[102653] in North American Network Operators' Group
Re: YouTube IP Hijacking
daemon@ATHENA.MIT.EDU (Will Hargrave)
Sun Feb 24 15:45:54 2008
Date: Sun, 24 Feb 2008 20:38:34 +0000
From: Will Hargrave <will@harg.net>
To: nanog@nanog.org
In-Reply-To: <47C1D331.7000003@decarta.com>
Errors-To: owner-nanog@merit.edu
Sargun Dhillon wrote:
> So, it seems that youtube's ip block has been hijacked by a more
> specific prefix being advertised. This is a case of IP hijacking, not
> case of DNS poisoning, youtube engineers doing something stupid, etc.
> For people that don't know. The router will try to get the most specific
> prefix. This is by design, not by accident.
You are making the assumption of malice when the more likely cause is
one of accident on the part of probably stressed NOC staff at 17557.
They probably have that /24 going to a gateway walled garden box which
replies with a site saying 'we have banned this', and that /24 route is
leaking outside of their AS via PCCW due to dodgy filters/communities.
Will
