Re: [RPSEC] FW: AS 8437 announced a quarter of the net for half of an hour

In message <61CD5836-AA9C-4D07-BEDD-976642406608@muada.com>
Iljitsch van Beijnum writes:
>  
> On 14-aug-2006, at 21:53, Tony Li wrote:
>  
> >> Today (Aug 14th 2006) AS 8437 announced 63 /8 nets from 14:30 to  
> >> 15:00
> >> UTC.  I don't believe that this is normal, but please correct me if I
> >> am wrong.
>  
> Looks like they inject these prefixes into their routers to blacklist  
> them (if you route the next hop address to some place unreachable and  
> also do a reverse path forwarding check you filter both to and from  
> these addresses) but somehow they leaked the prefixes.

I think Tony's point is that no one should be accepting these.  Almost
all cases of bogus routing that has done damage was accidental.  There
have been some incidents of intentional bogus routes injected as an
attack that I know of but these are (or used to be) far less common.

Curtis

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec