[GTER] Novo caso de anúncios AS-PATH incorretos

Tue Feb 17 17:51:40 -03 2009

Sim.

Aqui:

Feb 16 15:06:31.365 BRST: %BGP-6-ASPATH: Long AS path 8167 3257 29113 47868
47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868
47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868
47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868
47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868
47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868
47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868 47868
47868 47868 47868 47868 received from xxx.xxx.xxx.xxx : Has more than 255 AS

Pensei que tinha sido algum tipo de ataque :-)

Abs

2009/2/17 MARLON BORBA <MBORBA at trf3.jus.br>

> http://www.renesys.com/blog/2009/02/the-flap-heard-around-the-worl.shtml
>
>
> "The Details
>
> SuproNet (AS 47868) normally announces a single prefix,
> 94.125.216.0/21, to a single provider, CD-Telematika (AS 25512). On
> February 16th at 16:23:30 UTC, we saw this same prefix via a different
> provider, Sloane Park Property Trust (AS 29113), but with an AS path
> exceeding 255 ASNs. Such messages continued for almost exactly one hour
> or until 17:23:00 UTC. We observed Level 3 (AS 3356), Tiscali (AS 3257)
> and TeliaSonera (AS 1299) propagating most of these routes globally,
> with a total of 230 unique ASes ultimately sending us the problematic
> announcements."
>
> 255 ASNs!?
>
>
>
> --
>
> Abraços,
>
> Marlon Borba, CISSP, APC DataCenter Associate
> Técnico Judiciário · Segurança da Informação
> IPv6 Evangelist · MoReq-Jus Evangelist
> TRF 3 Região
> (11) 3012-1683
> --
> Practically no IT system is risk free.
> (NIST Special Publication 800-30)
> --
>
> --
> gter list    https://eng.registro.br/mailman/listinfo/gter
>