What is the difference between a BGP hijack and a route leak? Give an example.
Show the answer
Say this first
A hijack is announcing address space you do not hold: the exact prefix, which splits traffic based on AS path, or a more specific one, which wins everywhere because of longest match. A route leak is announcing real routes beyond their intended scope, typically a customer passing routes from one provider to another (RFC 7908). The classic hijack: in February 2008 Pakistan Telecom announced a more specific part of YouTube's address block to block YouTube inside Pakistan, its upstream propagated it, and YouTube was unreachable for much of the internet for about two hours.
Go deeper
How they differ
| Hijack | Leak | |
|---|---|---|
| Origin AS | Wrong, or forged | Correct |
| Usual cause | Mistake or malice | Policy mistake |
| Main defences | RPKI origin validation, prefix filters built from IRR and ROA data | Customer prefix filters, maximum-prefix, BGP roles (RFC 9234), ASPA |
A well-known leak
In June 2019 a BGP optimizer at a small ISP generated more specific routes meant for internal use. A customer of that ISP leaked them to its other provider, Verizon, which accepted and propagated them. Traffic for Cloudflare and others was pulled through the small networks for a couple of hours.
The valley-free rule behind leaks
Routes from customers may be sent to everyone. Routes from peers and providers may be sent only to customers. A leak breaks that rule, for example provider routes sent to another provider.
If someone hijacks your prefix
- Confirm with external views: BGP monitoring alerts, RIPE RIS, looking glasses.
- Announce more specifics if the hijack is shorter than /24, so you win by longest match.
- Contact the offending network and its upstreams, and your own providers.
- Make sure your ROAs exist, so networks that drop Invalid routes ignore the hijack.
They will ask next
Why is a more specific hijack so effective?
Routers forward on longest match before BGP preferences matter. A /24 inside your /22 attracts that traffic from every network that accepts it, whatever their path preferences.
What does RFC 9234 add?
BGP roles (provider, customer, peer, route server) negotiated in the OPEN, and the Only to Customer attribute, so routers can detect and stop leaks automatically.
Traps
- Claiming RPKI origin validation solves route leaks. In a leak the origin is correct, so the routes are Valid.