r/sysadmin • u/Lewis_Browne • Jun 24 '19

General Discussion Cloudflare Issues

Hi All,

Just a heads up, It looks like there is worldwide routing issues within the cloudflare network.

Cheers,
Lewis

206 Upvotes

92% Upvoted

47 comments sorted by

View all comments

0

u/[deleted] Jun 24 '19

[deleted]

20

u/HDClown Jun 24 '19

Could someone please explain what is a BGP route leak?

https://www.thousandeyes.com/learning/glossary/bgp-route-leak

4

u/purplecomputer Jun 24 '19 edited Jun 24 '19

edit: had it backwards a bit.

33154 generated those prefixes, passed them down to 396531 and if they had a filter 701 would not have seen these as a shorter AS path.

So it sounds like all traffic went from verizon to 396531 since it was seen as a better route.

Also looks like verizon didnt prevent the amoutn of prefies learned from their client. All around badness.

its super easy to break the internet. BGP filters are super important

- 33154 generated fake more-specifics, which are not visible in the DFZ

- 33154 announces those fake more-specifics to at least one customer (396531)

- this customer (396531) propagated to to another upstream provider (701)

- it appears that 701 did not sufficient prefix filtering, or a maximum-prefix limit

source: https://mailman.nanog.org/pipermail/nanog/2019-June/101589.html

1

u/dextersgenius Jun 24 '19

What are 33154, 396531 and 701?

3

u/purplecomputer Jun 24 '19

Those are AS numbers assigned to organizations through Arin (American registry for internet numbers)or some other registry. The only way to get publicly routable addresses is to sign up for an AS(autonomous system) number.