BGP route hijack by AS10990

Fri Jul 31 13:29:48 UTC 2020

On 31/Jul/20 10:47, Nick Hilliard wrote:

>
> Misconfig or oversight?

We started using Telia as an upstream back in 2014. When we had new
prefixes to announce to the Internet, we always sent them (as we do to
all our upstreams) a request to update their filters to support the
same. The standard response we got back from them, in those days, was a
list of ASN's permitted in an inbound filter applied to our eBGP session
with them, that showed all the ASN's that belonged to us and transited
through us.

I am not entirely sure whether this was backed up by a prefix filter,
but my feeling is that it wasn't. To them, as long as the AS we wanted
to get through them was included in the list, we basically took 10
minutes away from their day with the request.

If I check an e-mail from the Telia NOC as recently as 2018, I see this
(verbatim; our customer AS masked out with XXXX):

*****

    Dear Customer,

    Please be advised that the BGP filter that is applied to you is
AS-based and the AS XXXX is included in the BGP filter. Therefore, the
reported prefixes should be accepted. Can you please check and inform us
    accordingly?

*****

Is it at all possible that this is still their current filtering policy?

Mark.