AS Hijacking All Around

this just hit the north american network operators group:

seems like the following prefixes have been briefly announced by as 23520:
1/8, 2/8, 3/8, 4/8, 5/8, 7/8, 8/8, 12/8.

1/8 means 1.0.0.0 to 1.255.255.255. this representation is called cidr.

some .mil there as well.

josh karlin wrote:

check out the iar for “potential prefix hijacks” and if you’re coming
to this more than 24 hours after the post, do a search on as 23520 as
the hijacking as.

i don’t know how long the routes were announced, but they seem to be
gone now. or maybe the iar is horribly broken, in which case i will
be lynched :)

iar: http://cs.unm.edu/~karlinjf/iar/

in basic not 100% accurate terms to non network folks among us…
an asn is a way to represent a big network in the global routing table.
if someone somewhere privately announces a network space they don’t own, it’s not very good. this happens quite often, but on much smaller prefixes and usually by mistake.

gadi evron,
ge@beyondsecurity.com.

Share