3 ms·

Under what circumstances can internal traffic leak to external addresses in 11.0.0.0/8? I’d have thought it wouldn’t have been routed via a gateway if the traff

• 0x0000000 5y ago
  Routing decisions are made via route tables, which may include routes learned from different means: connected routes ("I have an interface in this network"), static routes, and routes learned from routing protocols (BGP, OSPF, et al). While any given routing protocol has it's own cost metric for selecting the best path, if a router has multiple routes to a network, learned from different means, there must be a way to select which route to install in the route table. This can be tuned, but often goes in order of connected, static, external BGP, followed by internal BGP and other interior gateway protocols. So, yeah if you learn a route from eBGP, you very well may take that path out of your own AS out to the global Internet, as opposed to internally where you are (incorrectly) using someone else's public space. (Edit: network here includes a prefix length, where more specific prefixes are chosen over less specific ones. In the case, the public announcement is 11.0.0.0/8. If you were using this space internally, you would presumably have more specific routes than a /8)