Today, on April 22, 2020, in the world of BGP routing, a thing that usually occurs in rare circumstances, happened. A year and 11 days ago, on April 11 2019, we wrote our first incident report about a thing that has never been observed before - a hijack by, with the highest probability, BGP optimizing software. Later that year, in summer, Cloudflare was brutally hit by the same type of incident. And today, a year after the first incident with AS263444 belonging to Open X Tecnologia Ltda, the same autonomous system… no, you guessed wrong.
Today it leaked 9328 prefixes from 1250 autonomous systems including all your favorite names: Akamai, Cloudflare, Vodafone, NTT, Amazon, NVIDIA and many others.
leaker | min_start_time | max_end_time | duration | prefix_count | origin_count | min_avg_max_propagation | max_duration
--------+------------------------+------------------------+----------+--------------+--------------+-------------------------+--------------
263444 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 9328 | 1250 | 2, 21, 176 | 00:22:00
asn | leaker | as_name | country | prefix_count | min_start_time | max_end_time | duration | prefix_count | min_avg_max_propagation | max_duration
--------+--------+-----------------------------------------------+---------------------------+--------------+------------------------+------------------------+----------+--------------+-------------------------+--------------
855 | 263444 | CANET-ASN-4 | Canada | 820 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 820 | 5, 8, 26 | 00:18:00
1541 | 263444 | DNIC-ASBLK-01534-01546 | United States | 269 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 269 | 2, 5, 8 | 00:18:00
37963 | 263444 | CNNIC-ALIBABA-CN-NET-AP | China | 250 | 2020-04-22 01:27:00+00 | 2020-04-22 01:47:00+00 | 00:20:00 | 250 | 2, 10, 19 | 00:20:00
20940 | 263444 | AKAMAI-ASN1 | | 225 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 225 | 15, 39, 86 | 00:21:00
26484 | 263444 | IKGUL-26484 | United States | 224 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 224 | 24, 55, 79 | 00:18:00
36352 | 263444 | AS-COLOCROSSING | United States | 221 | 2020-04-22 01:27:00+00 | 2020-04-22 01:47:00+00 | 00:20:00 | 221 | 7, 23, 55 | 00:20:00
3549 | 263444 | LVLT-3549 | United States | 220 | 2020-04-22 01:27:00+00 | 2020-04-22 01:47:00+00 | 00:20:00 | 220 | 2, 13, 87 | 00:19:00
45528 | 263444 | TIKONAIN-AS | India | 197 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 197 | 9, 11, 14 | 00:21:00
23089 | 263444 | HOTWIRE-COMMUNICATIONS | United States | 164 | 2020-04-22 01:27:00+00 | 2020-04-22 01:46:00+00 | 00:19:00 | 164 | 2, 20, 37 | 00:19:00
16625 | 263444 | AKAMAI-AS | United States | 151 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 151 | 14, 38, 176 | 00:21:00
35986 | 263444 | VYVE-BROADBAND | United States | 150 | 2020-04-22 01:27:00+00 | 2020-04-22 01:47:00+00 | 00:20:00 | 150 | 2, 7, 17 | 00:20:00
45769 | 263444 | DVOIS-IN | India | 131 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 131 | 25, 27, 46 | 00:21:00
44244 | 263444 | IranCell-AS | Iran, Islamic Republic of | 130 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 130 | 27, 29, 33 | 00:21:00
13335 | 263444 | CLOUDFLARENET | United States | 120 | 2020-04-22 01:27:00+00 | 2020-04-22 01:47:00+00 | 00:20:00 | 120 | 2, 39, 83 | 00:20:00
134548 | 263444 | DXTL-HK | Hong Kong | 116 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 116 | 12, 35, 51 | 00:18:00
38266 | 263444 | VODAFONE-IN | India | 110 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 110 | 17, 21, 35 | 00:22:00
9009 | 263444 | M247 | United Kingdom | 101 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 101 | 23, 47, 97 | 00:21:00
9605 | 263444 | DOCOMO | Japan | 100 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 100 | 10, 20, 35 | 00:21:00
721 | 263444 | DNIC-ASBLK-00721-00726 | United States | 94 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 94 | 2, 6, 9 | 00:18:00
43260 | 263444 | AS43260 | Turkey | 92 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 92 | 14, 62, 84 | 00:18:00
42337 | 263444 | RESPINA-AS | Iran, Islamic Republic of | 87 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 87 | 29, 31, 56 | 00:20:00
58224 | 263444 | TCI | Iran, Islamic Republic of | 84 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 84 | 22, 52, 62 | 00:21:00
50010 | 263444 | Nawras-AS | Oman | 83 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 83 | 20, 40, 53 | 00:21:00
3223 | 263444 | VOXILITY | United Kingdom | 76 | 2020-04-22 01:27:00+00 | 2020-04-22 01:46:00+00 | 00:19:00 | 76 | 13, 37, 53 | 00:19:00
51570 | 263444 | SPB-AS | Russian Federation | 76 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 76 | 5, 11, 22 | 00:20:00
11272 | 263444 | TELEPAK-NETWORKS-INC | United States | 75 | 2020-04-22 01:28:00+00 | 2020-04-22 01:46:00+00 | 00:18:00 | 75 | 2, 3, 11 | 00:18:00
41733 | 263444 | ZTELECOM-AS | Russian Federation | 73 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 73 | 16, 24, 41 | 00:21:00
20473 | 263444 | AS-CHOOPA | United States | 66 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 66 | 2, 33, 58 | 00:20:00
9845 | 263444 | CJCKN-AS-KR | Korea, Republic of | 63 | 2020-04-22 01:25:00+00 | 2020-04-22 01:44:00+00 | 00:19:00 | 63 | 5, 8, 12 | 00:19:00
25019 | 263444 | SAUDINETSTC-AS | Saudi Arabia | 62 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 62 | 38, 50, 65 | 00:20:00
30722 | 263444 | VODAFONE-IT-ASN | Italy | 56 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 56 | 13, 15, 17 | 00:21:00
64050 | 263444 | BCPL-SG | Singapore | 53 | 2020-04-22 01:25:00+00 | 2020-04-22 01:39:00+00 | 00:14:00 | 53 | 6, 18, 56 | 00:14:00
45083 | 263444 | CHEERYZONE | China | 52 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 52 | 8, 9, 11 | 00:21:00
20978 | 263444 | TT_Mobil | Turkey | 51 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 51 | 53, 54, 55 | 00:21:00
17941 | 263444 | BIT-ISLE | Japan | 50 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 50 | 4, 8, 22 | 00:18:00
139007 | 263444 | UNICOM-NM-WULANCHABU-IDC | China | 46 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 46 | 15, 18, 28 | 00:22:00
1452 | 263444 | DNIC-ASBLK-01451-01456 | United States | 45 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 45 | 2, 7, 8 | 00:18:00
42708 | 263444 | PORTLANE | Sweden | 45 | 2020-04-22 01:27:00+00 | 2020-04-22 01:46:00+00 | 00:19:00 | 45 | 2, 5, 14 | 00:19:00
198471 | 263444 | LINKEM-AS | Italy | 44 | 2020-04-22 01:26:00+00 | 2020-04-22 01:42:00+00 | 00:16:00 | 44 | 8, 11, 12 | 00:16:00
45102 | 263444 | CNNIC-ALIBABA-US-NET-AP | China | 42 | 2020-04-22 01:27:00+00 | 2020-04-22 01:46:00+00 | 00:19:00 | 42 | 2, 27, 56 | 00:19:00
57858 | 263444 | AS57858 | Estonia | 42 | 2020-04-22 01:26:00+00 | 2020-04-22 01:41:00+00 | 00:15:00 | 42 | 11, 12, 24 | 00:15:00
134743 | 263444 | WSPL-AS-AP | Australia | 41 | 2020-04-22 01:27:00+00 | 2020-04-22 01:46:00+00 | 00:19:00 | 41 | 7, 15, 19 | 00:19:00
9583 | 263444 | SIFY-AS-IN | India | 41 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 41 | 13, 23, 43 | 00:22:00
16509 | 263444 | AMAZON-02 | United States | 38 | 2020-04-22 01:26:00+00 | 2020-04-22 01:44:00+00 | 00:18:00 | 38 | 26, 55, 71 | 00:18:00
34164 | 263444 | AKAMAI-LON | United Kingdom | 36 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 36 | 20, 40, 76 | 00:21:00
13904 | 263444 | COSLINK | United States | 35 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 35 | 2, 7, 15 | 00:18:00
2519 | 263444 | VECTANT | Japan | 35 | 2020-04-22 01:25:00+00 | 2020-04-22 01:40:00+00 | 00:15:00 | 35 | 9, 10, 10 | 00:15:00
2914 | 263444 | NTT-COMMUNICATIONS-2914 | United States | 35 | 2020-04-22 01:27:00+00 | 2020-04-22 01:47:00+00 | 00:20:00 | 35 | 7, 26, 29 | 00:20:00
42682 | 263444 | ERTH-NNOV-AS | Russian Federation | 35 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 35 | 5, 6, 7 | 00:19:00
62738 | 263444 | ZOCHNET1 | United States | 34 | 2020-04-22 01:27:00+00 | 2020-04-22 01:45:00+00 | 00:18:00 | 34 | 2, 10, 19 | 00:18:00
21859 | 263444 | ZNET | United States | 33 | 2020-04-22 01:27:00+00 | 2020-04-22 01:47:00+00 | 00:20:00 | 33 | 14, 28, 37 | 00:20:00
3329 | 263444 | HOL-GR | Greece | 33 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 33 | 13, 13, 13 | 00:21:00
For 22 minutes this Brazilian ISP was leaking its upstream providers AS52320, AS22356 and AS6762 toward AS57463 NetIX. Open X is a member of NetIX - which is probably the main reason why NetIX help spread this leak through its channels to many other Internet Exchanges - you can take a look at the network map of NetIX to get a better understanding of where and with whom it exchanges, without the help from Tier-1 ISPs. Usually, they are vital for the leak to spread really far from the leaker, but not at this time.
Autonomous systems that accepted this route leak are distributed all over the world - without proper inbound filters because you do not expect that a route leak on an IX could lead to bad routes on a separate IX. Classic. And here we can see the “results” of such high maintenance.
accepted_asn | prefixes | country
--------------+----------+----------------------
57463 | 9329 | Bulgaria
21321 | 9173 | United Kingdom
199524 | 8595 | Austria
12605 | 8398 | Austria
49720 | 8247 | Ukraine
24723 | 8247 | Poland
201054 | 7782 | Poland
39489 | 7748 | Poland
1820 | 5936 | United States
15772 | 5800 | Ukraine
43981 | 5681 | Ukraine
31167 | 5407 | France
34572 | 5407 | France
15557 | 5159 | France
25358 | 5121 | France
60032 | 5011 | France
16347 | 4988 | France
61319 | 4902 | France
34177 | 4576 | France
196845 | 4182 | Czechia
42908 | 4182 | Czechia
8839 | 3997 | France
201701 | 3735 | Germany
37100 | 3598 | Mauritius
50629 | 3595 | Germany
37353 | 3573 | South Africa
24482 | 3442 | Singapore
58511 | 3205 | Australia
58057 | 3060 |
37497 | 2985 | South Africa
37468 | 2942 | Angola
328269 | 2919 | Zimbabwe
41495 | 2655 | United Kingdom
23738 | 2644 | United States
41405 | 2596 | France
8304 | 2581 | France
28186 | 2528 | Brazil
7850 | 2523 | United States
38719 | 2512 | Australia
201029 | 2452 | Poland
57811 | 2452 | Poland
25369 | 2449 | United Kingdom
3255 | 2380 | Ukraine
50321 | 2330 | Czechia
49223 | 2330 | Ukraine
31122 | 2238 | Ireland
31500 | 2199 | Russian Federation
48136 | 2000 | Poland
24748 | 1915 | Poland
35320 | 1891 | Ukraine
5588 | 1776 | Czechia
49102 | 1767 | Poland
34779 | 1616 | Slovenia
21021 | 1562 | Poland
61102 | 1562 | Israel
8551 | 1562 | Israel
13538 | 1387 | United States
58453 | 1387 | Hong Kong
28634 | 1320 | Brazil
27630 | 1227 | United States
34872 | 1119 | United Kingdom
6134 | 1119 | United States
49697 | 1101 | Germany
43531 | 1064 | United Kingdom
24875 | 1064 | Netherlands
206479 | 1050 | Germany
204708 | 1032 | France
34549 | 1016 | Germany
200753 | 1009 | Switzerland
62023 | 991 | Germany
It is peculiar that a Brazilian ISP, that is a member of IX.br, where it is, in fact, connecting to NetIX from Bulgaria, was able to make such a leak - almost non-existent at the region where it came from and severely affecting every other region - as you can see, almost all of leaked prefixes reach other countries from Brazil.
country | prefix_count | origin_count | min_start_time | max_end_time | duration | min_avg_max_propagation | max_duration
---------------------------+--------------+--------------+------------------------+------------------------+----------+-------------------------+--------------
United States | 3623 | 712 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 2, 18, 176 | 00:21:00
United Kingdom | 392 | 61 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 2, 33, 97 | 00:21:00
Russian Federation | 482 | 43 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 5, 17, 95 | 00:21:00
Iran, Islamic Republic of | 426 | 40 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 22, 38, 62 | 00:21:00
Korea, Republic of | 206 | 33 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 4, 11, 71 | 00:21:00
Germany | 124 | 31 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 2, 31, 84 | 00:21:00
Spain | 123 | 28 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 2, 15, 43 | 00:21:00
Turkey | 274 | 22 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 8, 61, 86 | 00:21:00
Netherlands | 72 | 20 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 2, 15, 51 | 00:21:00
| 289 | 20 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 2, 35, 86 | 00:21:00
China | 473 | 20 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 2, 13, 59 | 00:22:00
Sweden | 76 | 14 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 2, 9, 51 | 00:19:00
Italy | 134 | 12 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 3, 17, 82 | 00:21:00
France | 36 | 12 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 5, 9, 49 | 00:20:00
Canada | 832 | 11 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 2, 8, 50 | 00:18:00
Hungary | 20 | 10 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 5, 17, 50 | 00:19:00
Bulgaria | 40 | 10 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 10, 24, 43 | 00:21:00
India | 521 | 10 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 9, 19, 46 | 00:22:00
Japan | 208 | 9 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 4, 15, 49 | 00:21:00
Hong Kong | 166 | 9 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 6, 30, 70 | 00:22:00
Denmark | 18 | 8 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 6, 13, 42 | 00:20:00
Estonia | 52 | 7 | 2020-04-22 01:26:00+00 | 2020-04-22 01:41:00+00 | 00:15:00 | 8, 12, 36 | 00:15:00
Georgia | 27 | 7 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 13, 52, 68 | 00:18:00
Iraq | 22 | 7 | 2020-04-22 01:26:00+00 | 2020-04-22 01:44:00+00 | 00:18:00 | 23, 35, 63 | 00:18:00
Ireland | 10 | 7 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 9, 19, 38 | 00:20:00
Romania | 14 | 7 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 2, 23, 68 | 00:20:00
Australia | 81 | 5 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 7, 15, 32 | 00:21:00
Finland | 8 | 4 | 2020-04-22 01:26:00+00 | 2020-04-22 01:44:00+00 | 00:18:00 | 9, 10, 13 | 00:17:00
Israel | 20 | 4 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 3, 13, 36 | 00:19:00
Palestine, State of | 23 | 4 | 2020-04-22 01:26:00+00 | 2020-04-22 01:44:00+00 | 00:18:00 | 5, 13, 37 | 00:17:00
Poland | 8 | 4 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 5, 10, 30 | 00:19:00
Saudi Arabia | 82 | 4 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 13, 44, 65 | 00:20:00
Taiwan, Province of China | 51 | 4 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 8, 32, 92 | 00:22:00
Greece | 48 | 3 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 6, 23, 48 | 00:21:00
Brazil | 6 | 3 | 2020-04-22 01:25:00+00 | 2020-04-22 01:45:00+00 | 00:20:00 | 45, 54, 62 | 00:19:00
Switzerland | 3 | 3 | 2020-04-22 01:26:00+00 | 2020-04-22 01:44:00+00 | 00:18:00 | 6, 15, 25 | 00:18:00
Lithuania | 3 | 3 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 10, 39, 55 | 00:19:00
Moldova, Republic of | 3 | 3 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 17, 32, 53 | 00:18:00
Norway | 5 | 3 | 2020-04-22 01:26:00+00 | 2020-04-22 01:43:00+00 | 00:17:00 | 8, 9, 11 | 00:17:00
Armenia | 2 | 2 | 2020-04-22 01:26:00+00 | 2020-04-22 01:38:00+00 | 00:12:00 | 28, 48, 68 | 00:12:00
Croatia | 2 | 2 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 16, 32, 47 | 00:21:00
United Arab Emirates | 4 | 2 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 16, 33, 50 | 00:18:00
Portugal | 5 | 2 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 9, 10, 11 | 00:20:00
Czechia | 23 | 2 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 5, 11, 16 | 00:20:00
Belgium | 11 | 2 | 2020-04-22 01:26:00+00 | 2020-04-22 01:45:00+00 | 00:19:00 | 8, 9, 13 | 00:19:00
Latvia | 2 | 2 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 5, 11, 17 | 00:21:00
Singapore | 55 | 2 | 2020-04-22 01:25:00+00 | 2020-04-22 01:47:00+00 | 00:22:00 | 6, 19, 56 | 00:21:00
Viet Nam | 31 | 1 | 2020-04-22 01:25:00+00 | 2020-04-22 01:46:00+00 | 00:21:00 | 4, 9, 12 | 00:21:00
Argentina | 2 | 1 | 2020-04-22 01:25:00+00 | 2020-04-22 01:40:00+00 | 00:15:00 | 11, 11, 11 | 00:15:00
Jordan | 18 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 29, 55, 76 | 00:19:00
Cambodia | 8 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:38:00+00 | 00:12:00 | 19, 22, 26 | 00:12:00
Kazakhstan | 18 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 55, 60, 64 | 00:20:00
Kuwait | 1 | 1 | 2020-04-22 01:27:00+00 | 2020-04-22 01:38:00+00 | 00:11:00 | 6, 6, 6 | 00:11:00
Oman | 83 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 20, 40, 53 | 00:21:00
Albania | 7 | 1 | 2020-04-22 01:27:00+00 | 2020-04-22 01:46:00+00 | 00:19:00 | 47, 47, 48 | 00:19:00
Philippines | 2 | 1 | 2020-04-22 01:25:00+00 | 2020-04-22 01:45:00+00 | 00:20:00 | 11, 11, 11 | 00:20:00
Guam | 1 | 1 | 2020-04-22 01:27:00+00 | 2020-04-22 01:43:00+00 | 00:16:00 | 8, 8, 8 | 00:16:00
Yemen | 15 | 1 | 2020-04-22 01:27:00+00 | 2020-04-22 01:46:00+00 | 00:19:00 | 2, 28, 45 | 00:19:00
Azerbaijan | 1 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 22, 22, 22 | 00:21:00
Austria | 12 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:46:00+00 | 00:20:00 | 40, 49, 88 | 00:19:00
Syrian Arab Republic | 15 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:47:00+00 | 00:21:00 | 3, 13, 16 | 00:21:00
Iceland | 2 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:36:00+00 | 00:10:00 | 37, 37, 37 | 00:10:00
Ukraine | 2 | 1 | 2020-04-22 01:26:00+00 | 2020-04-22 01:38:00+00 | 00:12:00 | 56, 66, 75 | 00:12:00
Uruguay | 5 | 1 | 2020-04-22 01:25:00+00 | 2020-04-22 01:42:00+00 | 00:17:00 | 11, 11, 11 | 00:17:00
(64 rows)
The reasons for this route leak are probably much less conspiracy as it was last time, when we thought of a Pilosov-Kapela attack, without knowing much at the time about BGP optimization software. This time, keeping the previously gained knowledge, we could say that the reason for this incident is quite trivial, as it always is - a mistake in the configuration.
Though a much more interesting question is how NetIX that accepted such an announcement from the leaker, while being kind of a cloud Internet-Exchange does not have appropriately tuned and maintained filters, as it accepted too many routes with Tier-1 operators in them. Such a combination, as we pointed out too many times, is a recipe for disaster.
This time it resolved quickly without rendering too much damage, but an almost ignorant absence of filters on such a massive infrastructure is a gun hanging on the wall and as we know from Chekhov, it would shoot.