2

The other day one of my VPS instances got inaccessible, for no apparent reason. Neither could I connect to it via ssh, nor it responded to ping. After several exchanges with the support of the VPS hosting provider (specifically, Vultr), they eventually told me: somebody hijacked an IP range (xxx.xxx.xxx.0/24) that included the IP address of said instance.

The instance got accessible again after three hour downtime, so the damage was not huge, but it left me confused since I never expected to be targeted with BGP hijacking, assuming what they told me was true.

So the question is: BGP hijacking is a real threat even to ordinary users and I have to believe what the VPS provider claimed, that the inaccessibility was not their fault, or the provider is to blame for the downtime and they are just making up an excuse?

2

1 Answer 1

4

BGP hijacks happen all the time. Both by accident (mostly by typos in router configurations by network engineers), but sometimes on purpose to reroute traffic via a specific network to do man-in-the-middle attacks.

It's hard to quantify 'how often'. I'd say it's not that common, but of course it could just be a case of bad luck with a typo.

However, one important thing is you can verify this. For example, RIPE NCC collects historical routing data and offers you a tool called BGPlay to watch back what happened to a specific IP range in time. You could use that to verify if the IP range of your VPS instance is seen with another AS number as source during the downtime you experienced. If RIPE Stat hasn't detected it, there's a fair chance they're making this up.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .