Hacker News Reader

Comment by ahmedalsudani | Hacker News Reader

It should be clarified the vulnerability was not on Google's end. It's the sort of thing we're used to by now: misconfigured/malicious BGP routes.

View on HN

If google advertised several /24 for these ip networks instead of /19, this would have not happenned.

Is that a best practice though? Wouldn't the BGP tables get pretty big if everyone did that?

They would, and we would probably see a repeat of this: https://bgpmon.net/what-caused-todays-internet-hiccup/

Ugh, old Cisco trash

Didn’t Pakistan advertise a /28 at one point that blackholed YouTube?

Good times. (/s)

I believe there are routers that break at around 1M ipv4 entries, and we're at ~700k now.

https://www.cidr-report.org/cgi-bin/plota?file=%2fvar%2fdata...

Wow - it's really gone up in the last couple of years. I think it was at 550k last time I had access to an edge router.

Now that other ISP would advertise Googles /24's, it doesn't help.

Advertising every /24 within a /19 - would that take exactly 32 route advertisements?

You are correct.

24-19 = 5 bits. 2^5 = 32

And if everyone advertised /24s instead of larger aggregate networks, routers would have to store about 12 million routes. Better yet, why not just advertise a /32 for every IP address?

Most routers would crash and the internet would stop long before we ever got to 12 million routes.

That's a lot of words to say that BGP is outdated.

How would an alternative deal with that problem ?

Some /24 are more critical than other. There is a price to security and for sure advertising only /24 is probably not viable.

The article mentionned that some networks within the /19, in this incident, were critical. So yes, I believe that every businesses should advertise /24 for their highly critical infra. They can advertise /19, /20 and so on for the less important networks. No need to use /24 for everything.

A valid point that I thought you might have meant after re-reading your post a couple of times.

Sorry for the quick-fire snark.

It would have happened, and not even doing it as a mitigation would've worked, as the offending ISP would've re-advertised the same routes as google shortly after google changed it.

Reply on news.ycombinator.com