Re:Updated I-D: draft-melegassi-mvps-ddos-resilience-02

[Leonardo Melegassi <[e-mail]>]

Dear BFD WG and OPSAWG,



Follow-up to my -01 update from earlier today.  I have submitted

revision -02, which replaces the "general Internet event"

correlation from -01 with confirmed DDoS attacks specifically.



  https://datatracker.ietf.org/doc/draft-melegassi-mvps-ddos-resilience/ 



Using RIPE Stat's public BGP-updates API, I identified 7

independently confirmed DDoS attacks from April-May 2026 (via

victim status pages and press reports) and measured BGP updates

on each victim's OWN announced prefix during the attack window:



  VentraIP (AU, 600 Gbps), Canonical/Ubuntu (3.5 Tbps), Binary

  Lane (AU, 400 Gbps), Network Platforms (ZA, 676 Gbps), Xneelo

  (ZA, 300 Gbps), SiteHost (NZ), and 1-Grid (ZA, 100 Gbps).



30 of 33 tested prefixes (91%) showed a BGP anomaly on the

confirmed attack day; 4 of 7 targets show ALL tested prefixes

alarming together (Network Platforms 4/4, Xneelo 6/6, SiteHost

10/10, 1-Grid 6/6).  Joint significance across all 7 targets

(binomial test) is P < 6*10^-60 under the null hypothesis that

alarms are unrelated to attack timing.



Two cases show detection before any defensive action: VentraIP

(same hour as attack onset, 4h before mitigation) and Canonical

(2h before their Cloudflare migration began).



I should also flag a self-correction.  An earlier working

version of Section 7.7 tried to correlate RIPE Atlas RTT spikes

with DDoS events purely by time proximity, and initially seemed

to show detection up to 53 hours ahead of public reports.  A

control test showed this was a base-rate artifact: with several

major Internet disruptions packed into the same week, almost any

large RTT spike lands within 48h of SOME known event by chance.

I removed that claim and kept only the causally-direct BGP-on-

prefix results above, which do not share this flaw.  Section

7.7.1 documents the retraction for transparency.



To be clear on positioning: BGP-aware DDoS correlation itself is not

new -- commercial platforms (Kentik, NETSCOUT, ThousandEyes) already

do this operationally with proprietary vantage networks and much

lower latency (minutes vs. the hours I observe here).  The

contribution I am claiming is narrower: a formally-proved,

reproducible validation of the MVPS coherence-vector framework using

only free public data.  Section 1.4 (new in -02) states this

explicitly.



Intended status remains Experimental.  Feedback welcome, including

on the retroactive-selection caveat noted in Section 7.7.3 (all 7

targets were chosen because their attacks were already publicly

confirmed; a forward/blind test remains future work).



Best regards,

Leonardo Melegassi

Catellix





De: Leonardo Melegassi <[e-mail]>
Para: "rtg-bfd"<[e-mail]>, "opsawg"<[e-mail]>
Data: seg., 06 jul. 2026 16:52:27 -0300
Assunto: Updated I-D: draft-melegassi-mvps-ddos-resilience-01



Dear BFD WG and OPSAWG,



I have submitted revision -01 of

draft-melegassi-mvps-ddos-resilience.



  https://datatracker.ietf.org/doc/draft-melegassi-mvps-ddos-resilience/ 



Main changes: added formal proofs for the three theorems

(D1-D3), and a real-data validation section using two months

of RIPE Atlas and RIPE Stat BGP measurements.



The BGP data (30 days, 5 anycast DNS prefixes) produced

9 alarm-days, all of which correlate with independently

documented public Internet events -- including the .de

DNSSEC outage (May 5), the Seacom/EASSy submarine cable

breaks (May 12), and the Railway/GCP platform suspension

(May 19-20).  Details in Section 7.2 of the draft.



The intended status remains Experimental.  Feedback welcome.



Best regards,

Leonardo Melegassi

Catellix