On Fri, Nov 06, 2015 at 09:38:52AM -0600, Andrew Duey wrote:
Is anyone else seeing their routes leaked from AS9498 (BHARTI Airtel) in India?
According to bgpmon.net they started leaking our Level 3 provided IP space at 2015-11-06 05:52 UTC. Oddly, they're not leaking our ARIN assigned IP blocks but our prefixes inside the 8.0.0.0/8 range they are (8.34.96.0/21 and 8.33.2.0/24).
BGPmon shows less of their probes are now showing the announcement and we haven't seen a noticeable hit in overall traffic levels.
Has anyone else seen this route leak? Is it somehow specific to just the big Level 3 blocks? (4.0.0.0/8 and 8.0.0.0/8)? I figured NANOG would have a thread on it already but haven't heard a whisper (unless all the new guys like me are being modded thanks to the spam incident).
Andree already did a good write-up: http://www.bgpmon.net/large-scale-bgp-hijack-out-of-india/ Kind regards, Job