BGP Route Leak That Rerouted Traffic Through an Unexpected AS

A misconfigured BGP peer accepted a broader-than-intended prefix announcement, briefly rerouting user traffic through a third-party network.

Overview

A prefix-filter mistake on a Direct Connect router accepted a /16 instead of a /24, and for 18 minutes part of another customer's traffic ran through the company's link.

What happened

A network engineer updated the BGP route policy at the Direct Connect router. The company never noticed; the adjacent customer did.

Why it broke

The filter was meant to accept only the corporate /24. The /16 it accepted also covered an adjacent /24 owned by a different customer.

Some speakers preferred the new /16 route: a longer AS-path, but a wider prefix, and the behavior is AS-dependent.

Impact

Duration — 18 minutes
Data security impact for the company — None
Who noticed — The adjacent customer, not the company
Consequence — Violated acceptable-use terms with the carrier; formal incident report required

The fix

Accepted prefix — A /16 supernet — Only the specific /24 for the corporate network
Adjacent customer's /24 — Covered — Not covered

> [!NOTE] A route leak can cause no pain for the network that causes it. The company learned about it from a carrier complaint, not its own monitoring.

Key concepts

BGP route leak: Propagating a BGP route beyond the intended scope — advertising a prefix to a peer that was not meant to receive it, potentially causing traffic to transit through unintended networks.
Prefix filter: A BGP policy that restricts which prefixes are accepted or advertised to a peer, preventing route leaks by enforcing explicit prefix lists.
AS-path prepending: Adding your own AS number to the AS-path multiple times to make a route appear longer and less preferred, useful for traffic engineering.
Direct Connect route policy: BGP configuration on the Direct Connect virtual interface that controls which prefixes are accepted from and advertised to AWS, and which routes are propagated to the on-premises network.

When to use it

Explaining BGP route hygiene and prefix filtering requirements
Discussing Direct Connect route policy design
Answering "What is a BGP route leak and how do you prevent it?"

Interview questions

How do you design BGP prefix filters to prevent route leaks on a Direct Connect connection?