Home page logo

nanog logo nanog mailing list archives

Re: So -- what did happen to Panix?
From: Jared Mauch <jared () puck nether net>
Date: Thu, 26 Jan 2006 20:01:39 -0500

On Thu, Jan 26, 2006 at 04:22:29PM -0700, Josh Karlin wrote:
The noise of origin changes is fairly heavy, somewhere in the low
hundreds of alerts per day given a 3 day history window.  Supposing a
falsely originated route was delayed, what is the chance of identifying
and fixing it before the end of the delay period?  Do operators
commonly catch misconfigurations on their own or do they usually find
out about it from other operators due to service disruption?

        Are the origin changes for a small set of the prefixes
that tend to repeat (eg: connexion as planes move), or is it a different
set of prefixes day-to-day or week-to-week?

        I suspect there are the obvious prefixes that don't change
(eg: 12/8, 18/8, 35/8, 38/8)  but subparts of that may change, but
for most people with allocations in the range of 12-17 bits, I suspect
they won't change frequently.

        - jared

Jared Mauch  | pgp key available via finger from jared () puck nether net
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]