It was yesterday (2009-10-09) at 07:21:41 UTC that an italian ISP AS9035 “ASN-WIND Wind Telecomunicazioni spa” started leaking no less than 90,358 prefixes to its italian upstream AS 1267. The last announcement happened at 07:23:42 UTC, a bit more than two minutes after the first announcement, and the routes were immediately withdrawn.

Several Cyclops users received “origin change” alerts like the following one:

————————————————–
Alert ID:                     7645041
Alert type:                   origin change
Monitored ASN,prefix:         128.97.0.0/16
Offending attribute:          128.97.0.0/16-9035
Date:                         2009-10-09 07:22:12 UTC
Duration:                     00:00:38 (hh:mm:ss)
No. monitors:                 3
Announced prefix:             128.97.0.0/16
Announced ASPATH:             12637 12637 3269 1267 9035
————————————————–

The alert clearly shows that only 3 monitors saw this alert which hints the event was very local, and when drilling down in the link we can see they reside in Italy:

Also, after inspecting the AS paths, it looks like only italian ISPs were involved. It seems this event was a result of an accidental misconfig of the router similar to the AS13214 also detected by Cyclops: http://cyclops.cs.ucla.edu/blog/?p=78. –Ricardo

This entry was posted on Saturday, October 10th, 2009 at 6:44 pm and is filed under leaks. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.