Re: Prefix hijacking by AS20115

[Mark Tinka <mark.tinka () seacom mu>]

On 29/Sep/15 16:26, Rampley Jr, Jim F wrote:

> Hi Seth, which market was this occurring?  Was this already removed?  I'm
> not seeing it this morning.  I would like to figure out what went wrong
> here.  We shouldn't be nailing up any static configuration to have caused
> a situation like this.

You'd be surprised how often this happens, especially on the back of a
conference rocking into a city/country and the local provider having
minimal BGP experience. Once the conference is done, folk leave, and the
provider forgets about things - which is not a problem since the
conference would have come with its own IP address space.

The issue goes unnoticed for 12x months when the conference is trying to
route their usual block in some other city/country, and things just seem
"strange". Someone remembers the previous year's event, calls up the
previous provider, and finds out that the tech. who worked the
activation has since left.

It's not easy...

Many other situations closer to home (i.e., paying customers) where
things like this happen, especially if the customer has IP address space
but does not do BGP (until they want to or leave to the competition).

Blackholing operations that go wrong that folk forget about as well, not
to mention other networks that cut themselves off by using public IP
address space for their enterprise network.

It's not easy at all...

Mark.