Re: RIPE NCC publishes case study of youtube.com hijack

2008-02-29 Thread Danny McPherson
On Feb 29, 2008, at 11:49 AM, David Ulevitch wrote: Of course... In fact, wouldn't it even providers benefit from having some logic that says "don't ever accept a more specific of a customer-announced prefix?" Sure, that'd suck less, I guess, although then you have to punch holes for mul

Re: RIPE NCC publishes case study of youtube.com hijack

2008-02-29 Thread David Ulevitch
Danny McPherson wrote: On Feb 29, 2008, at 7:46 AM, David Ulevitch wrote: It's worth noting that from where I sit, it appears as though none of Youtube's transit providers accepted this announcement. Only their peers. A simple artifact of shortest AS path route selection. Well, we (yout

Re: RIPE NCC publishes case study of youtube.com hijack

2008-02-29 Thread Jeff Aitken
On Fri, Feb 29, 2008 at 06:46:15AM -0800, David Ulevitch wrote: > The point is -- Restrictive customer filtering can also bite you in the > butt. Trying to require your providers to do a "ge 19 le 25" (or > whatever your largest supernet is), rather than filters for specific > prefix sizes see

Re: RIPE NCC publishes case study of youtube.com hijack

2008-02-29 Thread Danny McPherson
On Feb 29, 2008, at 7:46 AM, David Ulevitch wrote: The report states: Sunday, 24 February 2008, 20:07 (UTC): AS36561 (YouTube) starts announcing 208.65.153.0/24. With two identical prefixes in the routing system, BGP policy rules, such as preferring the shortest AS path, determine whi

Re: RIPE NCC publishes case study of youtube.com hijack

2008-02-29 Thread David Ulevitch
The report states: Sunday, 24 February 2008, 20:07 (UTC): AS36561 (YouTube) starts announcing 208.65.153.0/24. With two identical prefixes in the routing system, BGP policy rules, such as preferring the shortest AS path, determine which route is chosen. This means that AS17557 (Pakistan Telecom

RIPE NCC publishes case study of youtube.com hijack

2008-02-29 Thread Tom Quilling
for those interested in the matter tom Dear Colleagues, As you may be aware from recent news reports, traffic to the youtube.com website was 'hijacked' on a global scale on Sunday, 24 February 2008. The incident was a result of the unauthorised announcement of the prefix 208.65.153.0/24