RIPE NCC publishes case study of youtube.com hijack

Fri Feb 29 14:46:15 UTC 2008

The report states:

> Sunday, 24 February 2008, 20:07 (UTC): AS36561 (YouTube) starts announcing 208.65.153.0/24. With two identical prefixes in the routing system, BGP policy rules, such as preferring the shortest AS path, determine which route is chosen. This means that AS17557 (Pakistan Telecom) continues to attract some of YouTube's traffic. 

It's worth noting that from where I sit, it appears as though none of 
Youtube's transit providers accepted this announcement.  Only their peers.

The point is -- Restrictive customer filtering can also bite you in the 
butt.  Trying to require your providers to do a "ge 19 le 25" (or 
whatever your largest supernet is), rather than filters for specific 
prefix sizes seems a worthwhile endeavor so you can de-aggregate on the 
fly, as necessary.

-David

Tom Quilling wrote:
> for those interested in the matter
>  
> tom
>  
>  
> 
>      
> 
>     Dear Colleagues,
> 
>     As you may be aware from recent news reports, traffic to the
>     youtube.com website was 'hijacked' on a global scale on Sunday, 24
>     February 2008. The incident was a result of the unauthorised
>     announcement of the prefix 208.65.153.0/24 and caused the popular
>     video sharing website to become unreachable from most, if not all,
>     of the Internet.
> 
>     The RIPE NCC conducted an analysis into how this incident was seen
>     and tracked by the RIPE NCC's Routing Information Service (RIS) and
>     has published a case study at:
>     http://www.ripe.net/news/study-youtube-hijacking.html
> 
>     The RIPE NCC RIS is a service that collects Border Gateway Protocol
>     (BGP) routing information from roughly 600 peers at 16 Internet
>     Exchange Points (IXPs) across the world. Data is stored in near
>     real-time and can be instantly queried by anyone to provide multiple
>     views of routing activity for any point in time.
> 
>     The RIS forms part of the RIPE NCC's suite of Information Services,
>     which together provide a deeper insight into the workings of the
>     Internet. The RIPE NCC is a neutral and impartial organisation, and
>     commercial interests therefore do not influence the data collected.
> 
>     The RIPE NCC Information Services suite also includes the Test
>     Traffic Measurement (TTM) service, the DNS Monitoring (DNSMON)
>     service and Hostcount. All of these services are available to
>     anyone, and most of them are offered free of charge.
> 
>     More information about RIPE NCC Information Services can be found at:
>     http://is-portal.ripe.net
> 
>     Regards,
>     Daniel Karrenberg
>     Chief Scientist, RIPE NCC
> 