bad announcement taxonomy

Mattia Rossi mattia.rossi.mailinglists at
Wed Nov 18 13:50:14 UTC 2015

Am 18.11.2015 um 13:08 schrieb William Herrin:
> On Wed, Nov 18, 2015 at 6:51 AM, William Herrin <bill at> wrote:
>> On Wed, Nov 18, 2015 at 5:06 AM, Randy Bush <randy at> wrote:
>>> some friends and i were talking about recent routing cfs, and found we
>>> needed a clearer taxonomy.  i throw this out.
>>> leak - i receive P and send it on to folk to whom i should not send
>>>         it for business reasons (transit, peer, ...)
>>> mis-origination - i originate P when i do not own it
>>> hijack - an intentional mis-origination
>>> 7007 - i receive P (or some sub/superset), process it in some way
>>>         (likely through my igp), and re-originate it, or part of it,
>>>         as my own
>>> we need a name for 7007 other then vinnie
>> mis-origination. When you non-maliciously announce P as if you own it
>> (even though you do not) the exact details of how you screwed the
>> pooch are not externally important. And we have enough obscure names
>> for things as it is.
> For that matter, just call it a hijack like it is. Don't legitimize
> originating a prefix you don't own by giving it an innocuous name.

So probably it should be structured like this:

               _________ leak
hijack ----------------- mis-origination (which should be better 
described as: I originate P when I don't have the right to)
            \__________ origin scrubbing (I like that)

It's a hijack (the result)  in any case. If you want to differentiate 
between malice and stupidity/ignorance just call it "malicious hijack" 
opposed to  "accidental hijack". And then list the cause (leak, 
mis-origination, origin scrubbing)



More information about the NANOG mailing list