Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Simon Leinen
cidr-report writes: BGP Update Report Interval: 20-Nov-14 -to- 27-Nov-14 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASNUpds % Upds/PfxAS-Name [...] 11 - AS5 38861 0.6% 7.0 -- SYMBOLICS - Symbolics,

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Pierfrancesco Caci
Simon == Simon Leinen simon.lei...@switch.ch writes: Simon Some suspicious paths I'm seeing right now: Simon 133439 5 Simon 197945 4 my bet is on someone using the syntax prepend asnX timesY on a router that instead wants prepend asnX asnX -- Pierfrancesco Caci, ik5pvx

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Paul S.
Do these people never check what exactly they end up originating outbound due to a config change, if that's really the case? On 11/30/2014 午後 11:24, Pierfrancesco Caci wrote: Simon == Simon Leinen simon.lei...@switch.ch writes: Simon Some suspicious paths I'm seeing right now:

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Harry Hoffman
I'm currently looking into AS3 in an attempt to figure out what's going on. Always interested to hear what others have found out. Cheers, Harry On Nov 30, 2014 8:57 AM, Simon Leinen simon.lei...@switch.ch wrote: cidr-report  writes: BGP Update Report Interval: 20-Nov-14 -to- 27-Nov-14

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Valdis . Kletnieks
On Mon, 01 Dec 2014 00:53:07 +0900, Paul S. said: Do these people never check what exactly they end up originating outbound due to a config change, if that's really the case? You're new here, aren't you? :) pgpeSOBr2fqm8.pgp Description: PGP signature

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Joe Provo
On Mon, Dec 01, 2014 at 12:53:07AM +0900, Paul S. wrote: Do these people never check what exactly they end up originating outbound due to a config change, if that's really the case? Of course not because their neighbors are allowing it to pass; so as with all hijacks, deaggregation, and other

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Stephen Satchell
On 11/30/2014 11:26 AM, valdis.kletni...@vt.edu wrote: On Mon, 01 Dec 2014 00:53:07 +0900, Paul S. said: Do these people never check what exactly they end up originating outbound due to a config change, if that's really the case? You're new here, aren't you? :) Thank you, I needed the

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Andree Toonk
.-- My secret spy satellite informs me that at 2014-11-30 6:24 AM Pierfrancesco Caci wrote: Simon == Simon Leinen simon.lei...@switch.ch writes: Simon Some suspicious paths I'm seeing right now: Simon 133439 5 Simon 197945 4 my bet is on someone using the syntax prepend

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Jay Ashworth
- Original Message - From: Joe Provo nanog-p...@rsuc.gweep.net On Mon, Dec 01, 2014 at 12:53:07AM +0900, Paul S. wrote: Do these people never check what exactly they end up originating outbound due to a config change, if that's really the case? Of course not because their

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Jason Bothe
I’m not new here but the thread caught my eye, as I am one of the lower ASs being mentioned. I guess there isn’t really anything one can do to prevent these things other than listening to route servers, etc. I guess it’s all on what the upstream decides to allow-in and re-advertise. Jason

Re: Low-numbered ASes being hijacked? [Re: BGP Update Report]

2014-11-30 Thread Scott Weeks
- Original Message - Do these people never check what exactly they end up originating outbound due to a config change, if that's really the case? Of course not because their neighbors are allowing it to pass; so as with all hijacks, deaggregation, and other unfiltered noise, the