23 Sep
2008
23 Sep
'08
2:53 a.m.
On Tue, 23 Sep 2008, Andree Toonk wrote:
Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files. Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a full table, i.e. : * 217.208 unique prefixes detected by the RIS server in Moscow (ASpath: 2895 3267 8997) * 250495 seen by routeviews (ASpath: 2895 3267 8997). (results of quick query: where AS-path contained '3267 8997' update type = advertisement).
ASpath: 2895 3267 8997
Is that the only ASpath that leaked it? There are others - did they filter properly and only that path failed to filter? Regards, Hank