Hi Bob, AARNet does have a fairly strong policy on prefix-filtering. We also peer with route-views servers so that Cyclops and other projects can actually get this type of information. Best not to shoot the messenger as the message can be useful ;-) Regards Bruce

From: peering-admin@aarnet.edu.au [mailto:peering-admin@aarnet.edu.au] On Behalf Of Bob Poortinga Sent: Friday, 9 April 2010 11:13 PM To: nanog@nanog.org Cc: peering@aarnet.edu.au; Bruce Morgan Subject: Re: BGP hijack from 23724 -> 4134 China?

Jay Hennigan <jay@west.net> writes:

...

We just got Cyclops alerts showing several of our prefixes sourced from AS23474 propagating through AS4134. Anyone else?

For the record, yes. Two of our blocks were announced via 7575 4134 23724 yesterday. First seen by Cyclops at 2010-04-08 15:57:13 UTC and lasted about 20 minutes.

Does AS7575, Australian Academic and Reasearch Network, do any filtering?

-- Bob Poortinga K9SQL <http://www.linkedin.com/in/bobpoortinga> Technology Service Corp. <http://www.tsc.com> Bloomington, Indiana US

-- street address: AARNet, POD 3, 20 Dick Perry Ave, Kensington, WA 6151, Australia m. 0408 882 390 t. +61 8 9289 2212 e. bruce.morgan@aarnet.edu.au w. www.aarnet.edu.au important This email and any files transmitted with it are confidential, and the rights of confidentiality in such information are not waived or lost by its mistaken delivery to you. Any dissemination, copying, use or disclosure of the email and/or such files without the permission of AARNet, or the sender, is strictly prohibited. If you have received this email in error, please contact the sender immediately and delete all copies of this transmission.