North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: BGP Attack - Best Defense ?

  • From: Scott Weeks
  • Date: Fri Aug 29 18:00:52 2008 

Please allow me to change this:

"I then would deaggregate (as little as possible) to be able to announce the same more specific as the attacker."

to this:

"Announce the same more specific as the attacker."

scott



--- [email protected] wrote:

From: "Scott Weeks" <[email protected]>
To: <[email protected]>
Subject: BGP Attack - Best Defense ?
Date: Fri, 29 Aug 2008 14:29:21 -0700




My question revolves around the best recovery from an attack of the type we've been discussing.  I only figured out the attack methodology yesterday evening Hawaiian Standard Time.  Be gentle please...  :-)



I am signed up for the Prefix Hijack Alert System (phas.netsec.colostate.edu) and would be alerted in about 6 hours (or less?) about a prefix announcement change.

I then would deaggregate (as little as possible) to be able to announce the same more specific as the attacker.

The topologically closer ASs would then start sending the traffic to me properly.  Those topologically closest to the attacker would still send to the attack path.

I would then try to contact the ASs still using the attack path to get it stopped.  (Yell help on NANOG? ;-)



Is this the best recovery plan at this time?
scott