cloudflare-akamai-leak.ipynb

cloudflare-akamai-leak.ipynb

{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "name": "cloudflare-akamai-leak.ipynb",
      "provenance": [],
      "authorship_tag": "ABX9TyPtjeOJSiOmQZ8QzDmt5II1",
      "include_colab_link": true
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    },
    "language_info": {
      "name": "python"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "view-in-github",
        "colab_type": "text"
      },
      "source": [
        "<a href=\"https://colab.research.google.com/gist/digizeph/022abcbf96e39babf4cb01b831998ee8/cloudflare-akamai-leak.ipynb\" target=\"_parent\"><img src=\"https://colab.research.google.com/assets/colab-badge.svg\" alt=\"Open In Colab\"/></a>"
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "# Investigating an potential route leak event\n",
        "\n",
        "relevant links:\n",
        "- https://twitter.com/bgp_events/status/1488487777067012096\n",
        "- https://twitter.com/DougMadory/status/1488621239157641216\n",
        "- https://twitter.com/jaredmauch/status/1488490713952264197"
      ],
      "metadata": {
        "id": "3vEiCuBMbukw"
      }
    },
    {
      "cell_type": "markdown",
      "source": [
        "## Search for BGP announcements\n",
        "\n",
        "Looking for any announcements between Tuesday, February 1, 2022 11:30:00 AM and February 1, 2022 12:15:00 PM (GMT), with the AS paths `.* 13335 20940$`, from all RouteViews and RIPE RIS collectors.\n",
        "\n",
        "Using `pybgpkit` for the lookup, more at https://github.com/bgpkit/pybgpkit"
      ],
      "metadata": {
        "id": "e33kKNrpZK-h"
      }
    },
    {
      "cell_type": "markdown",
      "source": [
        "**install pybgpkit**"
      ],
      "metadata": {
        "id": "vhiTu8pzZyDW"
      }
    },
    {
      "cell_type": "code",
      "execution_count": 2,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "E_ebE7QDVq1f",
        "outputId": "175ad5cd-2830-48ab-dbb5-810c06fdec39"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Collecting pybgpkit\n",
            "  Downloading pybgpkit-0.0.1-py3-none-any.whl (4.1 kB)\n",
            "Collecting pybgpkit-parser==0.0.1\n",
            "  Downloading pybgpkit_parser-0.0.1-cp37-cp37m-manylinux_2_24_x86_64.whl (3.4 MB)\n",
            "\u001b[K     |████████████████████████████████| 3.4 MB 29.6 MB/s \n",
            "\u001b[?25hInstalling collected packages: pybgpkit-parser, pybgpkit\n",
            "Successfully installed pybgpkit-0.0.1 pybgpkit-parser-0.0.1\n"
          ]
        }
      ],
      "source": [
        "!pip install -U pybgpkit"
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "**gather MRT files during the time range**"
      ],
      "metadata": {
        "id": "QqjhfYSaZ058"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "import bgpkit \n",
        "broker = bgpkit.Broker()\n",
        "# time range:\n",
        "# start_ts: 1643717100 -- GMT: Tuesday, February 1, 2022 11:00:00\n",
        "# end_ts: 1643717400 -- GMT: Tuesday, February 1, 2022 13:00:00\n",
        "items = broker.query(start_ts=1643713200, end_ts=1643720400, collector=\"rrc00\", data_type=\"update\")\n",
        "print(len(items))"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "9o63lDPZV2jK",
        "outputId": "8272b1d6-91a7-4a21-d4d1-a6e3b670ea5e"
      },
      "execution_count": 20,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "25\n"
          ]
        }
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "**parse each MRT file that matches the AS path filter**"
      ],
      "metadata": {
        "id": "ydCGVkqgZ4Rd"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "elems = []\n",
        "for item in items:\n",
        "  new_elems = bgpkit.Parser(url=item.url, \n",
        "                        filters={\n",
        "                            \"as_path\": \".* 13335 20940$\",\n",
        "                            }\n",
        "                        ).parse_all()\n",
        "  if new_elems:\n",
        "    print(item.url)\n",
        "  elems.extend(new_elems)\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "_kj60Lj8yO44",
        "outputId": "5c8c4f27-078a-4ed0-cd87-fcc448c9276c"
      },
      "execution_count": 25,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "http://data.ris.ripe.net/rrc00/2022.02/updates.20220201.1205.gz\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "accepted_asns = set()\n",
        "for elem in elems:\n",
        "  accepted_asn = elem.as_path.split(\" 13335 20940\")[0].split(\" \")[-1]\n",
        "  accepted_asns.add(accepted_asn)\n",
        "print(accepted_asns)\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "Q8qbZ7Z6lF3U",
        "outputId": "15b5caa4-e461-4371-d90f-1e131ffc66a8"
      },
      "execution_count": 26,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "{'5511'}\n"
          ]
        }
      ]
    }
  ]
}