August 7, 2026
BGP route leak vs hijack: how to tell them apart
A BGP route leak is usually an accident with your customer’s logo still on it. A hijack is someone else originating the space. From one collector they can look identical: a shorter path, a surprised NOC, and a prefix that went on holiday. The job is to decide which Tuesday you are having before you write the wrong email.
I open the BGP looking glass first, not traceroute. I want origin ASN and the full path from more than one region. If the origin is still yours and a downstream is now offering you to the world, you are in leak territory. If the origin is a stranger, stay in hijack mode until the RPKI validator and IRR say otherwise.
What a BGP route leak looks like
The origin ASN is still the rightful one. The path grew a new middle or, worse, got shorter because a customer exported your route to their other transit. RIS collectors that peer with the leaker light up first. Collectors that never see that customer still show last week’s path. That split is the tell. A BGP prefix lookup on the covering aggregate plus the more-specifics keeps you from missing a /24 that leaked while the /22 stayed home.
203.0.113.0/24
3356 64511 64500 ← usual
1299 64550 64500 ← 64550 should not be offering thisIf the origin did not change, shout “leak” before you shout “hijack.” You will be right more often than the incident channel is.
What is not a BGP route leak
A new origin is not a leak. A more-specific from an ASN that never had a route object or a ROA is not a leak. An anycast prefix that shows different origins by design is not a leak. Check ASN explorer for the middle AS: a customer of yours with one transit and a fat export policy is the usual suspect. The protocol background is still RFC 4271; the leak taxonomy people actually cite is RFC 7908.
Call the network that exported you. Send the path, the collector, and the UTC time. Do not send a novel. Then decide whether you need a tighter export, an IRR prefix-list, or a ROA you should have published last year.