Re: ASN "Hijacked"

[Saku Ytti via NANOG <nanog () lists nanog org>]

When you generate a prefix-list, you start from AS-SET.

AS-SET is a list of ASN and AS-SET.

You can build a graph/tree out of this data, but you cannot prune
ASN/AS-SET or AS-SET/ASN pairs. You need ASN/ASN pairs to prune ASPA
violating branches.

You'd need to translate the AS-SET in the list into an ASN that is
advertising that AS-SET. For the top level AS-SET this is easy, you
are configuring that ASN so you know it explicitly. For any recursed
AS-SETs, you don't actually know which ASN that AS-SET represents.

You can do some heuristics to translate AS-SET into the ASN that is
advertising that AS-SET. Two that come to mind

1) Parse RIR data, for every ASN look at (mp-)export, if this yields
to exactly one AS-SET, then consider that ASN/AS-SET relation
2) PeeringDB has ASN/AS-SET relation, use that

If neither work, then it just means you cannot translate that AS-SET,
and it will not be subject to pruning due to ASPA violation. You don't
have to be able to translate everything to be able to prune.

Possibly there are other mechanisms to translate that I've not identified.

On Wed, 16 Sept 2026 at 00:18, Steven Wallace via NANOG
<nanog () lists nanog org> wrote:
> Could you expand on what is mean by  "b) resolve AS-SET into an ASN tree"?
> _______________________________________________
> NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/7UZ67EVTQAMLK543A3PAM7HDJBP26MJL/



-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/RGJPHQU6Y4XPWTYNQUU2IO2OCFAS23H7/