IPv4 and IPv6 hijacking by AS 6

• Subject: IPv4 and IPv6 hijacking by AS 6
• From: bjorn at mork.no (Bjørn Mork)
• Date: Sat, 14 Apr 2018 13:26:20 +0200
• In-reply-to: <[email protected]> (Randy Bush's message of "Fri, 13 Apr 2018 14:35:07 -0700")
• References: <CA[email protected]> <15[email protected]> <CA[email protected]> <CA[email protected]> <CA[email protected]> <[email protected]> <[email protected]>

Randy Bush <randy at psg.com> writes:

>> I believe we've seen bogus low AS number announcements a few times
>> before, and they've usually been caused by attemts to configure
>> AS path prepending without understanding and/or reading the docs.
>> 
>> Someone might have wrongly assumed that
>> 
>>    set as-path prepend 133711 133711
>> 
>> could be written shorter like
>> 
>>    set as-path prepend 133711 2
>> 
>> and there you go...
>
> for someone else's prefix?

No, of course not. At least I have no reason to beliece so.

I briefly looked at a couple of the examples Anurag posted.  And for
those, the next AS number in the path seemed consistent with the prefix
owner:

*   43.227.224.0/24  208.51.134.254           0             0 3549 3356 6453 4755 133711 133711 133711 2 i
*   91.143.144.0/20  208.51.134.254           0             0 3549 3356 12389 41837 41837 2 i


bjorn at miraculix:~$ whois 43.227.224.0/24 |grep origin
origin:         AS133711
origin:         AS58965

bjorn at miraculix:~$ whois 91.143.144.0/20  |grep origin
origin:         AS41837



Bjørn

• References:
  • IPv4 and IPv6 hijacking by AS 6
    • From: matt at netfire.net (Matt Harris)
  • IPv4 and IPv6 hijacking by AS 6
    • From: lists at as23738.net (lists at as23738.net)
  • IPv4 and IPv6 hijacking by AS 6
    • From: matt at netfire.net (Matt Harris)
  • IPv4 and IPv6 hijacking by AS 6
    • From: job at instituut.net (Job Snijders)
  • IPv4 and IPv6 hijacking by AS 6
    • From: me at anuragbhatia.com (Anurag Bhatia)
  • IPv4 and IPv6 hijacking by AS 6
    • From: bjorn at mork.no (Bjørn Mork)
  • IPv4 and IPv6 hijacking by AS 6
    • From: randy at psg.com (Randy Bush)

• Prev by Date: IPv4 and IPv6 hijacking by AS 6
• Next by Date: Is WHOIS going to go away?
• Previous by thread: IPv4 and IPv6 hijacking by AS 6
• Next by thread: IPv4 and IPv6 hijacking by AS 6
• Index(es):
  • Date
  • Thread