In 1997, one network accidentally announces thousands of other networks’ destinations as though the preferred routes lead through AS7007. Much of the Internet believes it.
The Internet, inconveniently, believed it.
On Friday, 25 April 1997, one network began telling much of the Internet: send the traffic here.
The Internet, inconveniently, believed it.
The Internet has no single traffic controller deciding where every packet should go. Instead, networks exchange reachability information using the Border Gateway Protocol, or BGP.
A network announces which destinations it can reach. Other networks compare the available paths. More-specific routes normally take priority.
That arrangement depends heavily on networks advertising sensible information.
On 25 April, a border router operated by MAI Network Services as Autonomous System 7007 received approximately 23,000 routes from a downstream network. MAI later acknowledged that it had not applied an inbound filter that could have limited what it accepted.
Then the router behaved disastrously.
According to MAI’s contemporary explanation, it deaggregated the received routes into more-specific announcements and stripped their existing AS paths. The resulting messages made AS7007 appear to originate routes to thousands of destinations belonging to other networks.
Because the false routes were more specific, routers elsewhere preferred them. Traffic that should have gone to many unrelated destinations started heading toward AS7007 instead.
Network operators noticed their own address space being announced by somebody else. One engineer wrote that, from his router’s perspective, most of the Internet had suddenly disappeared.
MAI disabled connections, rebooted equipment and ultimately disconnected its network. Even then, the disturbance did not vanish immediately: erroneous routes already circulating through other networks continued to cause trouble.
The next day, MAI’s network-services director published an explanation and apology. His account distinguished the approximately 23,000 routes received from the more than 73,000 entries later observed inside another router. A modern APNIC retrospective estimates that roughly 6,000 erroneous routes escaped into the wider routing system for about two hours.
The incident did not shut down every part of the Internet, and it was not a deliberate hijacking. It did expose how far one mistaken claim could travel through a system built on networks trusting one another’s directions.
One router announced that it knew the way.
Too many others followed it.
A single accidental routing announcement redirected traffic for thousands of unrelated destinations toward a network that could not deliver it.
AS7007 announced directions. Much of the Internet followed them.
Evidence status
Sources
Primary / Contemporary operator record
NANOG archive — MAI Network Services: “7007 Explanation and Apology”
NANOG archive — Contemporary operator report: “Wow, AS7007!”
Original language: English