Internet Vulnerability Takes Down Google

24-19 = 5 bits. 2^5 = 32

The article mentionned that some networks within the /19, in this incident, were critical. So yes, I believe that every businesses should advertise /24 for their highly critical infra. They can advertise /19, /20 and so on for the less important networks. No need to use /24 for everything.

China doesn't need anyone to play along to prevent their population from accessing the global internet. Right now, at least the rest of the world can access Chinese websites. A blanket ban on peering with Chinese ISPs would really bifurcate the internet. I'd count that as "playing along".

It just goes to show the power of branding and how much people attach to it.

edit/minor correction: I guess they'd have control over peering agreements for initial hops for Google Fiber users, but that wouldn't have resolved the issue in this case, either, unless they stopped peering with other huge providers like NTT. Even then, it'd only help their subscribers.

As BGP nodes come online, they establish connections with "nearby" existing BGP nodes, saying what version and how frequently they'll check in, and what their AS number is (a unique identifier)

Once communications have been established, then they can start to report any network routes they know about.

"I'm AS 123456, and I am the originator for 3.0.0.0/0" (i.e. they're responsible for it), "Also, I can reach 4.0.0.0/8 with a cost of 6" (A fair number of hops away on the network).

Any neighbouring BGP peers update their routing table:

"AS 123456 is responsible for 3.0.0.0/8, and I can reach it with a cost of 1, and I can also reach 4.0.0.0/8 with a cost of 7 via AS 123456". If there's a cheaper route to a network address, no changes will happen.

Routing changes can propagate quite quickly across the internet. The routing protocol is nice and lightweight, and updates are happening with reasonable frequency, as network connections come and go.

The idea is that should damage occur to the network fabric, the network will automatically update and route around it, without need for any intervention.

It's entirely built on trust, though. You have to trust that AS 123456 is indeed actually responsible for 3.0.0.0/8.

If you get two parties indicating responsibility for a network range, it's possible to end up with routing loops etc, as things get in to a mess.

What is legitimate behaviour, though, is for, say, AS 123456 to be the originator for 3.0.0.0/8, and another AS be the originator for 3.0.1.0/24 (i.e just 254 addresses under that space). That's not an unusual situation, and it won't cause routing issues, because more specific is taken as a priority over less specific, rough analogy: "In general mail for General Electric, should be sent here, but if it's for the electronics product division, send it straight to them"

There have been different attempts to put filtering in place, provide authentication "Yes, AS 123456 is allowed to be responsible for 3.0.0.0/0" and the like, but nothing has really taken off.