On Mon, May 11, 2009 at 2:29 PM, Andree Toonk <andree+na...@toonk.nl> wrote: > .-- My secret spy satellite informs me that at Mon, 11 May 2009, Jay Hennigan > wrote: > >> We're getting cyclops[1] alerts that AS13214 is advertising itself as >> origin for all of our prefixes. Their anomaly report shows thousands of >> prefixes originating there. >> >> Anyone else seeing evidence of this or being affected? > > It seems it was picked up by route-views4. Non of the RIS peers seem to have > seen this. > > Looking at the raw bgp data from route-views4: > AS13214 leaked a full table (~266294 prefixes) with 13214 as OriginAS to > AS48285 which is a routeviews4 peer. > Routeviews4 saw these announcements as: ASpath 48285 13214. >
Since 48285 == robtex, is it possible TPB was just setting up a monitoring/route-feed session to robtex and either missed their outbound policy or sent them the wrong form of outbound policy (full routes not customer only routes)?? -chris