BGP Hijacking and Route Leaks: Why We Keep Saying the Same Thing
Yes, we are repeating ourselves. On purpose.
Every route leak and hijack that makes the news is a reminder that most of the protection is free, and most of it is still not deployed. So we will keep saying it until it is.
No single layer catches everything. ROAs and ROV stop routes with the wrong origin. ASPA catches forged paths and leaks that ROV still calls valid. IRR prefix lists and max-prefix limit what each neighbour can send you. Together they cover each other’s blind spots.
And the effort is smaller than most people assume:
– Publishing ROAs, and an ASPA object where your RIR supports it, takes minutes in the RIR portal.
– Spinning up Routinator and feeding validated data to your routers takes minutes too.
– IRR-based prefix lists take a little more work, but tools like bgpq4 generate them in seconds.
– If you are heavily peered, a few hours deploying Peering Manager lets you automate sessions and filters end to end.
One mistake to avoid when you switch ROV on: do not just lower the local-preference of invalid routes. A hijacked /24 carved out of your /22 has nothing else to compete with, so it still wins best-path, and longest-prefix match sends the traffic to the hijacker. Local-pref decides between equals. It never outranks a more specific route. Depref is fine as a short observation phase. Drop is the actual protection.
Which of these is still on your “next quarter” list?
