[6bone] Rogue announcement from rogue ASN?

[Christian Nickel]

----- Original Message -----
From: "John Fraizer" <tvo@EnterZone.Net>
To: <6bone@ISI.EDU>
Sent: Saturday, July 20, 2002 1:46 AM
Subject: [6bone] Rogue announcement from rogue ASN?


>
> I'm seeing the following announcement:
>
> *  2001:430::/32    3ffe:1ced:ff05::2
>                                                            0 22 10566 5594 13193 109 17965 5609 4554 278 6939 2497 5994 i
> *                   3ffe:c00:8023:4::1
>                                                            0 109 3748 3786 10566 8379 8277 45328 2042 6435 6175 2497 5994 i
> *                   3ffe:31ff:0:ffff::50
>                                                            0 1930 10566 5594 13193 109 17965 5609 4554 278 6939 2497 5994 i
> *                   3ffe:8160:0:1::c
>                                                            0 6435 6175 10566 5594 13193 109 17965 5609 4554 278 6939 2497 5994 i
> *>                  3ffe:81d0:ffff:2::44
>                                                            0 6939 3748 3786 10566 8379 8277 45328 2042 6435 6175 2497 5994 i
>
>
> 2001:430::/32 has not been assigned:
>

I think this sTLA changed to the new RIR policy, but whois hasn't been updated (possible upgrade to new whois database in august
2002?)

> [whois.arin.net]
> ARIN-001                            2001:0400:0000:0000:0000:0000:0000:0000/23
> DISN-LES-V6                         2001:0430:0000:0000:0000:0000:0000:0000/35
>

whois -h whois.arin.net DISN-LES-V6
NRL (for SSCC) (DISN-LES-V6)
   One Innovation Drive,
   Hanahan, SC 29406-4200
   US

   Netname: DISN-LES-V6
   Netnumber: 2001:0430:0000:0000:0000:0000:0000:0000/35

   Maintainer: V6NV

   Coordinator:
     Brig, Michael (MB1166-ARIN)  brigm@spawar.navy.mil


   Domain System inverse mapping provided by:
   NS1.V6.LES.DISA.MIL
   NS2.V6.LES.DISA.MIL

   Record last updated on 13-Sep-2000.

> I am pretty sure that if this was legit, I would be seeing it only one or two ASNs into
> AS22.
>
> The origin AS5994 is not assigned according to ARIN:
>

whois -h whois.nic.mil AS5994
USN SPAWAR SYSTEM CENTER CHARLESTON (UNCLAS-DEFUN-ASN)
   PO 190022
   NORTH CHARLESTON, SC 29419

   Autonomous System Name: UNCLAS-DEFENSENET
   Autonomous System Number: 5994
   PLA: SPAWARSYSCEN CHARLESTON SC

   Technical Contact:
      Brig, Michael P. [SSCC NGI PROGRAM MANAGER]  (MPB)
      (843) 218-4675 (DSN) 588-4675 (FAX)(843) 218-4675
      BRIGM@SPAWAR.NAVY.MIL
   Administrative Contact:
      DoD, Hostmaster  (HOSTMASTER)
      (800) 365-3642 (FAX)(703) 676-1749
      HOSTMASTER@NIC.MIL

   Record last updated on 15-Sep-2000.

>
> [whois.arin.net]
> No match for "5994".
>
> %%%%%%%%%%%%%%%%%%% NO MATCH TIP %%%%%%%%%%%%%%%%%%%%%%%%%
> %                                                        %
> %  ALL OF THE POINT OF CONTACT HANDLES IN THE ARIN       %
> %  WHOIS END WITH "-ARIN", IF YOU ARE QUERYING A POINT   %
> %  OF CONTACT HANDLE PLEASE ADD -ARIN TO YOUR QUERY.     %
> %                                                        %
> %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
>
> The upstream is:
>
> aut-num:     AS2497
> as-name:     IIJ
> descr:       (Unknown)
> country:     JP
> as-in:       (Unknown)
> as-out:      (Unknown)
> admin-c:     TA032JP
> tech-c:      TA032JP
> remarks:     This information has been partially mirrored by APNIC from
> remarks:     JPNIC. To obtain more specific information, please use the
> remarks:     JPNIC whois server at whois.nic.ad.jp. (This defaults to
> remarks:     Japanese output, use the /e switch for English output)
> changed:     apnic-ftp@nic.ad.jp 20020717
> source:      JPNIC
>
>
>
> So, can someone tell me why:
>
> 1) I'm seeing a prefix that is not assigned yet.
> 2) I'm seeing it announced from an ASN that is not assigned.
>
> ---
> John Fraizer              | High-Security Datacenter Services |
> EnterZone, Inc            | Dedicated circuits 64k - 155M OC3 |
> http://www.enterzone.net/ | Virtual, Dedicated, Colocation    |
>
>
> _______________________________________________
> 6bone mailing list
> 6bone@mailman.isi.edu
> http://mailman.isi.edu/mailman/listinfo/6bone
>