<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:AngsanaUPC;
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Georgia","serif";
color:#002060;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Georgia","serif";color:#002060">Thanks Anurag for dig down the issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Georgia","serif";color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#17365D">Sincerely Yours<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#365F91">-------------------------------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#365F91">Md. Mahbubul Alam
<b>Reyad</b><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">Assistant Manager<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">CORE-IP Network || Technology<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">Cell: +880 1976672281 || Skype: new_reyad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060"><a href="http://www.qubee.com.bd/"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">www.qubee.com.bd</span></a></span><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">T +88 02 8812113 || F +88 02 8812115<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:AngsanaUPC;color:#D99594"><img border="0" width="103" height="31" id="Picture_x0020_1" src="cid:image001.jpg@01D14614.E13E1ED0" alt="Description: Description: logo-02"></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Georgia","serif";color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> nog-bounces@bdnog.org [mailto:nog-bounces@bdnog.org]
<b>On Behalf Of </b>Anurag Bhatia<br>
<b>Sent:</b> Thursday, December 31, 2015 3:48 PM<br>
<b>To:</b> nog@bdnog.org<br>
<b>Subject:</b> Re: [bdNOG] BGP Prefix hijacking<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Additionally I looked at <span style="font-size:9.5pt">AS44050 looking glass
<a href="http://lg.pinspb.ru/">here</a>. </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">Router: PIN-SPB-ASR9001-CORE </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">Command: show bgp ipv4 unicast regexp 131788$</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">Thu Dec 31 12:45:53.169 MSK</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">BGP router identifier 95.215.3.1, local AS number 65221</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">BGP generic scan interval 60 secs</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">BGP table state: Active</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">Table ID: 0xe0000000 RD version: 246514823</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">BGP main routing table version 246514823</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">BGP scan interval 60 secs</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">Status codes: s suppressed, d damped, h history, * valid, > best</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New""> i - internal, r RIB-failure, S stale, N Nexthop-discard</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">Origin codes: i - IGP, e - EGP, ? - incomplete</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New""> Network Next Hop Metric LocPrf Weight Path</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">*> <a href="http://203.23.51.0/24">
203.23.51.0/24</a> 95.215.3.78 0 500 131788 i</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New"">Processed 1 prefixes, 1 paths</span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">So that old route is removed but still a new/weird AS131788 route is visible. Hard to believe <a href="http://203.23.51.0/24">203.23.51.0/24</a> is allocated over there. So ASN and prefix hijacked for purpose
of spamming or something like that. </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">Thanks. </span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Dec 31, 2015 at 2:59 PM, Anurag Bhatia <<a href="mailto:me@anuragbhatia.com" target="_blank">me@anuragbhatia.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Dear Mahbubul<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think this is not BGP prefix hijack based on the aspath in bgpmon alert. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">1103 286 9002 44050 131788<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Shows AS 131788 is announcing to AS44050 and beyond. Except origin AS none of other AS belongs to any Indian telco and I am sure AS 44050 transit is not available in India. :)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hence, I think AS131788 has not hijacked prefix but it's rather a case where an ASN has been hijacked and is being used to announce fishy routes. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://bgp.he.net/AS131788#_graph4" target="_blank">http://bgp.he.net/AS131788#_graph4</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Shows the relations. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Anyways, will wait to hear back from AS131788 (though I think they haven't done any misconfig at their end). <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Dec 31, 2015 at 2:31 PM, Scott Weeks <<a href="mailto:surfer@mauigateway.com" target="_blank">surfer@mauigateway.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal"><br>
<br>
On Thu, Dec 31, 2015 at 1:31 PM, Md. Mahbubul Alam Reyad<br>
<<a href="mailto:mahbubul.reyad@qubee.com.bd" target="_blank">mahbubul.reyad@qubee.com.bd</a>> wrote:<br>
<br>
> I received the following alert mail from bgpmon where one of our (QUBEE)<br>
> prefix (<a href="http://163.47.76.0/22" target="_blank">163.47.76.0/22</a> ) is announce by an indian ISP. FYN this IP<br>
> prefix was newly acquired from APNIC and yet to be announce from QUBEE<br>
> (AS45951) network.<br>
--------------------------------<br>
<br>
<br>
--- <a href="mailto:kzobair@gmail.com" target="_blank">kzobair@gmail.com</a> wrote:<br>
From: "Md. Zobair Khan" <<a href="mailto:kzobair@gmail.com" target="_blank">kzobair@gmail.com</a>><br>
<br>
You can send an email to that ISP querying about this possible hijack.<br>
Other than that, there is no big primary steps. If the ISP doesn't reply<br>
you back with suitable answers, then you can communicate with their<br>
upstream to filter these routes from that ISP, since it is your prefix.<br>
---------------------------------<br>
<br>
<br>
<br>
You could also email their upstream providers and ask<br>
them to properly filter their customers. The upstream<br>
providers should allow the ISP to only announce the<br>
prefixes they're supposed to announce.<br>
<span style="color:#888888"><br>
scott</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
><br>
> _______________________________________________<br>
> nog mailing list<br>
> <a href="mailto:nog@bdnog.org" target="_blank">nog@bdnog.org</a><br>
> <a href="http://mailman.bdnog.org/mailman/listinfo/nog" target="_blank">http://mailman.bdnog.org/mailman/listinfo/nog</a><br>
><br>
><br>
<br>
<br>
_______________________________________________<br>
nog mailing list<br>
<a href="mailto:nog@bdnog.org" target="_blank">nog@bdnog.org</a><br>
<a href="http://mailman.bdnog.org/mailman/listinfo/nog" target="_blank">http://mailman.bdnog.org/mailman/listinfo/nog</a><br>
<br>
<br>
_______________________________________________<br>
nog mailing list<br>
<a href="mailto:nog@bdnog.org" target="_blank">nog@bdnog.org</a><br>
<a href="http://mailman.bdnog.org/mailman/listinfo/nog" target="_blank">http://mailman.bdnog.org/mailman/listinfo/nog</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><span class="hoenzb"><span style="color:#888888">-- <o:p></o:p></span></span></p>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#888888">Anurag Bhatia</span><span style="color:#888888"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#888888"><a href="http://anuragbhatia.com" target="_blank">anuragbhatia.com</a></span><span style="color:#888888"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888">PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif"">Anurag Bhatia</span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif""><a href="http://anuragbhatia.com" target="_blank">anuragbhatia.com</a></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>