“Today we observed a large-scale ‘hijack’ event that affected many of the prefixes on the Internet. This blog post is to provide you with some additional information. Indosat, AS4761, one of Indonesia’s largest telecommunication networks normally originates about 300 prefixes. Starting at 18:26 UTC (April 2, 2014) AS4761 began to originate 417,038 new prefixes normally announced by other Autonomous Systems such as yours.”
Rather see ▻http://seenthis.net/messages/243546 for a discussion
Indosat AS4761 hijacked 400k+ prefixes on April 2, 2014
►http://www.bgpmon.net/hijack-event-today-by-indosat
Indosat, AS4761, one of Indonesia’s largest telecommunication networks normally originates about 300 prefixes. Starting at 18:26 UTC (April 2, 2014) AS4761 began to originate 417,038 new prefixes normally announced by other Autonomous Systems such as yours. The ‘mis-origination’ event by Indosat lasted for several hours affecting different prefixes at different times until approximately 21:15 UTC.
It appears our AS was affected as well (between 19:33 and 20:23), but I am a bit suspicious as I cannot corroborate this info with other sources than bgpmon.net
Any reference I find traces back to bgpmon. (and I cannot read Indonesian).
No Waldo here:
▻https://radar.qrator.net/general/?asnum=4761
Perhaps @Stephane Bortzmeyer has an opinion on this ?
Autres sources que découlant de bgpmon ?
paranoïa über alles : from the bgpmon service:
Users with a premium account also have access to all the individual BGP updates as well as the full AS path. This will tell you in detail what networks selected this bad route and the exact timestamps. Some of you also received a phone call to inform you of the events immideatly after detection (part of the Enterprise add-on).
I see the same thing. Probably, the leak was filtered out by Indosat’s upstream providers and received only by one BGPmon probe. ("Detected by #peers: 1" in the message I received from BGPmon.)
However, on the NANOG mailing list, there was also a testimony that it was also seen through RIS and that one Route-Views collector, 64.25.208.71 “has seen updates that contains large amount of prefixes at time 1396464452 (04 / 02 / 14 @ 6:47:32pm UTC) with path [20225, 6939, 4761]”
Besides disrupting Akamai themselves, this routing leak completely took out Indosat in what amounted to a self-inflicted DDoS attack
:D
some instructive graphs in that article, and a valuable conclusion.
Enterprises also need to carefully police their own routing policies and understand how the world reaches them.
so true.