^ Top

NANOG Meeting Presentation Abstract

PHAS - A Prefix Hijack Alert System
Meeting: NANOG38
Date / Time: 2006-10-10 9:00am - 9:30am
Room: St. Louis C
Presenters: Speakers:
Mohit Lad, UCLA.
Lixia Zhang, UCLA.
Yan Chen, Colorado State University.
Dan Massey, Colorado State University.
Beichuan Zhang, University of Arizona.
Abstract: Prefix hijacking events occur due to both unintentional configuration errors and intentional attacks. The talk introduces the Prefix Hijack Alert System (PHAS). PHAS is a simple, real time notification system that alerts prefix owners if the BGP origin for their prefix changes. The central goal of PHAS is to provide reliable and timely notification of origin AS changes. Although many origin changes are valid, the design of PHAS errs on providing notifications for all the prefix origin changes to maximize users detection power. PHAS notifications follow a standard format and are delivered to multiple mailboxes of prefix owners to maximize delivery reliability even in the face of effective route hijacking. An automated mail reader with a simple filter can quickly capture real route hijacks and ignore the rest messages, providing the network administrator with rapid notification and few (if any) false positives. In addition to origin changes, PHAS also notifies changes in sub-prefix sets and last hop sets. We are in the process of deploying PHAS, and prefix owners can now register their prefixes to receive alarms by email, or check the alarms for their prefixes on the web.
Files: pdfDan Massey Presentation(PDF)
youtubePHAS - A Prefix Hijack Alert System
Sponsors: None.

Back to NANOG38 agenda.

NANOG38 Abstracts

  • ISP Security
    Moderators:
    Danny McPhersonArbor Networks; .
    Roland DobbinsCisco Systems; .
  • ISP Security
    Moderators:
    Danny McPhersonArbor Networks; .
    Roland DobbinsCisco Systems; .
  • PHAS - A Prefix Hijack Alert System
    Speakers:
    Mohit LadUCLA; .
    Lixia ZhangUCLA; .
    Yan ChenColorado State University; .
    Dan MasseyColorado State University; .
    Beichuan ZhangUniversity of Arizona; .
  • PHAS - A Prefix Hijack Alert System
    Speakers:
    Mohit LadUCLA; .
    Lixia ZhangUCLA; .
    Yan ChenColorado State University; .
    Dan MasseyColorado State University; .
    Beichuan ZhangUniversity of Arizona; .
  • PHAS - A Prefix Hijack Alert System
    Speakers:
    Mohit LadUCLA; .
    Lixia ZhangUCLA; .
    Yan ChenColorado State University; .
    Dan MasseyColorado State University; .
    Beichuan ZhangUniversity of Arizona; .
  • PHAS - A Prefix Hijack Alert System
    Speakers:
    Mohit LadUCLA; .
    Lixia ZhangUCLA; .
    Yan ChenColorado State University; .
    Dan MasseyColorado State University; .
    Beichuan ZhangUniversity of Arizona; .
  • PHAS - A Prefix Hijack Alert System
    Speakers:
    Mohit LadUCLA; .
    Lixia ZhangUCLA; .
    Yan ChenColorado State University; .
    Dan MasseyColorado State University; .
    Beichuan ZhangUniversity of Arizona; .

 
^ Back to Top