Live Long and Prosper:Analyzing Long-Lived MOAS Prefixes in BGP

TL;DR

This study provides an in-depth analysis of long-lived MOAS prefixes in BGP over six years, revealing their characteristics, origins, and implications for network security and traffic management.

Contribution

It is the first comprehensive analysis of long-lived MOAS prefixes, including their prevalence, RPKI status, CIDR sizes, and underlying reasons such as mergers and acquisitions.

Findings

Over 24k long-lived MOAS prefixes in IPv4 identified in January 2023.

More than 40% of MOAS prefixes have all origins correctly registered in RPKI.

Majority of MOAS prefixes are used for fine-grained traffic steering and originate from customer-provider relationships.

Abstract

BGP exchanges reachability information in the form of prefixes, which are usually originated by a single Autonomous System (AS). If multiple ASes originate the same prefix, this is referred to as a Multiple Origin ASes (MOAS) prefix. One reason for MOAS prefixes are BGP prefix hijacks, which are mostly short-lived and have been studied extensively in the past years. In contrast to short-lived MOAS, long-lived MOAS have remained largely understudied. In this paper, we focus on long-lived MOAS prefixes and perform an in-depth study over six years. We identify around 24k long-lived MOAS prefixes in IPv4 and 1.4k in IPv6 being announced in January 2023. By analyzing the RPKI status we find that more than 40% of MOAS prefixes have all origins registered correctly, with only a minority of MOAS having invalid origins. Moreover, we find that the most prominent CIDR size of MOAS prefixes is /24 for IPv4 and /48 for IPv6, suggesting their use for fine-grained traffic steering. We attribute a considerable number of MOAS prefixes to mergers and acquisitions of companies. Additionally, more than 90% of MOAS prefixes are originated by two origin ASes, with the majority of detected origin AS relations being customer-provider. Finally, we identify that the majority of MOAS users are IT companies, and just 0.9% of IPv4 MOAS and 6.3% of IPv6 MOAS prefixes are used for anycast.