AS203 (CenturyLink/Qwest/Level3/Lumen) hijack report

Thu Oct 22 16:45:54 UTC 2020

Peace,

On Thu, Oct 22, 2020 at 4:11 AM Töma Gavrichenkov <ximaera at gmail.com> wrote:
> Following up on the today's massive partial network outage, here's the
> analysis of what actually happened with the AS203's hijack, which is
> the first one for the newly founded Lumen Technologies.
>
> https://blog.qrator.net/en/lumen-aka-centurylink-generating-routing-incidents_101/

And a follow-up with the incident report from Lumen:

--- cut ---
[PROBLEM OVERVIEW]
Customer reporting routing issues to a host on 3rd party network

[SUMMARY OF WORK]
Lumen is not responsible for routing issues on 3rd party network.
Reported prefix is learned from 35415 which appear to have had an
issue in their network

[REASON FOR CLOSURE]
no fault on Lumen

[ROOT CAUSE]
customer/ destination host network
--- cut ---

Looks like Lumen doesn't treat the absence of prefix filters as their fault...

--
Töma