[102665] in North American Network Operators' Group
RE: YouTube IP Hijacking
daemon@ATHENA.MIT.EDU (Tomas L. Byrnes)
Sun Feb 24 17:02:32 2008
Date: Sun, 24 Feb 2008 13:49:00 -0800
In-Reply-To: <D1E73DBA7BDE4E42BCEE7BC6518C1BA50C2BB8@cx48.800onemail.com>
From: "Tomas L. Byrnes" <tomb@byrneit.net>
To: "Michael Smith" <msmith@internap.com>, <neil.fenemor@fx.net.nz>
Cc: <will@harg.net>, <nanog@merit.edu>
Errors-To: owner-nanog@merit.edu
Which means that, by advertising routes more specific than the ones they
are poisoning, it may well be possible to restore universal connectivity
to YouTube.
=20
> -----Original Message-----
> From: Michael Smith [mailto:msmith@internap.com]=20
> Sent: Sunday, February 24, 2008 1:23 PM
> To: neil.fenemor@fx.net.nz; Tomas L. Byrnes
> Cc: will@harg.net; nanog@merit.edu
> Subject: Re: YouTube IP Hijacking
>=20
> Exactly... They inadvertently made the details of their=20
> oppression more readily apparent...
>=20
>=20
> ----- Original Message -----
> From: owner-nanog@merit.edu <owner-nanog@merit.edu>
> To: Tomas L. Byrnes <tomb@byrneit.net>
> Cc: Will Hargrave <will@harg.net>; nanog@merit.edu <nanog@merit.edu>
> Sent: Sun Feb 24 16:00:35 2008
> Subject: Re: YouTube IP Hijacking
>=20
>=20
> While they are deliberately blocking Youtube nationally, I=20
> suspect the wider issue has no malice, and is a case of=20
> poorly constructed/ implemented outbound policies on their=20
> part, and poorly constructed/ implemented inbound polices on=20
> their upstreams part.
>=20
> On 25/02/2008, at 9:49 AM, Tomas L. Byrnes wrote:
>=20
> >
> > Pakistan is deliberately blocking Youtube.
> >
> > http://politics.slashdot.org/article.pl?sid=3D08/02/24/1628213
> >
> > Maybe we should all block Pakistan.
> >
> >
> >
> >> -----Original Message-----
> >> From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]=20
> On Behalf=20
> >> Of Will Hargrave
> >> Sent: Sunday, February 24, 2008 12:39 PM
> >> To: nanog@nanog.org
> >> Subject: Re: YouTube IP Hijacking
> >>
> >>
> >> Sargun Dhillon wrote:
> >>
> >>> So, it seems that youtube's ip block has been hijacked by a more=20
> >>> specific prefix being advertised. This is a case of IP
> >> hijacking, not
> >>> case of DNS poisoning, youtube engineers doing something
> >> stupid, etc.
> >>> For people that don't know. The router will try to get the most=20
> >>> specific prefix. This is by design, not by accident.
> >>
> >> You are making the assumption of malice when the more=20
> likely cause is=20
> >> one of accident on the part of probably stressed NOC staff=20
> at 17557.
> >>
> >> They probably have that /24 going to a gateway walled garden box=20
> >> which replies with a site saying 'we have banned this',=20
> and that /24=20
> >> route is leaking outside of their AS via PCCW due to dodgy=20
> >> filters/communities.
> >>
> >> Will
> >>
>=20
> Neil Fenemor
> FX Networks
>=20
>=20
>=20
