Not really... On the low end (small ISPs with zero or a handful of downstream ASes), people aren't aware or are too lazy to implement egress ACLs. Complicating

Not really... On the low end (small ISPs with zero or a handful of downstream ASes), people aren't aware or are too lazy to implement egress ACLs. Complicating this: A surprising number of small ISPs and telcos don't actually staff for internet routing skills (e.g. can work with BGP & have heard of a BCP). They'll bring on a consultant to "turn up my new circuit" and move on. If the first consultant sets up egress ACLs and they get a new netblock chances are the next consultant will just remove the ACL instead of updating it... Medium to large ISPs: IRRs are supposed to solve this but implementation is spotty / OMG scripting changes on routers / etc. http://www.irr.net/docs/list.html http://www.irr.net/docs/list.html High end: I've heard that some providers have so many customers landing on a given aggregation router that the ACLs from IRRs end up too large for the router. Cogent's approach is to require a LOA for the subnets that you are announcing and filter out everything else. This seems reasonable, though it gets annoying when you have a downstream AS that has downstream ASes (BUT that's fairly uncommon). I use egress ACLs that allow my RIR-issued and downstream customer blocs and drop everything else. I have a friend that runs a slightly larger ISP (5x more downstream ASes) that does automation with IRRs.