[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Dreamhost/AS26347 unauthorized bgp announcement
- Subject: Dreamhost/AS26347 unauthorized bgp announcement
- From: job.snijders at atrato.com (Job Snijders)
- Date: Wed, 6 Mar 2013 10:03:32 +0100
- In-reply-to: <[email protected]>
- References: <[email protected]>
I see the same thing, we learn the prefix from the route-server in LAX:
telnet at r1.lax1.us>show ip bgp routes detail 184.108.40.206/20
Number of BGP Routes matching display condition : 1
Status A:AGGREGATE B:BEST b:NOT-INSTALLED-BEST C:CONFED_EBGP D:DAMPED
E:EBGP H:HISTORY I:IBGP L:LOCAL M:MULTIPATH m:NOT-INSTALLED-MULTIPATH
S:SUPPRESSED F:FILTERED s:STALE
1 Prefix: 220.127.116.11/20, Status: BE, Age: 0h22m15s
NEXT_HOP: 18.104.22.168, Metric: 0, Learned from Peer: 22.214.171.124 (19996)
LOCAL_PREF: 400, MED: none, ORIGIN: incomplete, Weight: 0
Adj_RIB_out count: 18, Admin distance 20
Last update to IP routing table: 0h22m15s, 1 path(s) installed:
On Mar 6, 2013, at 9:59 AM, Matsuzaki Yoshinobu <maz at iij.ad.jp> wrote:
> According to RIPE RIS, AS26347 announced a bunch of prefixes again.
> - http://www.ris.ripe.net/dashboard/26347
> First suspicious announcement was started 2013-03-06 07:52:40 UTC, and
> last seen 2013-03-06 08:33:56 UTC. 195 prefixes total.
> It seems these unauthorized announcements have the same profile as
> before - AS26347 shrinks the prefix lenght of their received prefix
> somehow upto /20, and re-originates the prefix with origin AS26347.
> Any known bugs?
> Matsuzaki Yoshinobu <maz at iij.ad.jp>
> - IIJ/AS2497 INOC-DBA: 2497*629
AS5580 - Atrato IP Networks