RE: YouTube IP Hijacking

Not if the hijackers have advertised a /24.  Anything you
advertise more
specific than /24 will be lost on many networks' filters.


-----Original Message-----
From: owner-nanogmerit.edu [mailto:owner-nanogmerit.edu] On Behalf Of
Tomas L. Byrnes
Sent: Monday, 25 February 2008 8:49 AM
To: Michael Smith; neil.fenemorfx.net.nz
Cc: willharg.net; nanogmerit.edu
Subject: RE: YouTube IP Hijacking


Which means that, by advertising routes more specific than
the ones they
are poisoning, it may well be possible to restore universal
connectivity
to YouTube.

 

> -----Original Message-----
> From: Michael Smith [mailto:msmithinternap.com] 
> Sent: Sunday, February 24, 2008 1:23 PM
> To: neil.fenemorfx.net.nz; Tomas L. Byrnes
> Cc: willharg.net; nanogmerit.edu
> Subject: Re: YouTube IP Hijacking
> 
> Exactly... They inadvertently made the details of their

> oppression more readily apparent...
> 
> 
> ----- Original Message -----
> From: owner-nanogmerit.edu <owner-nanogmerit.edu>
> To: Tomas L. Byrnes <tombbyrneit.net>
> Cc: Will Hargrave <willharg.net>; nanogmerit.edu
<nanogmerit.edu>
> Sent: Sun Feb 24 16:00:35 2008
> Subject: Re: YouTube IP Hijacking
> 
> 
> While they are deliberately blocking Youtube
nationally, I 
> suspect the wider issue has no malice, and is a case of

> poorly constructed/ implemented  outbound policies on
their 
> part, and poorly constructed/ implemented inbound
polices on 
> their upstreams part.
> 
> On 25/02/2008, at 9:49 AM, Tomas L. Byrnes wrote:
> 
> >
> > Pakistan is deliberately blocking Youtube.
> >
> > http://politics.slashdot.org/article.pl?sid=08/02/24
/1628213
> >
> > Maybe we should all block Pakistan.
> >
> >
> >
> >> -----Original Message-----
> >> From: owner-nanogmerit.edu
[mailto:owner-nanogmerit.edu] 
> On Behalf 
> >> Of Will Hargrave
> >> Sent: Sunday, February 24, 2008 12:39 PM
> >> To: nanognanog.org
> >> Subject: Re: YouTube IP Hijacking
> >>
> >>
> >> Sargun Dhillon wrote:
> >>
> >>> So, it seems that youtube's ip block has
been hijacked by a more 
> >>> specific prefix being advertised. This is
a case of IP
> >> hijacking, not
> >>> case of DNS poisoning, youtube engineers
doing something
> >> stupid, etc.
> >>> For people that don't know. The router
will try to get the most 
> >>> specific prefix. This is by design, not by
accident.
> >>
> >> You are making the assumption of malice when
the more 
> likely cause is 
> >> one of accident on the part of probably
stressed NOC staff 
> at 17557.
> >>
> >> They probably have that /24 going to a gateway
walled garden box 
> >> which replies with a site saying 'we have
banned this', 
> and that /24 
> >> route is leaking outside of their AS via PCCW
due to dodgy 
> >> filters/communities.
> >>
> >> Will
> >>
> 
> Neil Fenemor
> FX Networks
> 
> 
>