[nsp-sec] Attn: ATT (AS7018) 122.169.0.0/17 -> AS64351 ???

[Rob Thomas]

That's a reserved ASN (<http://www.iana.org/assignments/as-numbers>), 
and probably a leak of private/end-customer peering.  If you take a 
peek, you'll find a few ASNs > 54271 in the table from time to time.

Given that AS9498 is in India, and the allocated netblocks in 
122.169.0.0/16 are in India, I'd wager this is a BGP "oops."


Lawrence Baldwin wrote:
> ----------- nsp-security Confidential --------
> 
> 
> Someone might want to take a look at this:
> 
> BGP routing table entry for 122.169.0.0/17, version 645120167
> Paths: (2 available, best #1, table Default-IP-Routing-Table)
>   Not advertised to any peer
>   7018 9498 64351
>     205.171.0.96 (metric 15) from 205.171.0.149 (205.171.0.149)
>       Origin IGP, metric 0, localpref 80, valid, internal, best
>       Community: 209:888 209:889
>       Originator: 205.171.0.96, Cluster list: 205.171.0.149
>   7018 9498 64351
>     205.171.0.96 (metric 15) from 205.171.0.150 (205.171.0.150)
>       Origin IGP, metric 0, localpref 80, valid, internal
>       Community: 209:888 209:889
>       Originator: 205.171.0.96, Cluster list: 205.171.0.149
> 
> 
> As far as I can tell AS64351 is unallocated by Arin.
> 
> Lawrence.
> 
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________

-- 
Rob Thomas
Team Cymru
The WHO and WHY team
http://www.team-cymru.org/