Hacker News Reader

Comment by lgierth | Hacker News Reader

It's not neccessarily AS4812 / China Telecom announcing this themselves. Anyone could be announcing AS4812,192.208.19.0/24. For some degree of attribution, you need to go and figure out where the actual announcement is coming from.

The "beauty" of BGP :)

edit: It's also interesting to note that the bogus announcement is for /24, which is more specific than the original /23, so it takes precedence.

View on HN

For reference, the path observed by BGPMon was:

  11039 The George Washington University
  46887 Lightower Fiber Networks I, LLC
  6939 Hurricane Electric LLC
  4134 China Telecom Backbone
  4134 China Telecom Backbone
  4134 China Telecom Backbone
  4812 China Telecom (Group)

Hurricane Electric has been known to not apply route filters to large peers, leading to hijacks like this. I suspect that was the case here, too. Although you are right, this path could have been spoofed by GWU or Lightower (or BGPMon!)

Reply on news.ycombinator.com