The BGP Analyst's Notebook: 17 Years In#

Doug Madory (Head of Internet Analysis, Infoblox)

• Why: Seventeen years of documented routing incidents from the analyst who published most of them — the right lens for separating durable trends (RPKI uptake) from headline noise, and for threat-modeling and monitoring product direction.
• What: A retrospective in two buckets. Geopolitical: Egypt 2011 as the start of the shutdown era; Iran's 2026 shutdowns described as the most impactful in history (BGP routes stayed up while the country went offline via GFW-like filtering, nightly curfews, a national internet, and 2026 allowlisting); the Kherson switchover to Russian transit; the ALBA-1 submarine cable. Attacks: the first documented BGP MITM hijacks (Belarusian ASes, Feb 2013, targets including Visa, Mastercard, and foreign ministries); the coordinated Bitcanal (AS197426) takedown; and the IPv4 leasing / residential-proxy economy — Ukraine's routed footprint shrank 18.5% post-invasion as providers leased IPv4 for revenue, only for it to be abused by proxy networks (per Krebs). Also: China's ROA coverage jumped from 4% to 81% since April 2026, lifting the APNIC region from 55% to 77%.
• How: His methodology: reconstruct the hidden per-AS routing-table state over time from merged BGP views rather than individual announcements, and analyze events by scope, duration, and context.
• Where applicable: Global internet measurement; not a deployment talk but a high-signal framing of what changed, what hasn't (path validation), and what's coming (ASPA as the next question after ROV).