odd hijack

Fri Nov 10 16:55:19 UTC 2006

On Fri, Nov 10, 2006 at 11:01:02AM +0000, steve at telecomplete.co.uk wrote:
> 
> the preso link is below, you didnt read it yet.. :)
> 
> you can hijack any address space providing your route is preferred either because it is more specific, less specific, shorter as-path.. 

Slides 13-15 of our Feb 2006 NANOG talk show examples of this and describe the
motivation.  

The technique us also described in detail in our SIGCOMM paper, along with
several other observations about why doing things like looking at "uncommon
origin ASes" to detect a determined hijacker is unlikely to ever be successful
at detecting a malicious hijack (as opposed to a misconfiguration).

-Nick