<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"Open Sans";
panose-1:2 11 6 6 3 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">It has been a few years, but I recall advertising my routes to the scrubbing center via a tunnel and just prepending to my other peers when in mitigation. This was pre-RPKI days, but my ASN was still originating the route. So, I would assume
no change in ROA would be needed in that scenario. Are you allowing them to originate your routes or are they just another hop in your as-path?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="600" style="width:6.25in;background:white;border-collapse:collapse">
<tbody>
<tr style="height:61.5pt">
<td width="310" style="width:232.5pt;padding:0in 0in 0in 0in;height:61.5pt">
<p class="MsoNormal"><span style="font-family:"Segoe UI",sans-serif;color:#0058A4">Tom Krenn<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-top:1.5pt"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#6E6D6D">Network Architect<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-top:1.5pt"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#6E6D6D">Enterprise Architecture - Information Technology<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:38.25pt">
<td width="40" style="width:30.0pt;padding:18.75pt 0in 0in 0in;height:38.25pt">
<p class="MsoNormal"><span style="font-family:"Open Sans",sans-serif;color:black"><img width="40" height="51" style="width:.4166in;height:.5312in" id="Picture_x0020_2" src="cid:image001.png@01DA18E1.DDCA93C0" alt="Hennepin County logo"></span><span style="font-family:"Open Sans",sans-serif"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="mso-ligatures:standardcontextual"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> NANOG <nanog-bounces+tom.krenn=hennepin.us@nanog.org>
<b>On Behalf Of </b>Amir Herzberg<br>
<b>Sent:</b> Thursday, November 16, 2023 19:58<br>
<b>To:</b> NANOG <nanog@nanog.org><br>
<b>Subject:</b> [External] announcing IPs by scrubbing service to help with DDoS attacks and ROAs<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left">
<tbody>
<tr>
<td style="background:#BBA555;padding:5.25pt 5.5pt 5.25pt 1.5pt"></td>
<td width="100%" style="width:100.0%;background:#FFE599;padding:5.25pt 3.75pt 5.25pt 11.25pt">
<div>
<p style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<b><span style="font-family:"Arial",sans-serif;color:#212121">CAUTION:</span></b><span style="font-family:"Arial",sans-serif;color:#212121"> This email was sent from outside of Hennepin County. Unless you recognize the sender and know the content, do not click
links or open attachments. </span><o:p></o:p></p>
</div>
</td>
</tr>
</tbody>
</table>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Hi, do people use scrubbing services, when under DDoS attack, by having the scrubbing service announce the attacked IP prefix(es)?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If so, and you have a ROA for these prefixes, do you authorize the scrubbing AS (by issuing ROA or otherwise), and if so, do you do it in advance or only when you need the scrubbing service to announce your prefix? <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">To clarify: we have a possible method to allow such `emergency ROAs' but I'm not convinced if we have a solution to a real problem - or if we just found a cute crypto solution and will end up writing it for a non-real problem. I prefer
not to waste our time on presenting cute solutions to non-real problems :) <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So thanks for your help! Use your judgement if to respond on list or off list. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Many thanks, Amir<o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal">Amir Herzberg<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Comcast professor of Security Innovations, Computer Science and Engineering, University of Connecticut<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Homepage: <a href="https://sites.google.com/site/amirherzberg/home" target="_blank">https://sites.google.com/site/amirherzberg/home</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">`Applied Introduction to Cryptography' textbook and lectures:<a href="https://sites.google.com/site/amirherzberg/cybersecurity" target="_blank">https://sites.google.com/site/amirherzberg/cybersecurity</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<br>
<b>Disclaimer:</b> If you are not the intended recipient of this message, please immediately notify the sender of the transmission error and then promptly permanently delete this message from your computer system.
</body>
</html>