Hi all, Perhaps another explanation is that these are router2router linknets between the involved parties, and all we are seeing is the effect of "redistribute connected". If this is the case, the word "hijack" might be somewhat strong worded. Kind regards, Job On Sat, 1 Apr 2017 at 23:25, Tyler Conrad <tyler@tgconrad.com> wrote: So not only are they hijacking prefixes, they're leaking the /30s to their peers. Failure through and through. On Saturday, April 1, 2017, George William Herbert <george.herbert@gmail.com

wrote:

Hey, Bharti, knock that off.

http://bgpstream.com/event/78126 http://bgpstream.com/event/78125 http://bgpstream.com/event/78124 http://bgpstream.com/event/78123 http://bgpstream.com/event/78122

Sent from my iPhone

I would (from a peering perspective) see this as a configuration error where somebody/someone botched a configuration change in a specific network router. Partly because a) seeing as the reports is sequentially numbered, b) as - already pointed out - it is either /30 or /29. c) thou I'm puzzled about the /27 leaked https://bgpstream.com/event/78122 Somebody noticed, somebody or another fixed the error in silence and said nothing afterwards. Sadly, No route-maps or the like were in place to prevent the prefix leaks from happening. That in it-self should be stuff for the people at Origin ASN 9498 (BHARTI Airtel Ltd.) to think a little "harder" about in the future. "Routers mostly only fail because of the selected many people managing them." Kind regards, Christoffer, CH11404-RIPE On 2 April 2017 at 00:09, Youssef Bengelloun-Zahr <bengelly@gmail.com> wrote:

Hi,

What's more concerning here is that those prefixes were able to pass through all filters on their way, via their transits and maybe probably via their peers as well. Haven't we been here before !?!

And here I thought 2017 internet would be a "safer" place. Silly me...

Y.

...

Le 1 avr. 2017 à 23:33, Job Snijders <job@instituut.net> a écrit :

Hi all,

Perhaps another explanation is that these are router2router linknets between the involved parties, and all we are seeing is the effect of "redistribute connected". If this is the case, the word "hijack" might be somewhat strong worded.

Kind regards,

Job

On Sat, 1 Apr 2017 at 23:25, Tyler Conrad <tyler@tgconrad.com> wrote:

So not only are they hijacking prefixes, they're leaking the /30s to their peers. Failure through and through.

On Saturday, April 1, 2017, George William Herbert <george.herbert@gmail.com wrote:

...

Hey, Bharti, knock that off.

http://bgpstream.com/event/78126 http://bgpstream.com/event/78125 http://bgpstream.com/event/78124 http://bgpstream.com/event/78123 http://bgpstream.com/event/78122

Sent from my iPhone