Best practices inquiry: filtering 128/1

Tue Jul 11 06:06:22 UTC 2006

* Patrick W. Gilmore:

> Actually, I take that back.  Why wouldn't you just get a feed from
> Cymru <http://www.cymru.com/Bogons/index.html> ??

I don't think Team Cymru offers a "feed" of what is supposed to be in
the routing table.  128/1 isn't a bogon.  It's not even that useful
for hijacking adress space.

The correct approach would be to verify prefixes using somewhat
indepedent. more static data, such as RPSL data from RIRs.  The old
blacklist vs. whitelist discussoin.  (I know that creating a useful
whitelist is a huge tsak.)