Revealed: The Internet's well known BGP behavior
Patrick W. Gilmore
patrick at ianai.net
Thu Aug 28 00:22:21 CDT 2008
On Aug 28, 2008, at 12:32 AM, John Lee wrote:
> Thanks guys, going back to my Comer one more time. My issue,
> question was whether the organization doing the hijacking controlled
> all of the routers in the new modified path or only some of them?
That is correct. However, once a packet hits the miscreant's device,
the traceroute is defeated.
Assuming their device is in the right place, you will not be able to
see the difference.
Assuming it is in the "wrong" place, you may be able to detect the
intrusion. But most people do not run traceroutes all day and watch
for it to change. If you run the traceroute after the attack starts,
well, how are you to know that br01-pos07-$FOO-$BAR is wrong and
br03-10GE02-$BLAH-$BAR is right?
More information about the NANOG