What signal indicates a potential BGP hijack when monitoring for anomalies?

• A. Sudden AS_PATH changes
• B. Stabilized routes
• C. No changes to prefixes
• D. Consistent ROA matches

Answer: (C)

When monitoring for BGP hijacks, sudden changes in the AS_PATH for a prefix are the most telling signal. A hijacker typically announces the same prefix from a different origin AS or alters the path to draw traffic, which shows up as abrupt, unexpected updates to the AS_PATH and often as route instability. This kind of rapid path change stands out against normal, stable routing behavior.

If routes stabilize and prefixes don’t change, that reduces suspicion of a hijack. Likewise, consistent ROA matches suggest the announcements align with authorized origins, making hijacking less likely. However, the hallmark anomaly to watch for is the quick, unexpected AS_PATH change that indicates a prefix being reachable through an unintended route.