North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

YouTube IP Hijacking

  • From: Sargun Dhillon
  • Date: Sun Feb 24 15:29:26 2008

As you guys probably know Youtube's IP's are being hijacked. Trace:
~ $ host has address has address has address
[Same /24]

701 3491 17557 (metric 1) from (
      Origin IGP, metric 100, localpref 100, valid, external
      Community: 65010:300
      Last update: Sun Feb 24 11:33:05 2008 [PST8PDT]
3491 17557 from (
      Origin IGP, metric 100, localpref 100, valid, external, best
      Last update: Sun Feb 24 10:47:57 2008 [PST8PDT]

So, it seems that youtube's ip block has been hijacked by a more
specific prefix being advertised. This is a case of IP hijacking, not
case of DNS poisoning, youtube engineers doing something stupid, etc.
For people that don't know. The router will try to get the most specific
prefix. This is by design, not by accident. This is a case of censorship
on the internet. Anyways, I hope this doesn't get into a political
situation, and someone stops this.

 What action are you going to take? Are you going to filter
announcements from AS17557, or just filter that specific announcement?
Considering youtube is a fairly high-traffic website I think that other
operators are just going to start filtering that AS. This is a great
example of global politics getting in the way of honest corporatism.
This is also an example of how vulnerable the internet is, and how lax
providers are in their filtering policies. I don't know how large
Pakistani Telecom is, but it I bet its not large enough that PCCW should
be allowing it to advertise anything.