[anti-abuse-wg] Mysteries of the Internet: AS65000

In message <44806.1555289035 at segfault.tristatelogic.com>, Ronald F.
Guilmette <rfg at tristatelogic.com> writes

>Here is what I am hoping some actual expert can explain to me:
>
>https://bgp.he.net/AS65000#_asinfo
>https://bgp.he.net/AS65000#_prefixes
>https://bgp.he.net/AS65000#_prefixes6
>https://bgp.he.net/AS65000#_peers
>https://bgp.he.net/AS65000#_peers6
>
>I will save all further comment until someone offers me some kind of an
>explanation of this apparently strange stuff.  For now, I will only add
>that whereas bgp.he.net is showing there as being a total of 66 IPv4
>prefixes announced by this (reserved) ASN

Hurricane Electric is seeing announcements from other ASs some of which
have AS65000 declared to be origin of the prefix

Which may sound the same as what you said, but isn't

>I am unable to fathom how and why a reserved ASN should be
>announcing -anything- at -any- place or point where anybody on the outside
>can see it.

Best practice is to remove internal use AS's from announcements -- not
much bad happens if you don't (well, you might not get as much
reachability if other folk are also using that reserved AS within their
networks...)

>The only other thing I feel compelled to say, or ask right now, is just
>this:   Who should I be notifying if there is an issue with this ASN?

the NOC for the people making the incorrect announcement -- if there is
a question as to how valid the rest of the path might be, then that may
take you a little while to establish (and you may get lied to when you
make enquiries)

BTW: great though HE's portal is, you really should be picking apart the
mass of data held by RIPE if you want to form a view as to might be
doing bad things (that's not the only place you need to look, but it's a
good start and in this case the number of detectors seeing this origin
and the timeline puts it rather more in perspective)

-- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 185 bytes
Desc: not available
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20190415/06bf2c34/attachment.sig>