China Telecom BGP Incident Briefly Reroutes ~37,000 Prefixes Including US .gov and .mil
On 8 April 2010 China Telecom's AS23724 originated about 37,000 prefixes it did not own for roughly 15–18 minutes, briefly drawing some traffic for US government, military and commercial networks through China; whether it was an accident or deliberate remains disputed.
02Deep-Dive Technical Analysis
AS23724 normally originated ~40 prefixes; between 17:54 and 18:10 UTC it announced ~37,000 (about 11% of the table), propagated via AS4134 (ChinaNet backbone). BGPmon estimated only ~10% propagated beyond China. The USCC's Nov 2010 report said traffic to about 15% of internet destinations was routed through China for about 18 minutes, widely misreported as 15% of all traffic; Arbor Networks measured only a few Gbit/s. A PAM 2013 study found little subprefix hijacking, consistent with a route leak. China Telecom denied hijacking.
03Vulnerability & Exploit Flow
Mass origination of foreign prefixes by a large transit AS, accepted by peers lacking origin or max-prefix filtering.
04Recommended Defense & Mitigation Protocol
Peer max-prefix limits, IRR-based filtering and RPKI route origin validation; MANRS routing-hygiene commitments.
05Security Impact & Geopolitical Consequence
Became the policy reference case for state-scale BGP interception risk and fed directly into US telecom supply-chain and routing-security debates, despite technical disagreement about its scale and intent.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.