Re: ASN "Hijacked"

[Matt Brennan via NANOG <nanog () lists nanog org>]

Thanks, everyone, for the feedback. FYI we do have ROA set up for our
prefixes, and I set up ASPA earlier this week hoping it might help this ...
situation.

After reviewing Ryan's note, I reviewed the list of their peers further and
I feel like a number of them are likely hijacked. I have now reached out to
who I am confident are upstreams of them (HE, Cogent, Level3) and we'll see
where that gets me. Of course, with more than 5,000 alleged peers this
could easily be a zero sum game.

@Bryton -- as a note, both of the upstream ASs are peering with you as
well, but your abuse form doesn't really have an option for this type of
submission.

-Matt

On Fri, 11 Sept 2026 at 16:06, Bryton Herdes via NANOG <
nanog () lists nanog org> wrote:

> > b) resolve AS-SET into an ASN tree
> >
> > c) prune from the tree ASPA violating branches
>
> I've discussed this with a few people with the same ideas, and I can think
> of few reasons not to ship it as long as it's done right.
>
> It is appealing to get some value from the ASPAs as early as possible, and
> pruning bad members from an expanded AS-SET tree could offer that.
>
> --
> Bryton Herdes
> Principal Network Engineer
> AS13335 - Cloudflare
>
>
> On Fri, Sep 11, 2026 at 11:58 AM Saku Ytti via NANOG <
> nanog () lists nanog org>
> wrote:
>
> > On Fri, 11 Sept 2026 at 18:04, Christopher Hawker via NANOG
> > <nanog () lists nanog org> wrote:
> >
> > > I would look at creating ASPAs objects with $rir in the first instance.
> > Would help combat these sorts of issues :)
> > > Ask your upstream to create objects, then ask them to ask their
> > upstreams, and so on… You get the picture.
> >
> > If someone feels like vibing, may I suggest.
> >
> > a) recover AS-SET <-> ASN relation
> >     - look at RIR data, check if (mp-)export has exactly one AS-SET ->
> > match
> >     - look at peeringDB
> >
> > b) resolve AS-SET into an ASN tree
> >
> > c) prune from the tree ASPA violating branches
> >
> > d) return prefix-list, and origin ASN list
> >
> >
> > This way anyone already doing RIR prefix-list generation, without any
> > ASPA support in NOS, could get a significant amount of ASPA benefits
> > without changing anything in the NOS side, just changing command they
> > call to translate customer AS-SET into prefix-list or AS origin list
> > or both.
> >
> > --
> >   ++ytti
> > _______________________________________________
> > NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/UOBGN4KMIREKINGTIAQ4K2ZKC62FPOUE/
> _______________________________________________
> NANOG mailing list
>
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/2FQHH6LNCO3QKUUBBWT6RA77OXJOKNYN/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/XUGR5FOE7FUOUV4IHSYHJPRG42XL3QJH/