nanog mailing list archives
Re: Telstra Hijack
From: Mark Duffell <mark () duffell net>
Date: Fri, 2 Oct 2020 23:51:59 +1000
Cross-post from Russ on AusNOG list. Telstra blog post on issue is now live - http://exchange.telstra.com.au/an-update-on-our-september-30-bgp-issue/ Regards, Mark Sent from my iPhone
On 30 Sep 2020, at 08:29, Mark Duffell <mark () duffell net> wrote: Hi Ross, Just to confirm the AS1221 incident (INC000094009293) was resolved approx. 20:32 29/09/20 (UTC). If anyone has further issues feel free to email me off-thread. Regards, -Mark Senior Network Engineer AS1221 Sent from my iPhoneOn 30 Sep 2020, at 07:30, Ross Tajvar <ross () tajvar io> wrote: Bad prefixes are all gone. This looks resolved from my point of view. On Tue, Sep 29, 2020 at 5:18 PM Ross Tajvar <ross () tajvar io> wrote:I'm still seeing bad prefixes from Cogent, but our other upstreams (NTT, GTT, Telia) blocked them. On Tue, Sep 29, 2020 at 5:09 PM Sadiq Saif <lists () sadiqsaif com> wrote:On Tue, 29 Sep 2020, at 16:36, Ross Tajvar wrote:I'm surprised no one else has mentioned this yet, but Telstra is hijacking a lot of prefixes: https://rpki.cloudflare.com/?view=bgp&prefix=&asn=1221&validState=Invalid Since we don't have RPKI filtering in our network (yet), we are currently filtering everything with the path ".* 4637 1221$". This is of course taking a while...My employer's prefixes were affected, I posted about it on the AusNOG list so I could get some assistance. It has cleared up now but it took about two hours or so. I saw AS paths like this from HE's looking glass: 6461x4, 4637x11, 1221 I would love to know what the root cause of the leak was. -- Sadiq Saif
Current thread:
- Re: Telstra Hijack Mark Duffell (Oct 02)