YouTube IP Hijacking

Sun Feb 24 20:53:33 UTC 2008

Sounds more like a typo on a filter over at AS17557
than anything else.

http://ca.news.yahoo.com/s/afp/080224/world/denmark_media_islam_pakistan_internet_youtube

-r

On Sun, Feb 24, 2008 at 12:27:29PM -0800, Sargun Dhillon wrote:
> 
> As you guys probably know Youtube's IP's are being hijacked. Trace:
> ~ $ host youtube.com
> youtube.com has address 208.65.153.253
> youtube.com has address 208.65.153.238
> youtube.com has address 208.65.153.251
> [Same /24]
> 
> 
> 701 3491 17557
>     64.74.137.253 (metric 1) from 66.151.144.148 (66.151.144.148)
>       Origin IGP, metric 100, localpref 100, valid, external
>       Community: 65010:300
>       Last update: Sun Feb 24 11:33:05 2008 [PST8PDT]
> 3491 17557
>     216.218.135.205 from 216.218.135.205 (216.218.252.164)
>       Origin IGP, metric 100, localpref 100, valid, external, best
>       Last update: Sun Feb 24 10:47:57 2008 [PST8PDT]
> 
> So, it seems that youtube's ip block has been hijacked by a more
> specific prefix being advertised. This is a case of IP hijacking, not
> case of DNS poisoning, youtube engineers doing something stupid, etc.
> For people that don't know. The router will try to get the most specific
> prefix. This is by design, not by accident. This is a case of censorship
> on the internet. Anyways, I hope this doesn't get into a political
> situation, and someone stops this.
> 
>  What action are you going to take? Are you going to filter
> announcements from AS17557, or just filter that specific announcement?
> Considering youtube is a fairly high-traffic website I think that other
> operators are just going to start filtering that AS. This is a great
> example of global politics getting in the way of honest corporatism.
> This is also an example of how vulnerable the internet is, and how lax
> providers are in their filtering policies. I don't know how large
> Pakistani Telecom is, but it I bet its not large enough that PCCW should
> be allowing it to advertise anything.