Trusted Networks Initiative: DDoS fallback set of AS'es

Thu Apr 16 20:42:03 UTC 2015

On 4/16/15 1:30 PM, Valdis.Kletnieks at vt.edu wrote:
> On Thu, 16 Apr 2015 22:13:56 +0200, Job Snijders said:
> 
>> If you don't want packets from 1312 don't announce to them?
> 
> I'm probably at least 4-5 AS's away, and you're probably routed to us
> through Cogent or similar large transit.  Feel free to not announce your
> routes to Cogent because you don't want packets from my AS...
> 
> (For whatever value of "Cogent" you have for your upstream)

bearing in mind that transit providers rarely give you communities to
influence their customers, just peers. There is an illusion of control
that provider no export communities provide that always requires
confirmation when applied. if 1312 buys the full internet cone they can
also install a default. so they can send you packets even if they in
fact do not have your route.

my assumption is there is more default out there then generally assumed
and work to replicate the findings in

http://www.eecs.qmul.ac.uk/~steve/papers/imc099-bush.pdf

would probably find the same thing.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 243 bytes
Desc: OpenPGP digital signature
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20150416/d66c5884/attachment.sig>