[anti-abuse-wg] AS8003 and U.S. Department of Defense routing

Randy,

Ah, I don't know how that happened, but Ronald X-posted to Routing and I managed not to. Don't worry, we're not trying to steal their family jewels. 🙂

Brian


Brian Nisbet (he/him)

Service Operations Manager

HEAnet CLG, Ireland's National Education and Research Network

1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland

+35316609040 brian.nisbet at heanet.ie www.heanet.ie

Registered in Ireland, No. 275301. CRA No. 20036270

________________________________
From: Randy Bush <randy at psg.com>
Sent: Tuesday 27 April 2021 16:22
To: Brian Nisbet <brian.nisbet at heanet.ie>
Cc: Anti Abuse WG <anti-abuse-wg at ripe.net>
Subject: Re: [anti-abuse-wg] AS8003 and U.S. Department of Defense routing

CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe.


interesting wg to do routing security analysis.

as i do really not know the dod's or their proxy's motive(s), i can not
say much about their tactics let alone strategy.

i do know, and have actually seen and experienced, part of 11/8 being
used as if it was 1918 space; ripe bologna was the first time.  and the
food in that town was fantastic!

a /8 telescope would pick up leakage patterns as well as the current
shotgun blast of announcements (i presume folk have looked at the actual
announcements).  i would naïvely think that the /8 might be slightly
more easily analyzed than the pieces.

maybe, as the telescope analysis shows focused leaks, they are trying to
disrupt those focused uses with these focused announcements.

but, if an op is using 11.12.666.0/23 internally, would they be careless
enough to accept an exogenous announcement of that space?  i guess i
should not underestimate carelessness.

is some random (small, i hope) isp using my address space internally as
1918 equivalent abusive, beyond their customers maybe not be able to
reach my network?  if so, maybe the vigilantes are looking in the wrong
direction.

randy

---
randy at psg.com
`gpg --locate-external-keys --auto-key-locate wkd randy at psg.com`
signatures are back, thanks to dmarc header butchery
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20210427/e28340c3/attachment.html>