google and amazon wierdness via HE right now

Andree Toonk andree+nanog at toonk.nl
Fri Apr 22 18:54:52 UTC 2016


It appears HE and others accepted 'hijacked' routes from AS200759.
A quick initial investigation shows close to 2,000 prefixes were
affected including prefixes normally announced by networks such as
Facebook, Google, Amazon, Twitter, Apple, Akamai, Time Warner Cable and
more.

Also see more details on the bgpmon blog here:

http://www.bgpmon.net/large-hijack-affects-reachability-of-high-traffic-destinations/

Cheers
 Andree


My secret spy satellite informs me that Frank Bulk wrote On 2016-04-22,
10:31 AM:
> Being discussed on outages, too.
> 
> Our monitoring system saw access to www.amazon.com and www.cablelabs.com
> (over v6) down via HE ... amazon came back up for me via Zayo, but when
> www.cablelabs.com came back up, it was on HE.  So the same as you.
> 
> So I suspect HE had a hiccup.
> 
> Frank
> 
> -----Original Message-----
> From: NANOG [mailto:nanog-bounces at nanog.org] On Behalf Of Ken Chase
> Sent: Friday, April 22, 2016 12:22 PM
> To: NANOG <nanog at nanog.org>
> Subject: google and amazon wierdness via HE right now
> 
> 
> From toronto - something odd - mtr to google.com (google.com
> (172.217.3.142))
> 
>  5. v638.core1.tor1.he.net      
>  6. 100ge7-2.core1.nyc4.he.net  
>  7. 100ge11-1.core1.par2.he.net 
>  8. 10ge3-2.core1.zrh1.he.net   
>  9. ???
> 
> par is paris, zrh is zurich?
> 
> same base path for hitting my EC2 nodes... Cant imagine this is just
> affecting Toronto
> HE customers.
> 
> EC2 node is in 107.20/14 
> 
> /kc
> 
> 



More information about the NANOG mailing list