In message <44806.1555289035@segfault.tristatelogic.com>, Ronald F. Guilmette <rfg@tristatelogic.com> writes
Here is what I am hoping some actual expert can explain to me:
https://bgp.he.net/AS65000#_asinfo https://bgp.he.net/AS65000#_prefixes https://bgp.he.net/AS65000#_prefixes6 https://bgp.he.net/AS65000#_peers https://bgp.he.net/AS65000#_peers6
I will save all further comment until someone offers me some kind of an explanation of this apparently strange stuff. For now, I will only add that whereas bgp.he.net is showing there as being a total of 66 IPv4 prefixes announced by this (reserved) ASN
Hurricane Electric is seeing announcements from other ASs some of which have AS65000 declared to be origin of the prefix Which may sound the same as what you said, but isn't
I am unable to fathom how and why a reserved ASN should be announcing -anything- at -any- place or point where anybody on the outside can see it.
Best practice is to remove internal use AS's from announcements -- not much bad happens if you don't (well, you might not get as much reachability if other folk are also using that reserved AS within their networks...)
The only other thing I feel compelled to say, or ask right now, is just this: Who should I be notifying if there is an issue with this ASN?
the NOC for the people making the incorrect announcement -- if there is a question as to how valid the rest of the path might be, then that may take you a little while to establish (and you may get lied to when you make enquiries) BTW: great though HE's portal is, you really should be picking apart the mass of data held by RIPE if you want to form a view as to might be doing bad things (that's not the only place you need to look, but it's a good start and in this case the number of detectors seeing this origin and the timeline puts it rather more in perspective) -- richard Richard Clayton Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755