Re: BGPMON Alert Questions

[Bret Clark <bclark () spectraaccess com>]

They are advertising one of /22 right now as well,

Bret


On 04/02/2014 04:21 PM, Bryan Tong wrote:
> They have advertised all of ours now.
>
>
> On Wed, Apr 2, 2014 at 2:16 PM, Bob Evans <bob () fiberinternetcenter com>wrote:
>
> > Yes, I too have alerts for some of our prefixes from the same offending
> > origin 4761
> >
> > On Wednesday April 2nd 2014 at 19:59 UTC we detected a Origin AS Change
> > event for your prefix (66.201.48.0/20 slash 20 bottom of nor cal)
> > The detected prefix: 66.201.48.0/20, was announced by AS4761
> > (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID)
> > Alert description:       Origin AS Change
> > Detected Prefix:         66.201.48.0/20
> > Detected Origin AS:   4761
> > Expected Origin AS:   26803
> >
> > Bob Evans
> > CTO
> >
> >
> >
> >
> > > So I setup BGPMON for my prefixes and got an alert about someone in
> > > Thailand announcing my prefix.  Everything looks fine to me and I've
> > > checked a bunch of different Looking Glasses and everything announcing
> > > correctly.
> > >
> > > I am assuming I should be contacting the provider about their
> > > misconfiguration and announcing my prefixes and get them to fix it.  Any
> > > other recommendations?
> > >
> > > Is there a way I can verify what they are announcing just to make sure
> > > they
> > > are still doing it?
> > >
> > > Here is the alert for reference:
> > >
> > > Your prefix:          8.37.93.0/24:
> > >
> > > Update time:          2014-04-02 18:26 (UTC)
> > >
> > > Detected by #peers:   2
> > >
> > > Detected prefix:      8.37.93.0/24
> > >
> > > Announced by:         AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
> > > Provider,ID)
> > >
> > > Upstream AS:          AS4651 (THAI-GATEWAY The Communications Authority
> > of
> > > Thailand(CAT),TH)
> > >
> > > ASpath:               18356 9931 4651 4761


--
Spectra Access
25 Lowell Street
Manchester, NH 03042
603-296-0760
www.spectraaccess.net