YouTube Hijacking (February 24th 2008) Analysis of BGP Routing Dynamics

On Sunday, 24 February 2008, Pakistan Telecom (AS17557 ) started an unauthorized announcement of the prefix 208.65.153.0/24. One of Pakistan Telecom’s upstream providers, PCCW Global (AS3491 ) forwarded this announcement to the rest of the Internet, which resulted in the hijacking of YouTube traffic on a global scale. In this report we show how this event was observed by about 300 vantage points (also called collector peers) spread over the Internet by the Routing Information Service (RIS) of RIPE NCC and, in general, how to obtain hard data on network events using public available tools developed by the RIS and by the Compunet Research Group of Rome Tre University.