Routes to twitter via 8359 8359 8342

Mailman List Mirror (Read Only)
1

Is anyone else seeing this route destined for Twitter in the US being directed through 8359 announced by 8342?

104.244.42.0/24

Just curious, replies off list welcome.

-Drew

2

Seems visible in a handful of places:

$ w3m -dump ‘NLNOG RING looking glass’ | fgrep 8342
        BGP.as_path: 198644 21283 8447 8359 8342
        BGP.as_path: 8607 8359 8342
        BGP.as_path: 16086 8359 8342
        BGP.as_path: 31027 8359 8342

There is a RPKI ROA which only authorizes AS 13414 to originate that
/24, chances are that RPKI ROV is helping limit the blast radius.

https://console.rpki-client.org/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/521eb33f-9672-4cd9-acce-137227e971ac/69f7b69a-b519-4b2d-a7be-03aa505b2576/672a3d03-abc2-3f66-8052-26ed409619a3.roa.html

Kind regards,

Job

3

I’m seeing the same thing from my edge routers in Toronto and New York but am discarding the route on each due to it being RPKI invalid. Looks like a potential hijack by a Russian ISP based on the origin ASN.

NLNOG RING also shows some of their peers accepting the invalid announcement while others are accepting the correct one. https://lg.ring.nlnog.net/prefix_detail/lg01/ipv4?q=104.244.42.0/24

Regards,
Peter Potvin