Of Nick Rose
Sent: Thursday, March 26, 2015 3:49 PM
To: a...@djlab.com; Peter Rocca
Cc: nanog@nanog.org
Subject: RE: More specifics from AS18978 [was: Prefix hijack by
INDOSAT AS4795 / AS4761]
This should be resolved from AS18978. If you experience anything else
please let me know and I
[was: Prefix hijack by
INDOSAT AS4795 / AS4761]
This should be resolved from AS18978. If you experience anything else
please let me know and I will get it addressed immediately.
Regards,
Nick Rose
CTO @ Enzu Inc.
-Original Message-
From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf
[was: Prefix hijack by INDOSAT AS4795
/ AS4761]
This should be resolved from AS18978. If you experience anything else please
let me know and I will get it addressed immediately.
Regards,
Nick Rose
CTO @ Enzu Inc.
-Original Message-
From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf
To: Peter Rocca
Cc: nanog@nanog.org
Subject: RE: More specifics from AS18978 [was: Prefix hijack by INDOSAT AS4795
/ AS4761]
On 03/26/2015 9:00 am, Peter Rocca wrote:
+1
The summary below aligns with our analysis as well.
We've reached out to AS18978 to determine the status of the leak
On 03/26/2015 9:00 am, Peter Rocca wrote:
+1
The summary below aligns with our analysis as well.
We've reached out to AS18978 to determine the status of the leak but
at this time we're not seeing any operational impact.
+2, after the morning coffee sunk in and helpful off list replies I can
[mailto:nanog-boun...@nanog.org] On Behalf Of Nick Rose
Sent: Thursday, March 26, 2015 3:49 PM
To: a...@djlab.com; Peter Rocca
Cc: nanog@nanog.org
Subject: RE: More specifics from AS18978 [was: Prefix hijack by INDOSAT AS4795
/ AS4761]
This should be resolved from AS18978. If you experience anything
On Thu, Mar 26, 2015 at 10:08 AM, Randy a...@djlab.com wrote:
On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing more
specifics on one of our prefixes. Anyone else seeing similar or is it just
us?
is your AS in the path below? (what is your AS so folk can check for
your
On 03/26/2015 7:27 am, Christopher Morrow wrote:
is your AS in the path below? (what is your AS so folk can check for
your prefixes/customer-prefixes and attempt to help?)
Sorry, we're 29889.
Hi Randy,
Assuming that your prefix is 198.98.180.0/22 (AS29889 - FSNET-1 - Fast
Serv Networks, LLC) none of the mentioned more specifics are currently
seen from the RIPE NCC's RIS network, see the Looking Glass widget:
https://stat.ripe.net/198.98.180.0/23#tabId=routing
-
From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Randy
Sent: March-26-15 10:08 AM
To: nanog@nanog.org
Subject: Prefix hijack by INDOSAT AS4795 / AS4761
On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing
more specifics on one of our prefixes. Anyone else seeing
Message-
From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Randy
Sent: March-26-15 10:08 AM
To: nanog@nanog.org
Subject: Prefix hijack by INDOSAT AS4795 / AS4761
On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing
more specifics on one of our prefixes
Rocca
Cc: nanog@nanog.org
Subject: Re: Prefix hijack by INDOSAT AS4795 / AS4761
Hi List,
this morning our BGPmon system picked up many new more specific announcements
by a variety of Origin ASns, the interesting part is that the majority of them
were classified as BGP Man In The middle attacks
On Thu, Mar 26, 2015 at 10:38 AM, Randy a...@djlab.com wrote:
On 03/26/2015 7:27 am, Christopher Morrow wrote:
is your AS in the path below? (what is your AS so folk can check for
your prefixes/customer-prefixes and attempt to help?)
Sorry, we're 29889.
ok, and it looks like the path you
On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing
more specifics on one of our prefixes. Anyone else seeing similar or
is it just us?
198.98.180.0/23 4795 4795 4761 9304 40633 18978 4436 29889
198.98.182.0/23 4795 4795 4761 9304 40633 18978 4436 29889
--
Randy
4795 4795 4761 9304 40633 18978 6939 40788
108.168.112.0/20 4795 4795 4761 9304 40633 18978 6939 40788
-Original Message-
From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Randy
Sent: March-26-15 10:08 AM
To: nanog@nanog.org
Subject: Prefix hijack by INDOSAT AS4795 / AS4761
All,
Info gathered off-list indicates this may be a couple of issues in our
case - possible routing leak by 18978 (check your tables!) and more
specifics on our prefixes from 4795 that we couldn't see before the leak
hence the apparent hijack.
--
~Randy
16 matches
Mail list logo
