Prefix hijacked by another ISP

Question

I had the <sarcasm>privilege</sarcasm> for the second time in 10 years to have one of our smaller prefixes hijacked. I have a branch office with a /27 assigned from ISP-A PA space configured with static routing. Recently, ISP-B, a well-known tier 2 cable company, allowed a customer to start advertising a /24 over BGP that overlapped with my /27, effectively siphoning off my traffic and causing an outage.

Obviously, ISP-B should be filtering what advertisements it receives from its customers to prevent this. Since my prefix is a /27, it's likely that even if I had my more specific route advertised, it would've been dropped by many routers that filter out anything > /24.

Is there anything more ISP-A could have done to reduce this likelihood of this event occurring?

Would it be better for me to speak BGP to ISP-A and advertise that /27 in the hope it at least reaches more of that carrier's network to minimize the chance that on-net traffic would see trouble?

Answer 1

At this moment, there's not that much that ISP's can do to prevent these kind of hijacks except, as you said, doing proper filtering of received and announced prefixes. Unfortunately many ISP's still don't do that. RPKI may help as well but has some other drawbacks and isn't widely implemented either.

I wouldn't expect on-net traffic for ISP-A to be affected though. Any sane ISP wouldn't accept their own prefixes (or more specifics of those) from any BGP peer. If they really accepted the /24 containing your prefix from another ISP, that's something you should complain about.

It sounds as if ISP-A only had an aggregate route containing a larger block than your /27 in its IBGP, else they should always have had a more specific route winning it from the hijacked /24. If it makes any difference if they configure that /27 statically on an interface or receive it via BGP is something only ISP-A can answer. Maybe it does help and the /27 will be installed in their IBGP, maybe not.