"I Didn't Mean to Tell You That"
A Route Hijack is claiming you own an IP block you don't. A Route Leak is different: you claim you know the path to a destination, and that claim is technically true — but you are not supposed to be advertising that path to certain neighbors.
The Classic Route Leak Scenario:
Imagine a small regional ISP (AS 65100) that buys transit from two large providers: Provider A (AS 1000) and Provider B (AS 2000). The small ISP learns routes from both providers. The correct behavior is:
- Advertise the small ISP's own customer routes to both providers.
- Do not advertise Provider A's routes to Provider B (or vice versa).
If the small ISP's router is misconfigured and leaks Provider A's routes to Provider B, Provider B thinks: "Great, I can reach Provider A's customers through this small ISP!" Provider B starts sending traffic through the small ISP. The small ISP's 1 Gbps uplink is suddenly carrying terabytes of transit traffic between two giants. The small ISP's network collapses, and Provider B's customers lose connectivity to Provider A's network.
Real-World Example — Cloudflare/Verizon/Allegheny, 2019:
A small Pennsylvania ISP (Allegheny Technologies) leaked approximately 20,000 routes to Verizon. Verizon, lacking proper route filtering, accepted and propagated these routes. Cloudflare, AWS, and many other major services became unreachable for portions of the internet for several hours.
Prevention Mechanisms:
| Mechanism | How It Works |
|---|---|
| BGP Communities | Tag routes with metadata indicating their origin type (customer, peer, upstream). Routers use these tags to enforce export policies. |
| AS-PATH Filtering | Reject routes whose AS-PATH contains ASNs that should not be transiting your network. |
| Prefix Limits | Set a maximum number of routes you will accept from a peer. If a peer suddenly advertises 20,000 more routes than expected, shut down the session. |
| RPKI ROV | Catches hijacks but not leaks directly — a leaked route from the correct ASN is still Valid under RPKI. |
| BGP Roles (RFC 9234) | A newer mechanism where BGP peers negotiate their relationship (customer/provider/peer) and routers automatically enforce correct export behavior. |
The critical insight: RPKI does not prevent route leaks. A leaked route from the correct ASN will still show as Valid or NotFound. Route leaks require separate filtering mechanisms, particularly strict BGP community policies and prefix limits.