email protected]> wrote: > Has anyone seen the strange activity from AS16387? Did they leak their > entire table? Our route collectors are showing AS16387 originating large > numbers of prefixes. It looks like we caught the tail end of this activity > as they are now announcing updates with massive amounts of prepending.
16387 is a uunet customer, it seems, who's only annoucing (now) 2 prefixes... Robtex seems to support them only having a single upstream (701). I think 701 still prefix-lists all their customers. You saw this through 3303 without 701 (it seems?) in the path, The orignal prefix looks actually like 95.79.192.0/19 in the path: 34533 16387 that looks like ESamara trying to poison their paths toward 'healthy directions, LLC". maybe ESamara saw something they disliked from this part of the network? -Chris
