What is the practical difference between a route leak and a hijack?

The core distinction is intent: a route leak is an accidental propagation of more specific routes beyond intended peers, while a hijack is the intentional advertisement of prefixes you do not own or legitimately control. A leak typically originates from a misconfigured or non-compliant BGP speaker within a legitimate AS that inadvertently attracts traffic by advertising paths it shouldn't, often due to missing route filters. A hijack involves an AS, which may be malicious or compromised, advertising prefixes it has no authority over, with the goal of intercepting or disrupting traffic. Both cause traffic misdirection, but the mechanism differs: leaks often involve violating selective export policies (e.g., sending customer routes to other providers), whereas hijacks involve falsifying the origin AS in the AS_PATH. To prevent leaks, operators must implement strict outbound route filtering based on customer cone relationships, such as using

ip prefix-list CUSTOMER-OUT seq 10 permit 192.0.2.0/24 le 24

and applying it to peer sessions. Understanding this difference is crucial for incident analysis and implementing appropriate prefix filtering and RPKI-based origin validation.