How was the state of the Internet’s routing system in 2017? Let’s take a look back using data from BGPStream. Some highlights:

• 13,935 total incidents (either outages or attacks like route leaks and hijacks)

• Over 10% of all Autonomous Systems on the Internet were affected

• 3,106 Autonomous Systems were a victim of at least one routing incident

• 1,546 networks caused at least one incident

An ‘incident’ is a suspicious change in the state of the routing system that can be attributed to an outage or a routing attack, like a route leak or hijack (either intentional or due to a configuration mistake). BGPStream is an operational tool that tries to minimize false positives, so the number of incidents may be on the low side. Let’s look at just a few examples of incidents picked up by the media.

March 2017 – SECW Telecom in Brazil hijacked prefixes of Cloudflare, Google, and BancoBrazil causing some outage for these services in the region.

April 2017 – Large chunks of network traffic belonging to MasterCard, Visa, and more than two dozen other financial services companies were briefly routed through a Russian telecom. For several minutes, Rostelecom was originating 50 prefixes for numerous other Autonomous Systems, hijacking their traffic.

August 2017 – Google accidentally leaked BGP prefixes it learned from peering relationships, essentially becoming a transit provider instead of simply exchanging traffic between two networks and their customers, causing large-scale internet disruption. It hit Japanese users the hardest, slowing or blocking access to websites and online services for dozens of Japanese companies.

October 2017 – Another BGP mishap caused reachability and performance problems for networks such as Twitter, Google, and others. For almost 20 minutes, traffic for many large CDNs was rerouted through Brazil, caused by a BGP leak.BGP mishap caused reachability and performance problems for networks such as Twitter, Google, and others. For almost 20 minutes, traffic for many large CDNs was rerouted through Brazil, caused by a BGP leak.

November 2017 – Leve3 BGP routing issues causing large scale network service degradation in North America for slightly more than 90 minutes. Another route leak.

December 2017 – Several high-profile sites (Google, Apple, Facebook, Microsoft, Twitch, NTT Communications and Riot Games) were rerouted to a previously unused Russian AS. Two BGP routing incidents only lasted about three minutes each.

Not a single day passed without an incident. While none of the incidents was catastrophic, all of them continue to demonstrate the lack of routing controls like those called for in MANRS that could have prevented them from happening.

And this is just a small fraction of what happened in the routing system in 2017. Rather than measure routing security by anecdotal evidence, let’s look at the data.

Routing Incidents

Of the 13,935 total incidents, 62% were classified as outages and 38% were considered routing attacks like route leaks and hijacks. These statistics are only counting the number of incidents and not factoring in duration or number of prefixes affected, which may indicate the impact of these incidents.

6,128 Autonomous Systems were involved, which is more that 10% of all announced ASNs on the Internet. If we look at the outages, almost half of them happened to Brazilian operators.

Let us look to incidents that represent a potential attack, be it malice or a configuration mistake. It is interesting to analyze such routing incidents by the roles a network played—whether it was a victim, a culprit, or an accomplice.

The U.S. ranks first among countries where networks became a victim of an incident, for example when a network’s prefix is hijacked. Last year that happened 1,193 times in the U.S. It is followed by Brazil (450), India (299), and Russia (242).

Unsurprisingly, the majority of the networks victimized by the most incidents are based in the U.S. In total 3,106 Autonomous Systems were victims of at least one routing incident in 2017.

U.S. and Brazil, followed by Russia and China, lead the list of countries in which networks caused incidents. They are responsible for more that 75% of all incidents. Overall, 1,546 networks caused at least one incident during 2017.

The ranking is different when it comes to the top 10 guilty networks. An interesting case is AS198949 - SecurityDAM, responsible for 54 incidents, mostly prefix hijacks. This is a security provider, offering DDoS attack mitigation among other services. Most probably these incidents were part of attack mitigation actions. Since the BGPStream only registers suspicious routing changes, without knowing intent in some cases, it is impossible to distinguish an attack from a legitimate (or consented) routing change.

The U.S. also leads the list of countries with networks that could have prevented an attack but didn’t, such as not filtering false routing announcements from their customers (one of MANRS Actions). The usual suspects—Russia, Brazil, and China—follow.

In the end, I’d like to note that absolute numbers tell only part of the story. They need to be put into perspective. Countries and networks differ significantly in terms of connected users, announced prefixes, etc. The numbers in this report are not normalized by any of these metrics, but to give an idea, let’s look at the fraction of advertised network in a country that caused a route leak or a hijack.

This chart may say more about the attitude of a particular networking community regarding routing security and implementation of best practices. The ranking is different here, bringing Hong Kong, Iran and Brazil to the top of the chart.(For advertised AS’s we used data available at http://resources.potaroo.net/iso3166/regiontablecc.html.)

Another point is that it is hard to say whether these numbers are OK, or really bad. Is the system improving or getting worse? The statistics in this report will be a good basis for a trend analysis in years to come.

How can we improve?

More than 5% of all networks advertised on the Internet became a victim of a route hijack or a leak. Another 4% of all networks caused these incidents or did not prevent them from their direct customers. The rest propagated them, spreading the incidents regionally or globally. The victims and culprits often have no direct relationships and operate independently in different parts of the globe.

There is no easy solution to this problem, but simple measures of basic routing hygiene could have prevented the majority of these incidents from happening. MANRS, an industry-driven initiative supported by the Internet Society, provides an opportunity to strengthen the community of security-minded operators and instigate a cultural change. The more service providers apply these minimum actions, the fewer incidents there will be, and the less damage they can do.

There are four MANRS Actions:

• Filtering – Ensure the correctness of your own announcements and of announcements from your customers to adjacent networks with prefix and AS-path granularity
• Anti-spoofing – Enable source address validation for at least single-homed stub customer networks, your own end-users, and infrastructure
• Coordination – Maintain globally accessible up-to-date contact information
• Global Validation – Publish your data, so others can validate routing information on a global scale

Maintaining up-to-date filters for customer announcements could mitigate many route leaks. Preventing address squatting could help ward off things like spam and malware. Keeping complete and accurate routing policy data in Internet Routing Registry (IRR) or Resource Public Key Infrastructure (RPKI) repositories are essential for global validation that helps prevent BGP prefix hijacking. Having updated contact information is vital to solving network emergencies quickly.

Let us hope we will see more network operators joining MANRS, and improvements in routing security in 2018. Happy New Year!

A slightly modified version of this post originally appeared on the MANRS site.