264462 massive route leak

In the morning of Tuesday, July 21 a Brazilian AS 264462 belonging to “Comercial Conecte Sem Fio Ltda me” as it is stated in the whois record for this particular ASN, leaked massive 13046 network prefixes in a networking incident that lasted for 1 hour and 23 minutes, starting at 9.15 UTC and ending at 10.38.

Some 1995 ASNs were affected by this route leak, originating from 104 countries. However, it dragged into this routing warp more networks from Russia (345 ISPs/1236 prefixes) and South Korea (217 ISPs/1085 prefixes) than anywhere else, with the third place taken by Germany with “only” 136 ISPs and 478 prefixes.

Brazilian networking is developing at a tremendous pace right now, as the market is hotter than ever with a vast population and potential for growth. On the other hand, ISP business in Brazil is somewhat different from other countries as they still have to overcome specific difficulties while developing networking infrastructure and getting that last mile to the customer in severe and even harsh environments.

Usually, a route leak like that, of such volume, when spreading through a well-connected ISP could make a lot of trouble not only for the region it originated from. But with a smaller AS and we suppose that this is the example at hand, even with a leak containing, literally, thousands of network prefixes, it could all end not that bad, hurting primarily direct customers and, probably, peerings without properly maintained ingress filters. Such an incident mainly hurts the reputation of an AS in question, though in this particular case as we were able to investigate (or, call it “google down”) that seems to be quite an old issue.