September 2008 - Test - lists.nanog.org

prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

I am hoping to confirm a short-duration prefix hijack of 72.234.0.0/15 (and another of our prefixes) by ASN 8997 ("OJSC North-West Telecom" in Russia) in using ASN 3267 (Russian Federal University Network) to advertise our space to ASN 3277 (Regional University and Scientific Network (RUSNet) of North-Western and Saint-Petersburg Area of Russia). Is that what I'm seeing when I go to "bgplay.routeviews.org/bgplay", put in prefix 72.234.0.0/15 and select the dates: 22/9/2008 9:00:00 and 22/9/2008 15:00:00 If so, am I understanding it correctly if I say ASN 3267 saw a shorter path from ASN 8997, so refused the proper announcement from ASN 36149 (me) it normally hears from ASN 174 (Cogent). If the above two are correct, would it be correct to say only the downstream customers of ASN 3267 were affected? scott

9 16

Re: eigrp and managed ethernet
by Joseph Doran 23 Sep '08

23 Sep '08

EIGRP timers over WAN media default to 60 seconds. Neighborship will not expire for up to 180 seconds. To verify your EIGRP neighborship do a "show ip eigrp neighbor" Message: 6 Date: Tue, 23 Sep 2008 09:25:34 -0700 (PDT) From: Philip Lavine <source_route(a)yahoo.com> Subject: Re: eigrp and managed ethernet To: nanog <nanog(a)merit.edu> Message-ID: <542140.85408.qm(a)web30802.mail.mud.yahoo.com> Content-Type: text/plain; charset=us-ascii What is really bizarre is that I am down for minutes not seconds and the timers never fire. If I don't manually passive the connection eigrp will for some reason think there is a neighbor even though I am unable to source ping across the WAN.

2 1

Re: prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

------ tme(a)multicasttech.com wrote: ---------- From: Marshall Eubanks <tme(a)multicasttech.com> So, do you think this was lots of little tests / hijacks / mistakes ? Or did it just not propagate very far ? --------------------------------------------- According to Andree Toonk (and someone confirmed privately) ASN 8997 leaked a full table to ASN 3267 (who didn't filter!). The only upstream of ASN 3267 I saw in bgplay was ASN 174 (Cogent) who seems to have filtered, but I can't confirm. So I guess that the impact would've only been to the peers downstream of ASN 3267. scott --------------------------------------------- Andree Toonk <andree+nanog(a)toonk.nl> Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files. Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a full table, i.e. : ----------------------------------------------

3 2

Re: eigrp and managed ethernet
by Philip Lavine 23 Sep '08

23 Sep '08

What is really bizarre is that I am down for minutes not seconds and the timers never fire. If I don't manually passive the connection eigrp will for some reason think there is a neighbor even though I am unable to source ping across the WAN. ----- Original Message ---- From: Matthew Huff <mhuff(a)ox.com> To: Philip Lavine <source_route(a)yahoo.com>; nanog <nanog(a)merit.edu> Sent: Tuesday, September 23, 2008 8:59:14 AM Subject: RE: eigrp and managed ethernet Correct. Eigrp neighbor connectivity has a short-cut when L2 connectivity goes down, otherwise it will use the eigrp neighbor hold-down timer. You can decrease that timer: interface fa0/0 ip hello-interval eigrp p x ip hold-time eigrp p y where p is your eigrp as-number, and x is how often you want the hello (in seconds) and y is the max hold-down timer. Generally y is = x * 3 http://www.cisco.com/en/US/docs/ios/12_2/iproute/command/reference/1rfeigrp… ---- Matthew Huff | One Manhattanville Rd OTA Management LLC | Purchase, NY 10577 www.ox.com | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-460-4139 -----Original Message----- From: Philip Lavine [mailto:source_route@yahoo.com] Sent: Tuesday, September 23, 2008 11:43 AM To: nanog Subject: eigrp and managed ethernet For some reason when I lose layer 3 connectivity between two managed Ethernet sites EIGRP does not bounce.Is this because the physical interface does not bounce?

5 4

eigrp and managed ethernet
by Philip Lavine 23 Sep '08

23 Sep '08

For some reason when I lose layer 3 connectivity between two managed Ethernet sites EIGRP does not bounce.Is this because the physical interface does not bounce?

4 3

Re: prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

--- tme(a)multicasttech.com wrote: From: Marshall Eubanks <tme(a)multicasttech.com> : You didn't specify the time zone you are in, : so I looked at +- 1 day around it. If the : hijack lasted 6 hours, we should have seen it. My apologies, I just used the time zone the tool (bgplay.routeviews.org/bgplay) was using when I said: 22/9/2008 9:00:00 and 22/9/2008 15:00:00 I'm sure it was in GMT. Seeing the many responses, we now know something happened and it was only about 15 minutes in duration. bgplay shows the problem with the above data and I was just wondering if I was understanding the impact correctly: > If the above two are correct, would it be > correct to say only the downstream customers > of ASN 3267 were affected? I was not following the rules properly: never attribute to malice that which can be explained by human error. I thought there might be some testing-of-the-water in preparation for future 'events' and I guess I was starting to be trigger happy after all the talk about the new BGP attack. scott --- tme(a)multicasttech.com wrote: From: Marshall Eubanks <tme(a)multicasttech.com> To: surfer(a)mauigateway.com Cc: <nanog(a)merit.edu> Subject: Re: prefix hijack by ASN 8997 Date: Tue, 23 Sep 2008 07:51:36 -0400 On Sep 22, 2008, at 9:06 PM, Scott Weeks wrote: > > > > I am hoping to confirm a short-duration prefix hijack of > 72.234.0.0/15 (and another of our prefixes) by ASN 8997 ("OJSC North- > West Telecom" in Russia) in using ASN 3267 (Russian Federal > University Network) to advertise our space to ASN 3277 (Regional > University and Scientific Network (RUSNet) of North-Western and > Saint-Petersburg Area of Russia). > > Is that what I'm seeing when I go to "bgplay.routeviews.org/bgplay", > put in prefix 72.234.0.0/15 and select the dates: > > 22/9/2008 9:00:00 and 22/9/2008 15:00:00 > > If so, am I understanding it correctly if I say ASN 3267 saw a > shorter path from ASN 8997, so refused the proper announcement from > ASN 36149 (me) it normally hears from ASN 174 (Cogent). I cannot confirm that from the monitoring program at AS 16517 : [tme@lennon mcast]$ grep 72.234.0.0 bgp.full.Sep_2*2008 bgp.full.Sep_21_00:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_21_06:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_21_12:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_21_18:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_22_00:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_22_06:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_22_12:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_22_18:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_23_00:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_23_06:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? You didn't specify the time zone you are in, so I looked at +- 1 day around it. If the hijack lasted 6 hours, we should have seen it. Regards Marshall > > > If the above two are correct, would it be correct to say only the > downstream customers of ASN 3267 were affected? > > scott >

2 1

Re: InterCage, Inc. (NOT Atrivo)
by Scott Weeks 23 Sep '08

23 Sep '08

--- jpleger(a)gmail.com wrote: I am sure if I looked into it more I could find some exploits related to the sites. ------------------------------------- "Why software piracy might actually be good for companies." Folks should clean their own house before pointing fingers at others... scott

16 28

comparison of hijack alert systems [was]: prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

On Mon, 22 Sep 2008, Scott Weeks wrote: > > I am hoping to confirm a short-duration prefix hijack <snip> --- hank(a)efes.iucc.ac.il wrote: From: Hank Nussbacher <hank(a)efes.iucc.ac.il> I too spotted this via PHAS for a large number of prefixes, but have not received alerts from IAR, Watchmy.Net nor does RIPE RIS show this hijack: http://www.ris.ripe.net/perl-risapp/risearch.html I would have expected with so many RRC boxes that RIPE RIS would have caught it. I had thought it was a false positive from PHAS but now that you and others have seen it - I guess it is for real. ---------------------------------------- It'd be very interesting to compare said systems using this event. I have not subscribed to MyASN or watchmy.net yet, so I can't do that. I do note, however, that PHAS took 4 hours and 20 minutes to email me, which is within the specs noted on their site. scott

1 0

duplicate packet
by chloe K 22 Sep '08

22 Sep '08

Hi all When I ping the ip, I get the duplicate I check the ip is just one. Why it happens? Thank you 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.344 ms 64 bytes from 192.168.0.95: icmp_seq=1 ttl=63 time=0.401 ms (DUP!) 64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.296 ms 64 bytes from 192.168.0.95: icmp_seq=2 ttl=63 time=0.328 ms (DUP!) 64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.291 ms 64 bytes from 192.168.0.95: icmp_seq=3 ttl=63 time=0.316 ms (DUP!) 64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.279 ms 64 bytes from 192.168.0.95: icmp_seq=4 ttl=63 time=0.309 ms (DUP!) 64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.271 ms 64 bytes from 192.168.0.95: icmp_seq=5 ttl=63 time=0.299 ms (DUP!) --------------------------------- Yahoo! Canada Toolbar : Search from anywhere on the web and bookmark your favourite sites. Download it now!

10 10

Re: prefix hijack by ASN 8997
by Scott Weeks 22 Sep '08

22 Sep '08

----------Scott Weeks <surfer(a)mauigateway.com> wrote: ------- > I am hoping to confirm a short-duration prefix hijack <snip> ------------------------------------- --- christian(a)broknrobot.com wrote: ------- From: "Christian Koch" <christian(a)broknrobot.com> I couldn't find any relevant data confirming the announcement of one of my /19 blocks, until a few minutes ago when i checked the route views bgplay (ripe bgplay turns up nothing) and can now see 8997 announcing and quickly withdrawing my prefix ------------------------------------- At what time did you see it? scott

2 1