<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-cite-prefix">On 21/11/2018 5:42 PM, Grahame Lynch
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CACUGddGSQCo-Y45mMzZpqoYEF5jM7+YBWxpZ0beQfdV33LoyYA@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=utf-8">
      <div dir="ltr">How much of this is "hijacking" and how much is
        just "least cost routing"? It is really hard to tell.</div>
    </blockquote>
    Its not 'least cost routing', BGP doesn't work like that, unless the
    target networks really were customers of China Telecom, or
    customers-of-a-customer.<br>
    China Telecom must have started advertising that those networks were
    reachable, and then stopped advertising, for the traffic to be sent
    into their network in the first place.<br>
    <br>
    This can happen by accident/incompetence/error, although that
    usually results in the affected site being blackholed - thats what
    happened with the Telstra BGP hijack of prefixes recently.  In this
    'diversion' case the traffic is being rerouted and eventually
    finding its way back out of the network and forwarded to the
    original destination - that is more difficult to make happen by
    accident.<br>
    <br>
    Its arguably laziness on the part of the other networks that China
    Telecom interconnects BGP with - peers, upstreams, and customers -
    although to be fair the various proposals for validating BGP route
    advertising permissions is not widely deployed and still being
    developed.<br>
    <br>
    Most ISPs filter BGP routing advertisements from customers, but very
    few filter route advertisements from upstreams and peers.<br>
    Securing BGP is a hot topic in recent years, but is taking a long
    long time to get critical mass.<br>
    <br>
    Everyone running BGP-4 should take a look at:<br>
    <ul>
      <li>MANRS (Mutually Agreed Norms for Routing Security -
        <a class="moz-txt-link-freetext" href="https://www.internetsociety.org/issues/manrs">https://www.internetsociety.org/issues/manrs</a>)</li>
      <li>RFC7454 = BCP-194 - BGP Operations and Security -
        <a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/rfc7454">https://tools.ietf.org/html/rfc7454</a></li>
      <li>NIST "Protecting the Integrity of Internet Routing: Border
        Gateway Protocol (BGP) Route Origin Validation",
        <a class="moz-txt-link-freetext" href="https://csrc.nist.gov/publications/detail/sp/1800-14/draft">https://csrc.nist.gov/publications/detail/sp/1800-14/draft</a></li>
    </ul>
    ...and plan to implement RPKI for all your routes.<br>
    <br>
    Paul.<br>
    <br>
    <blockquote type="cite"
cite="mid:CACUGddGSQCo-Y45mMzZpqoYEF5jM7+YBWxpZ0beQfdV33LoyYA@mail.gmail.com"><br>
      <div class="gmail_quote">
        <div dir="ltr">On Wed, 21 Nov 2018 at 17:38, Christian Heinrich
          <<a href="mailto:christian.heinrich@cmlh.id.au"
            moz-do-not-send="true">christian.heinrich@cmlh.id.au</a>>
          wrote:<br>
        </div>
        <blockquote class="gmail_quote" style="margin:0 0 0
          .8ex;border-left:1px #ccc solid;padding-left:1ex">Has anyone
          observed<br>
          <a
href="https://www.smh.com.au/technology/how-china-diverts-then-spies-on-australia-s-internet-traffic-20181120-p50h80.html"
            rel="noreferrer" target="_blank" moz-do-not-send="true">https://www.smh.com.au/technology/how-china-diverts-then-spies-on-australia-s-internet-traffic-20181120-p50h80.html</a><br>
          or not?<br>
          <br>
          -- <br>
          Regards,<br>
          Christian Heinrich<br>
          <br>
          <a href="http://cmlh.id.au/contact" rel="noreferrer"
            target="_blank" moz-do-not-send="true">http://cmlh.id.au/contact</a><br>
          _______________________________________________<br>
          AusNOG mailing list<br>
          <a href="mailto:AusNOG@lists.ausnog.net" target="_blank"
            moz-do-not-send="true">AusNOG@lists.ausnog.net</a><br>
          <a href="http://lists.ausnog.net/mailman/listinfo/ausnog"
            rel="noreferrer" target="_blank" moz-do-not-send="true">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
        </blockquote>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
    </blockquote>
    <p><br>
    </p>
  </body>
</html>