<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Consulta ingenua, ¿no tiene autoridad el RIR asociado al ISP para penalizarlo por tremenda aberración repetida?. Su upstream también fue bastante lights al permitir como si nada 300k rutas de un peer que no estaba ni próximo a ese número en estado normal.<br>
<br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Tiene pinta de ser una redistribución a su IGP y luego inyección a BGP nuevamente no?<br><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">
Slds.<br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-04-03 7:42 GMT-03:00 Alex Ojeda <span dir="ltr"><<a href="mailto:alex@chilenetworks.com" target="_blank">alex@chilenetworks.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="ES-CL">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Mail recibido de bgpmon:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p><span lang="ES">De: Andree Toonk // BGPmon.net <br>
Enviado el: jueves, 03 de abril de 2014 2:27<br>
Para: Alex Ojeda<br>
Asunto: Additional information - Hijack event today by Indosat</span><u></u><u></u></p>
<p><u></u> <u></u></p>
<p><span lang="EN-US">Dear BGPmon.net user,<u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">Today we observed a large-scale 'hijack' event that amongst others affected one or more of your prefixes. This email is to provide you with some additional information.<u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">What happened?<u></u><u></u></span></p>
<p><span lang="EN-US">Indosat, AS4761, one of Indonesia's largest telecommunication networks normally originates about 300 prefixes. Starting at 18:26 UTC (April 2, 2014) AS4761 began to originate 417,038 new prefixes normally announced
by other Autonomous Systems such as yours. The 'mis-origination' event by Indosat lasted for several hours affecting different prefixes at different times until approximately 21:15 UTC.<u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">What caused this?<u></u><u></u></span></p>
<p><span lang="EN-US">Given the large scale of this event we presume this is not malicious or intentional but rather the result of an operational issue. Other sources report this was the result of a maintenance window gone bad. Interestingly
we documented a similar event involving Indosat in 2011, more details regarding that incident can be found here:
</span><a href="http://www.bgpmon.net/hijack-by-as4761-indosat-a-quick-report/" target="_blank"><span style="color:windowtext;text-decoration:none" lang="EN-US">http://www.bgpmon.net/hijack-by-as4761-indosat-a-quick-report/</span></a><span lang="EN-US"><u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">Impact<u></u><u></u></span></p>
<p><span lang="EN-US">The impact of this event was different per network, many of the hijacked routes were seen by several providers in Thailand. This means that it's likely that communication between these providers in Thailand (as well
as Indonesia) and your prefix may have been affected. <u></u><u></u></span></p>
<p><span lang="EN-US">One of the heuristics we look at to determine the global impact of an event like this is the number of probes that detected the event. In this case, out of the 400k affected prefixes, 8,182 were detected by more than
10 different probes, which means that the scope and impact of this event was larger for these prefixes.
<u></u><u></u></span></p>
<p><span lang="EN-US">The link below is an example of a Syrian prefix that was hijacked by Indosat where the 'hijacked' route was seen from Australia to the US and Canada.<u></u><u></u></span></p>
<p><a href="http://portal.bgpmon.net/data/indosat-hijack.png" target="_blank"><span style="color:windowtext;text-decoration:none" lang="EN-US">http://portal.bgpmon.net/data/indosat-hijack.png</span></a><span lang="EN-US"><u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">What was the impact for my network?<u></u><u></u></span></p>
<p><span lang="EN-US">By clicking on the alert details link in the alert email or portal you will see the number of probes that detected the hijacked route update. It also shows you where in the world these updates were seen so you'll have
an idea of the geographical scope of the event.<u></u><u></u></span></p>
<p><span lang="EN-US">Users with a premium account also have access to all the individual BGP updates as well as the full AS path. This will tell you in detail what networks selected this bad route and the exact timestamps. Some of you
also received a phone call to inform you of the events immideatly after detection (part of the Enterprise add-on).<u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">BGP probe and peering<u></u><u></u></span></p>
<p><span lang="EN-US">A BGP probe in this case means one of our peering partners. You too can become a peering partner and get access to our PeerMon service, for more details see:<u></u><u></u></span></p>
<p><a href="http://portal.bgpmon.net/peermon.php" target="_blank"><span style="color:windowtext;text-decoration:none" lang="EN-US">http://portal.bgpmon.net/peermon.php</span></a><span lang="EN-US"><u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">Questions and more information<u></u><u></u></span></p>
<p><span lang="EN-US">I hope this provides you with some useful additional information regarding this event. Feel free to contact us should you have any follow up questions or would like to have more information for the purpose of further
forensics. <u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">Kind regards,<u></u><u></u></span></p>
<p><span lang="EN-US">Andree Toonk <u></u><u></u></span></p>
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">--<u></u><u></u></span></p>
<p><span lang="EN-US">BGPmon.net<u></u><u></u></span></p>
<p><span lang="EN-US"></span><a href="mailto:info@bgpmon.net" target="_blank"><span style="color:windowtext;text-decoration:none" lang="EN-US">info@bgpmon.net</span></a><span lang="EN-US"><u></u><u></u></span></p>
<p><span lang="EN-US"></span><a href="http://www.bgpmon.net/" target="_blank"><span style="color:windowtext;text-decoration:none" lang="EN-US">http://www.bgpmon.net/</span></a><span lang="EN-US"><u></u><u></u></span></p>
<div class="">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:13.0pt;font-family:"Verdana","sans-serif";color:#1f497d" lang="ES-BO">Alex Matias Ojeda Mercado</span><span style="font-size:13.0pt;font-family:"Tahoma","sans-serif";color:#1f497d" lang="ES-BO"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546a">NOG CHILE<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546a"><a href="mailto:alex@nog.cl" target="_blank">alex@nog.cl</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546a">+56971922362<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546a"><u></u> <u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</div><div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="ES">De:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="ES"> NOG [mailto:<a href="mailto:nog-bounces@nog.cl" target="_blank">nog-bounces@nog.cl</a>]
<b>En nombre de </b><a href="mailto:nog@nog.cl" target="_blank">nog@nog.cl</a><br>
<b>Enviado el:</b> miércoles, 02 de abril de 2014 17:44</span></p><div><div class="h5"><br>
<b>Para:</b> Latin America and Caribbean Region Network Operators Group; <a href="mailto:nog@nog.cl" target="_blank">nog@nog.cl</a>; <a href="mailto:lacnog@lacnog.org" target="_blank">lacnog@lacnog.org</a><br>
<b>Asunto:</b> Re: [NOG-CHILE] [lacnog] Secuestro prefijo<u></u><u></u></div></div><p></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Hermoso :-)<u></u><u></u></span></p>
</div>
</div>
<div>
<div class="MsoNormal" style="text-align:center" align="center">
<hr align="center" size="2" width="100%">
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:
</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><a href="mailto:alex@chilenetworks.com" target="_blank">Alex Ojeda</a></span><br>
<b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Sent: </span>
</b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">02/04/2014 18:18</span><br>
<b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">To: </span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><a href="mailto:nog@nog.cl" target="_blank">nog@nog.cl</a>;
<a href="mailto:lacnog@lacnic.net" target="_blank">Latin America and Caribbean Region Network Operators Group</a>;
<a href="mailto:lacnog@lacnog.org" target="_blank">lacnog@lacnog.org</a></span><br>
<b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Subject: </span>
</b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Re: [lacnog] [NOG-CHILE] Secuestro prefijo</span><u></u><u></u></p>
</div>
<p class="MsoNormal">Ya está más que confirmado que este evento a es a nivel Global afectando a más de 320.000 prefijos del globo.<br>
<br>
<br>
Saludos!<br>
<br>
<br>
<br>
Alex Matias Ojeda Mercado<br>
NOG CHILE<br>
<a href="mailto:alex@nog.cl" target="_blank">alex@nog.cl</a><br>
+56971922362<br>
<br>
<br>
-----Mensaje original-----<br>
De: NOG [<a href="mailto:nog-bounces@nog.cl" target="_blank">mailto:nog-bounces@nog.cl</a>] En nombre de
<a href="mailto:nog@nog.cl" target="_blank">nog@nog.cl</a><br>
Enviado el: miércoles, 02 de abril de 2014 16:02<br>
Para: Latin America and Caribbean Region Network Operators Group; <a href="mailto:nog@nog.cl" target="_blank">
nog@nog.cl</a>; <a href="mailto:lacnog@lacnog.org" target="_blank">lacnog@lacnog.org</a><br>
Asunto: Re: [NOG-CHILE] [lacnog] Secuestro prefijo<br>
<br>
Los espero a *todos* en el tutorial de BGP+RPKI en Cancún<br>
<br>
:-)<br>
<br>
<br>
<br>
On 4/2/14, 4:52 PM, Alex Ojeda wrote:<br>
> Se me acaban de alertar 4 x /24 adicionales<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> Alex Matias Ojeda Mercado<br>
> NOG CHILE<br>
> <a href="mailto:alex@nog.cl" target="_blank">alex@nog.cl</a><br>
> +56971922362<br>
> <br>
> <br>
> -----Mensaje original-----<br>
> De: NOG [<a href="mailto:nog-bounces@nog.cl" target="_blank">mailto:nog-bounces@nog.cl</a>] En nombre de
<a href="mailto:nog@nog.cl" target="_blank">nog@nog.cl</a> Enviado <br>
> el: miércoles, 02 de abril de 2014 15:43<br>
> Para: Latin America and Caribbean Region Network Operators Group; <br>
> '<a href="mailto:nog@nog.cl" target="_blank">nog@nog.cl</a>'; <a href="mailto:lacnog@lacnog.org" target="_blank">lacnog@lacnog.org</a><br>
> Asunto: Re: [NOG-CHILE] [lacnog] Secuestro prefijo<br>
> <br>
> A nosotros también, y del mismo AS. De hecho a nosotros también nos saltó como una alarma de RPKI.<br>
> <br>
> <br>
> On 4/2/14, 4:32 PM, Alex Ojeda wrote:<br>
>> Me acaba de llegar una alerta de un posible Prefix Hijack a uno de <br>
>> mis prefijos desde Indonesia.<br>
>><br>
>> Alguien màs con algo similar?<br>
<span lang="EN-US">>><br>
>> <br>
>><br>
>> <br>
>><br>
>> ====================================================================<br>
>><br>
>> Possible Prefix Hijack (Code: 10)<br>
>><br>
>> ====================================================================<br>
>><br>
>> Your prefix: <a href="http://64.76.170.0/24" target="_blank">64.76.170.0/24</a>:<br>
>><br>
>> Update time: 2014-04-02 18:28 (UTC)<br>
>><br>
>> Detected by #peers: 1<br>
>><br>
>> Detected prefix: <a href="http://64.76.170.0/24" target="_blank">64.76.170.0/24</a><br>
>><br>
>> Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network<br>
>> Provider,ID)<br>
>><br>
>> Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority<br>
>> of Thailand(CAT),TH)<br>
>><br>
>> ASpath: 18356 38794 4651 4761<br>
>><br>
>> <br>
>><br>
>> <br>
>><br>
>> <br>
>><br>
>> <br>
>><br>
>> <br>
>><br>
>> <br>
>><br>
>> Alex Matias Ojeda Mercado<br>
>><br>
>> NOG CHILE<br>
>><br>
>> </span><a href="mailto:alex@nog.cl" target="_blank"><span lang="EN-US">alex@nog.cl</span></a><span lang="EN-US"><br>
>><br>
>> +56971922362<br>
>><br>
>> <br>
>><br>
>> <br>
>><br>
>> <br>
>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> LACNOG mailing list<br>
>> </span><a href="mailto:LACNOG@lacnic.net" target="_blank"><span lang="EN-US">LACNOG@lacnic.net</span></a><span lang="EN-US"><br>
>> </span><a href="https://mail.lacnic.net/mailman/listinfo/lacnog" target="_blank"><span lang="EN-US">https://mail.lacnic.net/mailman/listinfo/lacnog</span></a><span lang="EN-US"><br>
>> Cancelar suscripcion: </span><a href="mailto:lacnog-unsubscribe@lacnic.net" target="_blank"><span lang="EN-US">lacnog-unsubscribe@lacnic.net</span></a><span lang="EN-US"><br>
>><br>
> <br>
> _______________________________________________<br>
> NOG mailing list<br>
> </span><a href="mailto:NOG@nog.cl" target="_blank"><span lang="EN-US">NOG@nog.cl</span></a><span lang="EN-US"><br>
> </span><a href="http://nog.cl/mailman/listinfo/nog_nog.cl" target="_blank"><span lang="EN-US">http://nog.cl/mailman/listinfo/nog_nog.cl</span></a><span lang="EN-US"><br>
> _______________________________________________<br>
> LACNOG mailing list<br>
> </span><a href="mailto:LACNOG@lacnic.net" target="_blank"><span lang="EN-US">LACNOG@lacnic.net</span></a><span lang="EN-US"><br>
> </span><a href="https://mail.lacnic.net/mailman/listinfo/lacnog" target="_blank"><span lang="EN-US">https://mail.lacnic.net/mailman/listinfo/lacnog</span></a><span lang="EN-US"><br>
> Cancelar suscripcion: </span><a href="mailto:lacnog-unsubscribe@lacnic.net" target="_blank"><span lang="EN-US">lacnog-unsubscribe@lacnic.net</span></a><span lang="EN-US"><br>
> <br>
<br>
_______________________________________________<br>
NOG mailing list<br>
</span><a href="mailto:NOG@nog.cl" target="_blank"><span lang="EN-US">NOG@nog.cl</span></a><span lang="EN-US"><br>
</span><a href="http://nog.cl/mailman/listinfo/nog_nog.cl" target="_blank"><span lang="EN-US">http://nog.cl/mailman/listinfo/nog_nog.cl</span></a><span lang="EN-US"><br>
_______________________________________________<br>
LACNOG mailing list<br>
</span><a href="mailto:LACNOG@lacnic.net" target="_blank"><span lang="EN-US">LACNOG@lacnic.net</span></a><span lang="EN-US"><br>
</span><a href="https://mail.lacnic.net/mailman/listinfo/lacnog" target="_blank"><span lang="EN-US">https://mail.lacnic.net/mailman/listinfo/lacnog</span></a><span lang="EN-US"><br>
Cancelar suscripcion: </span><a href="mailto:lacnog-unsubscribe@lacnic.net" target="_blank"><span lang="EN-US">lacnog-unsubscribe@lacnic.net</span></a><span lang="EN-US"><u></u><u></u></span></p>
</div></div></div>
</div>
<br>_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="mailto:lacnog-unsubscribe@lacnic.net">lacnog-unsubscribe@lacnic.net</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr"><b>Ivan Chapero<br><span style="color:rgb(102,102,102)">Área Técnica y Soporte</span></b><span style="color:rgb(102,102,102)"> </span><br style="color:rgb(102,102,102)">
<span style="color:rgb(102,102,102)">Fijo: 03464-470280 (interno 535)</span> | <span style="color:rgb(102,102,102)">Móvil: 03464-155-20282</span> | <span style="color:rgb(102,102,102)">Skype ID: ivanchapero</span><div><span style="color:rgb(102,102,102)">--</span><br style="color:rgb(102,102,102)">
<div style="text-align:center"><span style="color:rgb(102,102,102)">GoDATA Banda Ancha - CABLETEL S.A. | Av. 9 de Julio 1163 - 2183 - Arequito - Santa Fe - Argentina</span></div><br><br><br><br><br><br><br></div></div>
</div>