When the Internet’s Routing Protocol Goes Rogue

Border Gateway Protocol (BGP) is the glue that holds the Internet together, but it was built on trust, not security. That design flaw means route leaks and hijacks can silently redirect traffic meant for your network to an unknown third party. Cloudflare's new Route Leak Detection feature is designed to give network operators early warning when their advertised prefixes start appearing from unauthorized sources.

What a Route Leak Actually Is

A route leak occurs when a network advertises routes it shouldn't, causing the Internet to send traffic through that network when it normally wouldn't. The consequences range from mere congestion to full-blown security incidents. In June 2019, a small ISP in Pennsylvania advertised routes for parts of the Internet belonging to Cloudflare, Amazon, and Linode. A significant chunk of traffic destined for those networks was rerouted through the ISP, causing outages and unreachable network errors for end users.

Route leaks stem from multiple causes: misconfigured peering sessions, router software bugs, man-in-the-middle attacks, or malicious customers. While some leaks are benign, others are deliberate attacks. An attacker can advertise specific routes to direct users to their own infrastructure, aiming to steal cryptocurrencies or other sensitive data, or to obtain SSL/TLS certificates that let them impersonate legitimate domains. By advertising more specific routes, they can trick users into visiting a site that looks exactly like the one they expect, enticing them to enter personal data.

The result is twofold: your users experience slowdowns because traffic flows through paths that cannot handle it, and your data may be exposed to attackers. Route Leak Detection exists to alert you when your prefixes are appearing from unauthorized parties so you can respond quickly.

Setting Up Route Leak Detection

Route Leak Detection is available to Cloudflare customers who use "bring your own IP" (BYOIP) addresses, covering Magic Transit (L3), Spectrum (L4), and WAF (L7) customers. Only prefixes that Cloudflare advertises on your behalf qualify for monitoring.

Configuration is done through the Notifications tab in your Cloudflare account. Once enabled, Cloudflare watches all of your onboarded prefixes for leaks and hijacks, sending alerts via email or specialized on-call tools like PagerDuty. The notification system also supports webhooks, giving your teams flexibility in how they receive routing alerts.

A Realistic Attack Scenario

Consider Acme Corp., which owns the prefix 203.0.113.0/24 and has onboarded it to Cloudflare. A malicious actor begins advertising a subnet of that prefix to other networks, trying to hijack traffic destined for Acme and divert it to a fake version of Acme's network designed to capture user credentials and other data.

BGP updates propagate across the global routing table quickly, typically within 60 seconds. Cloudflare's goal is to detect the leak within five minutes of erroneous routing information spreading. When Acme's prefix appears from an unauthorized source, an alert is dispatched to Acme's administrators.

The alert includes every ASN that observes the prefix being advertised by the potentially malicious party. Armed with this information, Acme can warn users about a potential data exfiltration attack and contact the service providers listed in the alert to stop honoring the illegitimate routes.

Mitigating a route leak today is a manual process that requires contacting providers using contact information from public databases like PeeringDB. Cloudflare plans to automate this outreach and mitigation workflow in the future to shorten the time between leak detection and resolution.

How Cloudflare Detects Leaks

Cloudflare builds a comprehensive view of how the Internet sees routes to its BYOIP customers by pulling data from multiple external sources: RIPE's RIS feed, RouteViews, and Caida's public BMP feed. Using several independent views of the global routing table increases the accuracy of inferences about routing state.

After ingesting this data through API calls, Cloudflare filters it down to the prefixes each customer has onboarded. The system then cross-references global routing table updates with metrics that suggest hijacking activity:

  • The number of ASNs that directly see your routes
  • The volume of BGP updates arriving over short time windows
  • How many subnets are being advertised

If those numbers shift dramatically, it is a strong indicator that your prefixes are being leaked. A surge in routing changes for a specific subnet of your advertised range is a red flag that someone is attempting to pull your traffic toward their network.

Cloudflare runs this same monitoring on its own prefixes. The system flagged an attempt to advertise a subnet of 2606:4700:50::/44 to 38 networks over the course of an hour. Because Cloudflare has deployed RPKI, most networks rejected those advertisements rather than honoring them.

The Long-Term Fix: RPKI

Route Leak Detection helps you respond to attacks, but preventing them in the first place requires RPKI (Resource Public Key Infrastructure). RPKI lets you cryptographically sign the routes you advertise, making it impossible for anyone else to claim them. When someone advertises routes that are not RPKI-signed, RPKI-supporting providers drop those announcements and contain the leak as close to the attacker as possible.

Adoption is accelerating. Amazon, Google, Telstra, Cogent, and Netflix began supporting RPKI filtering in the past three months alone. Over 50% of top Internet providers now support RPKI in some capacity.

Combined, Route Leak Detection and wider RPKI deployment reduce the risk that route leaks will cause data loss and downtime. If you are a Cloudflare Magic Transit or BYOIP customer, you can configure a route leak alert in your dashboard today.