4 ms·

I worked for a dial-up ISP that was going out of business and their last hurrah was selling renting servers doling out clean IPs from their /16 blocks so the cl

I worked for a dial-up ISP that was going out of business and their last hurrah was selling renting servers doling out clean IPs from their /16 blocks so the clients could spam like crazy. Then we encountered these spammers were willing to forge BGP LOA stating that they could announce certain, defunct and unused blocks on BGP. I left there in a hurry, but it seems like they got away with it for a while. It would've been pretty catastrophic if their upstream ISPs decided to cut them off because they were announcing blocks they should not have been.

tialaramex 3y ago
Of course if the transit providers did a better job (to be fair you're talking about years ago when this wasn't close to practical) they'd reject the announcements as bogus, no need for administrative punishment if it just doesn't work so nobody tries it. Today RPKI means that machines can in effect authenticate the LOA, the same way your web server is able to prove it's itchyouch.example (or whatever) to a web browser, the real owners of 203.0.113.0/24 can prove to a machine they're the real deal and you aren't. Unfortunately there are still transit providers who don't do that, or have it set just to bring the discrepancy to the attention of a human.
- icedchai 3y ago
  Last I checked, RPKI was still not in use for the majority of prefixes: https://rpki-monitor.antd.nist.gov/ROV https://rpki-monitor.antd.nist.gov/ROV This is likely true for much of the legacy space in the US, since ARIN requires you sign their registry agreement and actually pay fees to enable RPKI. It's not grandfathered.