Re: [BGP Hijack] AS202734 - Follow-up on the HE-only visibility

Yanzheng,

Thank you for this clarification. This is the missing piece I've been 
trying to find.

So, to restate what you're saying, the 3,948 bogon routes were real 
(AS202734 did import them into its BGP table), but they were only leaked 
to HE's collector(s) and not propagated to the global DFZ. This explains 
the discrepancy between HE and RIPE RIS data perfectly.

This also answers Charlie's question about "propagation" — it wasn't 
global, but it was targeted (at route collectors).

I have a few follow-up questions, purely for my own technical 
understanding:

1. How common is it for an ASN to use a route collector session (like 
HE's) for "internal routing experiments" without proper outbound 
filters? Is this considered a best practice, or a known risk?

2. Does the fact that the leaked prefixes included specific, sensitive 
Chinese carrier space (e.g., China Telecom's 125.104.0.0/13) change 
anything about how this "experiment" should be viewed?

3. How can the community (or HE) prevent similar "collector-only leaks" 
from being used to generate misleading bogon alerts in the future?

Again, thank you for helping me understand the operational reality 
behind the data.

me
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/[email protected]/message/PXWXVJASN5X3FDFBZ76NPLIR2IIN54TM/