AS4134/AS4847 - Appear to be hijacking some ip space.

• Subject: AS4134/AS4847 - Appear to be hijacking some ip space.
• From: pf at tippete.net (Pierfrancesco Caci)
• Date: Sat, 06 Apr 2019 08:39:38 +0200
• In-reply-to: <CA[email protected]> (Christopher Morrow's message of "Fri, 5 Apr 2019 11:02:56 -0400")
• References: <CA[email protected]>

Looks like they stopped already, I'm not seeing this on 3491 nor on
routeviews anymore.

Pf

>>>>> "Christopher" == Christopher Morrow <morrowc.lists at gmail.com> writes:


    Christopher> Howdy gentle folks:
    Christopher> It looks like AS4847 - "China Networks Inter-Exchange"

    Christopher> Is taking some time to announce reachability for at least:
    Christopher>   136.38.33.0/24

    Christopher> which they ought not, given that this /24 is part of a /11 assigned to
    Christopher> AS16591 (google fiber)... Looking at routeviews data, I see the
    Christopher> following as-paths for this one /24:
    Christopher> $ grep -A1 Refresh /tmp/x | grep 4847
    Christopher>   1239 174 4134 4847
    Christopher>   3549 3356 174 4134 4847
    Christopher>   701 174 4134 4847
    Christopher>   4901 6079 3257 4134 4847
    Christopher>   20912 174 4134 4847
    Christopher>   1221 4637 4134 4847
    Christopher>   1351 11164 4134 4847
    Christopher>   6079 1299 4134 4847
    Christopher>   6079 3257 4134 4847
    Christopher>   7018 4134 4847
    Christopher>   6939 1299 4134 4847
    Christopher>   3561 209 4134 4847
    Christopher>   3303 4134 4847
    Christopher>   3277 39710 9002 4134 4847
    Christopher>   2497 4134 4847
    Christopher>   4826 1299 4134 4847
    Christopher>   54728 20130 23352 2914 4134 4847
    Christopher>   19214 3257 4134 4847
    Christopher>   101 101 11164 4134 4847
    Christopher>   1403 6453 4134 4847
    Christopher>   852 6453 4134 4847
    Christopher>   1403 6453 4134 4847
    Christopher>   286 4134 4847
    Christopher>   3333 1273 4134 4847
    Christopher>   57866 3491 4134 4847
    Christopher>   3267 1299 4134 4847
    Christopher>   49788 174 4134 4847
    Christopher>   53767 3257 4134 4847
    Christopher>   53364 3257 4134 4847
    Christopher>   8283 57866 3491 4134 4847
    Christopher>   7660 2516 4134 4847

    Christopher> From that I think the following AS should have filtered this prefix and are not:
    Christopher> $ grep -A1 Refresh /tmp/x | grep 4847 | sed 's/ 4134 4847//' | awk
    Christopher> '{print $NF}' | sort -n | uniq

    Christopher> 174  - Cogent
    Christopher> 209 - Qwest
    Christopher> 286 - KPN
    Christopher> 1273 - Vodafone
    Christopher> 1299 - Telia
    Christopher> 2497 - IIJ
    Christopher> 2516 - KDDI
    Christopher> 2914 - NTT
    Christopher> 3257 - GTT
    Christopher> 3303 - Swisscom
    Christopher> 3491 - PCCW
    Christopher> 4637 - Telstra
    Christopher> 6453 - TATA
    Christopher> 7018 - ATT
    Christopher> 9002 - RETN
    Christopher> 11164 - Internet2

    Christopher> It'd be great if the listed folk could filter AS4134 :)

    Christopher> -Chris

-- 
Pierfrancesco Caci, ik5pvx

• Follow-Ups:
  • AS4134/AS4847 - Appear to be hijacking some ip space.
    • From: morrowc.lists at gmail.com (Christopher Morrow)

• References:
  • AS4134/AS4847 - Appear to be hijacking some ip space.
    • From: morrowc.lists at gmail.com (Christopher Morrow)

• Prev by Date: GPS rollover
• Next by Date: GPS rollover
• Previous by thread: AS4134/AS4847 - Appear to be hijacking some ip space.
• Next by thread: AS4134/AS4847 - Appear to be hijacking some ip space.
• Index(es):
  • Date
  • Thread