Leaked routes earlier

For about two minutes from Tue Jul 25 21:09:42 2017 GMT to 21:11:30 2017,
routes to AWS were routed to stream-internet.net and got blackholed.

for example, route to 50.18.x.x at the time:

<snip>
  5. sd-cr01-te3-4.161.nyc.stream 0.0% 3 350.9 249.9 173.9 350.9 91.2
  6. anc-cr03-xe-5-0-1.149.ff.str 33.3% 3 174.7 195.8 174.7 216.8 29.8
  7. radio-cr01-ae4.135.hel.strea 33.3% 3 213.4 213.6 213.4 213.7 0.2
  8. mmon-cr01-be3.78.spb.stream- 66.7% 3 204.6 204.6 204.6 204.6 0.0
  9. a433-cr01-be1.78.msk.stream- 33.3% 3 214.4 212.9 211.5 214.4 2.1
10. m9-cr05-ae9.77.msk.stream-in 66.7% 3 213.6 213.6 213.6 213.6 0.0
11. m9-cr03-ae1.199.msk.stream-i 33.3% 3 197.5 206.4 197.5 215.3 12.6
12. s-bb3-link.telia.net 66.7% 3 206.8 206.8 206.8 206.8 0.0
13. kbn-bb3-link.telia.net 66.7% 3 214.9 214.9 214.9 214.9 0.0
14. 54.240.242.130 66.7% 3 614.2 614.2 614.2 614.2 0.0
15. 54.240.242.147 66.7% 3 204.4 204.4 204.4 204.4 0.0
16. m9-cr05-ae3.77.msk.stream-in 66.7% 3 262.0 262.0 262.0 262.0 0.0
17. 54.240.242.132 66.7% 3 606.2 606.2 606.2 606.2 0.0
18. 54.240.242.147 33.3% 3 205.5 203.6 201.6 205.5 2.7
19. 205.251.229.158 66.7% 3 200.8 200.8 200.8 200.8 0.0
20. ??? 100.0 3 0.0 0.0 0.0 0.0 0.0
21. ??? 100.0 2 0.0 0.0 0.0 0.0 0.0
22. ??? 100.0 2 0.0 0.0 0.0 0.0 0.0
23. ??? 100.0 2 0.0 0.0 0.0 0.0 0.0

Anyone saw the same issue?

Thanks,

--Wilson

It was AS12389 who leaked for few minutes.

From my view, AS7922, 16059, 4134, 6805, 13649, 29562, 31334, 9116 were all

affected.

For example 50.18.174.0/18 from AWS AS16509, right before:

[image: Inline image 1]

Duration:

[image: Inline image 2]

After:

[image: Inline image 3]

--Wilson