[nsp-sec] ARIN-REACHABILITY-TESTING

[Hank Nussbacher]

On Sat, 10 Jan 2009, sthaug at nethelp.no wrote:

>> I did a lookup in http://cs.unm.edu/~karlinjf/IAR/search_prefix.php
>> and came up with a bunch of faked ASNs (not just AS378):
>> Time Origin Prefix Why? Super Prefix Trusted Origins AS Path
>> 2009-01-10 12:50:58 2546 173.0.5.0/24 0  3130 22779 16668 42 2914 3130 2546
>> 2009-01-10 12:06:11 2274 173.0.5.0/24 0  3130 22779 16668 42 2914 3130 2274
>> 2009-01-10 11:21:20 2050 173.0.5.0/24 0  3130 10565 2914 3130 2050
>> 2009-01-10 10:36:24 1938 173.0.5.0/24 0  3130 5413 3356 2914 3130 1938
>> 2009-01-10 09:51:18 1791 173.0.5.0/24 0  3130 10565 2914 3130 1791
>> 2009-01-10 09:06:15 1678 173.0.5.0/24 0  3130 22779 16668 42 2914 3130 1678
>> 2009-01-10 08:21:17 1533 173.0.5.0/24 0  3130 5413 3356 2914 3130 1533
>> 2009-01-10 07:36:17 1480 173.0.5.0/24 0  3130 10565 2914 3130 1480
>> 2009-01-10 06:51:16 1317 173.0.5.0/24 0  3130 10565 2914 3130 1317
>> 2009-01-10 06:06:16 1204 173.0.5.0/24 0  3130 10565 2914 3130 1204
>> 2009-01-10 05:21:46 790 173.0.5.0/24 0  3130 10565 2914 3130 790
>> 2009-01-10 04:36:03 571 173.0.5.0/24 0  3130 10565 2914 3130 571
>> 2009-01-10 03:51:03 378 173.0.5.0/24 0  3130 10565 2914 3130 378
>> 2009-01-10 03:06:25 290 173.0.5.0/24 0  3130 5413 3356 2914 3130 290
>> 2009-01-10 02:21:01 158 173.0.5.0/24 0  3130 10565 2914 3130 158
>> 2009-01-10 01:23:31 87 173.0.5.0/24 0  3130 10565 2914 3130 87
>> 2009-01-10 00:39:03 30 173.0.5.0/24 0  3130 10565 2914 3130 30
>> 2009-01-08 17:50:47 3130 173.0.5.0/24 1 173.0.0.0/20 3130 22779 16668 6939 1299 2914 3130
>>
>> Who is doing this and why?
>
> Maybe the tech-c for AS 3130 might be a good guess?
>
> Steinar Haug, AS 2116
> ----------------------
> OrgName:    RGnet, LLC
> OrgID:      RGNETI-1
> Address:    PO Box 128
> City:       Kapaau
> StateProv:  HI
> PostalCode: 96755
> Country:    US
>
> ASNumber:   3130
> ASName:     RG-BIWA
> ASHandle:   AS3130
> Comment:
> RegDate:    1997-03-17
> Updated:    1997-06-19
>
> RTechHandle: RB366-ARIN
> RTechName:   Bush, Randy
> RTechPhone:  +1-206-780-0431
> RTechEmail:  randy at psg.com
>
> OrgTechHandle: RB366-ARIN
> OrgTechName:   Bush, Randy
> OrgTechPhone:  +1-206-780-0431
> OrgTechEmail:  randy at psg.com
>

I sent email to Randy off-list.

-Hank