Strange route with Jio and GTT as adjacency

Fri, 01 May 2026 01:12:16 +0530

Last month (on 18th April 2026), I saw an alert for a strange route announcement:

Prefix	AS Path	Origin ASN
117.120.58.0/23	262427 262761 263444 6453 3257 55836 9498 134863	134863

Background

While this specific alert triggered because it had three large Indian backbones - Tata Comm (AS6453), Jio (AS55836) and Airtel (AS9498) and normally this would appear just as a leak by Jio for routes learnt from Airtel (a known peer of Jio), but AS3257 before Jio makes it strange and interesting. AS3257 is a known transit-free network GTT. Jio is not known to be connected to them at all. Jio does have a mix of transit & peering internationally via AS64049 but not via AS55836. When they started, they had some transit via Tata Comm (AS4755) for a few early days of the launch. After that AS55836 only has peering with Tata Comm (AS4755) and Airtel (AS9498), besides technically transit via their own AS64049 which takes transit from Arelion (AS1299), Cogent (AS174) and NTT (AS2914) and a mix of transit/peering relations with Lumen (AS3356).

Who possibly caused it?

The AS_PATH here: 262427 262761 263444 6453 3257 55836 9498 134863 can be read backwards to understand the announcement:

SP Internet (134863) > Airtel (9498) > Jio (55836) > GTT (AS3257) > Tata Comm (AS6453) > Open X Tecnologia (AS263444) > Sinal Br Telecom (AS262761) > Invista Net Provedor (AS262427). As mentioned in a post last year, I hold recent routes in a Clickhouse table from various route collectors. This makes it easy to query a large number of routes quickly.

SELECT count(*)
FROM bgp.table

Query id: df33f954-7fbd-41a3-8de2-184990ca06d4

   ┌─────count()─┐
1. │ 68882920533 │ -- 68.88 billion
   └─────────────┘

1 row in set. Elapsed: 0.034 sec.

Let’s ask this table of 68.88 billion routes for routes matching AS_PATH: 3257 55836:

SELECT timestamp, prefix, as_path, collector
FROM bgp.table
WHERE arrayExists(i -> ((i < length(as_path)) AND ((as_path[i]) = 3257) AND ((as_path[i + 1]) = 55836)), arrayEnumerate(as_path))

Query id: 6805de6a-c1c5-47e8-ab83-9e1549527d65

   ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector─────────────┐
1. │ 2026-04-19 02:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.rio       │
2. │ 2026-04-19 02:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.fortaleza │
   └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴───────────────────────┘
   ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector───────┐
3. │ 2026-04-19 04:00:02 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.rio │
   └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴─────────────────┘
   ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector─────────────┐
4. │ 2026-04-19 04:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.fortaleza │
5. │ 2026-04-19 06:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.fortaleza │
   └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴───────────────────────┘
   ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector───────┐
6. │ 2026-04-19 06:00:04 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.rio │
7. │ 2026-04-18 16:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.rio │
   └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴─────────────────┘
   ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector─────────────┐
8. │ 2026-04-18 16:00:04 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.fortaleza │
   └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴───────────────────────┘
    ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector─────────────┐
 9. │ 2026-04-18 18:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.rio       │
10. │ 2026-04-18 18:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.fortaleza │
11. │ 2026-04-18 20:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.fortaleza │
    └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴───────────────────────┘
    ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector───────┐
12. │ 2026-04-18 20:00:04 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.rio │
    └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴─────────────────┘
    ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector─────────────┐
13. │ 2026-04-18 22:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.rio       │
14. │ 2026-04-18 22:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.fortaleza │
15. │ 2026-04-19 00:00:03 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.fortaleza │
    └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴───────────────────────┘
    ┌───────────timestamp─┬─prefix──────────┬─as_path────────────────────────────────────────────┬─collector───────┐
16. │ 2026-04-19 00:00:04 │ 117.120.58.0/23 │ [262427,262761,263444,6453,3257,55836,9498,134863] │ route-views.rio │
    └─────────────────────┴─────────────────┴────────────────────────────────────────────────────┴─────────────────┘

So routes were only visible at route-views in Rio de Janeiro (Brazil) and Fortaleza (Brazil), not any other collector or by any other ASN other than AS262427 which is feeding these routes in both the collectors. Both GTT (AS3257) and Tata Comm (AS6453) feed a few collectors but this route is not visible in their feeds. So it’s safe to say that this route is “generated” by the ASNs on the left side of AS6453 in the above AS_PATH. It’s either AS262427, AS262761 or AS263444 that “generated” this route.

I cannot find exactly which one of these three because:

Route is historical (no point of live lookup now)
AS262761 and AS263444 are not feeding any of the known public collectors and hence routes cannot be compared between these three.

It could be some sort of BGP route optimiser’s work in (AS262427, AS262761 or AS263444) but I fail to understand why they would show this fake adjacency between 3257 & 55836. For all this time the prefix 117.120.58.0/23 in reality was not in the downstream of Airtel (AS9498) but Vodafone IDEA (AS55410).

GTT on Personal blog of Anurag Bhatia

Strange route with Jio and GTT as adjacency

Background

Who possibly caused it?