AS7007 incident (MAI Network Services route leak)

• At 11:30 EST "our border router, stamped with AS 7007, recieved a full routing view from a downstream ISP (well, a view contacing 23,000 routes anyway)."
• "the 7007 router then began to de-aggregate the 23K route view and strip the AS path out of it." More than 73,000 routes reached the MAE-East border router of the upstream.
• MAI's own account of its error: "There was no distibute list imposed on the downstream" and "Not having a filter imposed on the inbound side was our error."
• The routes were more specific than the real ones and had a one-hop AS path, so other networks preferred them, and traffic for a large part of the internet was drawn to AS 7007. MAI disabled the session at 11:45, rebooted the router at 12:00 and unplugged it at 12:15; the routes persisted in other networks after that.
• Wikipedia: the deaggregation to /24s was "probably because of a bug in the affected router".

Everything below is ours.

• The mechanism is assumed. The record says the router deaggregated the view and stripped the AS path, and attributes that to a probable bug. It does not say how. This replay models the mechanism the incident is usually taught with, and that produces the same announcement: BGP redistributed into the IGP on one border router, and the IGP's external routes redistributed back into BGP on another, neither through a route-map. Routes that make that round trip come back as locally originated, AS path empty. We do NOT claim that is what MAI's router did, and we do not model the deaggregation at all.
• Two MAI border routers, because a router does not install its own redistributed externals, so the round trip needs two. A downstream ISP that sends a full view, a transit that prefers what its customers send it, a third party behind that transit, and one router standing in for the rest of the internet with six /20s standing in for the view. AS 7007 and AS 1239 are the real numbers; every other AS number and every address is from the documentation and benchmarking ranges.
• MAI takes only a default route from its transit, as a small ISP of 1997 would. It matters: if the transit-facing router also heard the view over eBGP, that route would win its routing table over the OSPF external and nothing would be redistributed back, on a real router as in the model.
• MAI's outbound filter toward the transit is an AS-path list permitting ^$ and ^64505$ (what MAI and its customer originate). That is our guess at a reasonable 1997 edge policy; it matters because a route whose AS path has been stripped matches ^$ and gets through it.
• Cisco IOS syntax throughout.

tools/replays/gen_as7007_1997.py writes the corpus.