Laos loses nearly four days of BGP routing with no attributed cause
Between September 2 and September 6, 2026, Laos saw its BGP control-plane visibility collapse for 3.7 days, with no public cause offered. The outage measures what a lightly multi-homed country costs, and reminds operators to verify route redundancy before the failure, not after.
September 2, 2026. Laos enters a routing outage that will last 3.7 days. September 6, 2026, 00:30 UTC. Connectivity is restored. No public cause. Why it matters: the country’s prefix visibility in the BGP control plane collapsed to a floor, and the episode shows what a country that depends on a handful of transit points actually costs.
A control-plane outage, not a transport one
The incident hit the control plane — route announcements — harder than the actual movement of packets. The clearest signal is the BGP median: the number of measurement points that could still see Laotian prefixes stayed frozen at 365 for the entire event, a reduced and constant level that points to a mass withdrawal of announcements.
The Merit Network Telescope (merit-nt), which approximates aggregate connectivity from backscatter, dropped 61% from its peak. The Google Traffic Report recorded a 19% decline (18% on its normalized variant). Active probing of IPv4 /24 reachability (ping-slash24), by contrast, lost only 7% — some traffic kept flowing even as routes vanished from tables. Telecom Observer scored the outage 5,773 on its own severity scale.
That gap between “announced” and “reachable” is the signature of a control-plane incident: announcements are withdrawn or degraded, but a few more-specific paths, or a subset of upstreams, keep carrying packets. The country was not fully cut off, but it had become largely invisible and partly unreachable to the rest of the world.
What the BGP median actually means
The BGP median is a simple but brutally informative measure. Every prefix a network announces is observed from many collection points (RIPE RIS, RouteViews, and others). The median counts how many of those points still see a given country’s prefixes in their routing tables.
When that median collapses and stays constant at 365, it means the country’s announcements are now propagated by only a handful of paths, stably. That is not the profile of a total physical cut — transport would have zeroed everything out — but of a coordinated withdrawal or an upstream BGP session that has stopped propagating routes. The fact that active reachability only lost 7% confirms the problem was in announcements, not in the fibers.
A silence on the cause
Telecom Observer notes the cause was not publicly attributed. No operator, agency, or transit provider documented what triggered the withdrawal: an upstream session failure, a routing-policy conflict, an exchange-point incident, or the failure of an international gateway. Routing was reported restored “by the end of the observation window”, without explanation.
The silence matters. A country like Laos depends on a small number of international gateways and upstream transits. When one of them loses sessions or mis-filters announcements, the whole country’s visibility collapses at once — exactly the curve observed: a sharp drop followed by a low, constant plateau for nearly four days.
Geography does not help. Laos is landlocked, with no direct sea access: its transit links and paths to the global network run through its neighbors — Thailand, Vietnam, China, Cambodia. A routing incident at one of those neighbors, or on the gateway connecting them to the Laotian network, immediately shows up in the whole country’s visibility. Redundancy is not only a matter of will, but of physical infrastructure and transit agreements.
A busy month for the control plane
The Laotian episode did not happen in a vacuum. September 2026 is accumulating incidents across global routing infrastructure. On September 12, the BGP.Exchange site — a free, virtual Internet exchange platform — was defaced and its mail system hijacked to send spam. Days earlier, a targeted BGP hijack was used to distribute a malicious Virtualizor update, with hypervisors compromised down to the root user.
The month’s lesson is not that BGP suddenly became more vulnerable. It is that the weak links — a single-transit country, an unhardened exchange platform, an unsigned update provider — are being exploited and documented faster than ever. RPKI and origin validation reduce the risk of invalid announcements, but they replace neither transit diversity nor monitoring.
What the incident teaches operators
Control-plane fragility is fixed with concrete measures, not with hope.
- Transit redundancy is measured upstream. A single transit provider, however reliable, remains a single point of failure for all your prefixes.
- Announcements and transport are monitored separately. A route can stay reachable while it has vanished from tables; the reverse is true too. Watch both signals.
- Public sources are enough to detect the anomaly. RIPE RIS, Cloudflare Radar, IODA, or backscatter telescopes show a median collapse within minutes, with no dedicated hardware.
- RPKI reduces ambiguity. Signing your prefixes and enabling route origin validation does not prevent a session failure, but stops an invalid announcement from spreading during an incident.
Each of these measures is cheap next to the price of four days of invisibility.
A precedent that weighs, and the tools to see it
Routing history is littered with incidents where a single event cut an entire network. The most famous remains the 2008 hijack, when Pakistan Telecom announced YouTube’s prefixes to block the site and the announcement leaked worldwide for two hours. Laos shows the other face of the same risk: not one announcement too many, but a disappearance of announcements.
Detection needs no expensive hardware. A look at RIPE RIS or RouteViews is enough to follow a country’s BGP median; public looking glasses (RIPE, Hurricane Electric) verify in real time whether a given prefix is still visible. On the prevention side, RPKI signing and origin validation stop an invalid announcement from propagating — but they do not fix a session that drops. Transit redundancy remains the only real insurance.
Verdict
If your network has a single upstream transit, treat that as a top availability risk and open a second path: the Laotian incident shows a single point of failure can make an entire country vanish from routing tables for nearly four days. If you are already multi-homed, confirm both transits announce your prefixes continuously and that you watch the BGP median as closely as reachability — the silent outage is the one that does not cut everything, but makes you invisible.