4 ms·
How many hours / days / weeks do you need to give the announcer to produce all that evidence, before considering the action as malicious and undoing the announc
by ge0rg 8y ago
How many hours / days / weeks do you need to give the announcer to produce all that evidence, before considering the action as malicious and undoing the announcement?
Proving a business relationship sounds like a multi-day endeavor, whereas you typically want to undo the damage ASAP.
- walrus01 8y agoa few days, maximum. If you're $SMALLISP and you have a /22 of space, and your upstream is $MEDIUMISP, you give a LOA (letter of authorization) to $MEDIUMISP allowing them to announce your prefix to their peers and upstreams. If $MEDIUMISP can't produce that LOA on demand and the ARIN/RIPE/WHOIS/APNIC/AFRINIC whois data, email/admin/technical contacts for the /22 owned by $SMALLISP don't respond with "yup that's our block and we are allowing $MEDIUMISP to announce it", something highly fishy is going on.
- tatersolid 8y agoIf you think a requirement to forge a paper document is going to stop a spammer who hijacks IP space... One more count of fraud don’t mean a thing to these criminal operations.
- walrus01 8y agoI would not rely on it at all. At a certain point a bgp hijacker has to have some sort of physical interconnection to get to upstreams or an IX. Either equipment colocated at or near an IX, a transport circuit, something. Showing a forged LOA to somebody's colocation process is something that can be helpful in getting them to physically power off/disconnect a customer's equipment for abuse.