Traffic Engineering Legitimacy

Technical argument that AS prepending is common practice for traffic management and the anomalies may be entirely routine

While some observers speculate that high-profile BGP anomalies could facilitate state-sponsored intelligence gathering, technical experts argue that AS prepending is a routine traffic engineering tool used to de-prioritize specific routes. In the case of the CANTV incident, the extreme prepending likely points to a benign misconfiguration rather than a malicious hijack, as making a path less attractive is counterintuitive for an entity seeking to intercept data. Ultimately, these perspectives suggest that such routing fluctuations are often just mundane, daily occurrences in the complex landscape of global network management.

View on HN · Topics

> When BGP traffic is being sent from point A to point B, it can be rerouted through a point C. If you control point C, even for a few hours, you can theoretically collect vast amounts of intelligence that would be very useful for government entities. The CANTV AS8048 being prepended to the AS path 10 times means there the traffic would not prioritize this route through AS8048, perhaps that was the goal?

AS prepending is a relatively common method of traffic engineering to reduce traffic from a peer/provider. Looking at CANTV's (AS8048) announcements from outside that period shows they do this a lot.

Since this was detected as a BGP route leak, it looks like CANTV (AS8048) propagated routes from Telecom Italia Sparkle (AS6762) to GlobeNet Cabos Sumarinos Columbia (AS52320). This could have simply been a misconfiguration.

Nothing nefarious immediately jumps out to me here. I don't see any obvious attempts to hijack routes to Dayco Telecom (AS21980), which was the actual destination. The prepending would have made traffic less likely to transit over CANTV assuming there was any other route available.

The prepending done by CANTV does make it slightly easier to hijack traffic destined to it (though not really to Dayco), but that just appears to be something they just normally do.

This could be CANTV trying to force some users of GlobeNet to transit over them to Dayco I suppose, but leaving the prepending in would be an odd way of going about it. I suppose if you absolutely knew you were the shortest path length, there's no reason to remove the prepending, but a misconfiguration is usually the cause of these things.

View on HN · Topics

This doesn't look like anything malicious, 8048 is just prepending these announcements to 52320.. If anything, it looks like 269832(MDS) had a couple hits to their tier 1 peers which caused these prepended announcements to become more visible to collectors.

View on HN · Topics

There are BGP anomalies every day.

Summarizer