Hacker News Reader

This says the prefix being announced by two ASNs is only a /24, which is kind of narrow for a hijack? Considering the countries involved, reporting this as a hijack will inevitably lead to people assuming it is related to the current conflict.

View on HN

A /24 wouldn't propagate much farther than the nearest IX and immediate peers, as presumably peers have learned to aggregate and filter in the last 20 years. At face value, it really seems like a shift to backup routes. Also, state level attacker view, hijacking a route from another ASN is a bit 3rd world, as if you were a superpower, you'd have already hacked the routers in question and would just loop traffic through and MPLS tunnel to your analysis centre.

> A /24 wouldn't propagate much farther than the nearest IX and immediate peers, as presumably peers have learned to aggregate and filter in the last 20 years.

... and yet the global BGP table is absolutely full of /24s.

AS212463 only announces 2 /24 prefixes in total so it being only 1 isn't a big sway one way or the other. The company being the same just across the 2 countries makes it less likely to be something militarily malicious but doesn't necessarily mean it's unrelated to the current conflict.

Reply on news.ycombinator.com