Home page logo

nanog logo nanog mailing list archives

Re: So -- what did happen to Panix?
From: Josh Karlin <karlinjf () cs unm edu>
Date: Thu, 26 Jan 2006 18:14:59 -0700

I unfortunately don't have answers to those questions, but you've
piqued my interest so I will try to look into it within the next
couple of days.


On 1/26/06, Jared Mauch <jared () puck nether net> wrote:
On Thu, Jan 26, 2006 at 04:22:29PM -0700, Josh Karlin wrote:
The noise of origin changes is fairly heavy, somewhere in the low
hundreds of alerts per day given a 3 day history window.  Supposing a
falsely originated route was delayed, what is the chance of identifying
and fixing it before the end of the delay period?  Do operators
commonly catch misconfigurations on their own or do they usually find
out about it from other operators due to service disruption?

        Are the origin changes for a small set of the prefixes
that tend to repeat (eg: connexion as planes move), or is it a different
set of prefixes day-to-day or week-to-week?

        I suspect there are the obvious prefixes that don't change
(eg: 12/8, 18/8, 35/8, 38/8)  but subparts of that may change, but
for most people with allocations in the range of 12-17 bits, I suspect
they won't change frequently.

        - jared

Jared Mauch  | pgp key available via finger from jared () puck nether net
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]