Re: Rogue objects in routing databases

2020-01-27 Thread Florian Brandstetter
Hi Stephane, NANOG – Do the math for all pertained prefixes in the pastes, those 3 prefixes were just examples I had at hand, and the event is still of quite some significance. Albeit ROA-validating routers being an argument that extenuates probabilities and the ensuing effect, deployment of

Re: Rogue objects in routing databases

2020-01-27 Thread Stephane Bortzmeyer
On Sat, Jan 25, 2020 at 12:06:51AM +0100, Florian Brandstetter wrote a message of 53 lines which said: > Examples of affected networks are: > > 193.30.32.0/23 > 45.129.92.0/23 > 45.129.94.0/24 Note that 193.30.32.0/23 has also a ROA (announces by 42198). So, announces by AS8100 would be

Re: Rogue objects in routing databases

2020-01-25 Thread Florian Brandstetter
l to make a big difference a couple > of years down the road. > > Best regards, > Martijn Schmidt > > PS, a small disclaimer: none of the above are > new ideas, nor did I come up with them myself - > but it still makes sense to work towards > implementing them.. &g

Re: Rogue objects in routing databases

2020-01-24 Thread Martijn Schmidt via NANOG
Sent: 25 January 2020 00:06 To: nanog@nanog.org Subject: Rogue objects in routing databases It appears that there is currently an influx of rogue route objects created within the NTTCOM and RaDB IRR databases, in connection to Quadranet (AS8100) and China Mobile International (CMI). Examples o

Re: Rogue objects in routing databases

2020-01-24 Thread Job Snijders
Hi! This came up on our radar somewhere in the last 24 hours too. It indeed does look very curious. Thank you for your analysis and report. NTT is taking steps to figure out what is behind this. Our current working theories are that perhaps the IRR maintainer account was compromised, or some

Rogue objects in routing databases

2020-01-24 Thread Florian Brandstetter
It appears that there is currently an influx of rogue route objects created within the NTTCOM and RaDB IRR databases, in connection to Quadranet (AS8100) and China Mobile International (CMI). Examples of affected networks are: 193.30.32.0/23 45.129.92.0/23 45.129.94.0/24 Networks, which have