[atlas] 8.8.8.8 hijack and ripe atlas

On Mar 20, 2014, at 4:14 AM, Emile Aben <emile.aben at ripe.net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> On 19/03/14 14:14, Jared Mauch wrote:
>> It appears there are some public measurements like #1002630, and
>> i'm curious if someone is able to look at the latency and TTL
>> numbers of the transport side and observe the localized hijacking
>> of 8.8.8.8.
>> 
>> The dataset is somewhat huge and i'm not a json master so trying
>> to discern if there is evidence in there is something i'm looking
>> at.
> 
> This may works to get the data into an easier to digest form (requires
> the perl JSON module installed):
> 
> curl
> "https://atlas.ripe.net/api/v1/measurement/1002630/result/?start=1340323200&stop=1395273599&format=txt"
> | perl -MJSON -nle'$d=decode_json($_); print "$d->{timestamp}
> $d->{prb_id} $d->{min} $d->{ttl}"' | tee results.txt
> 
> I looked into the results a little bit and didn't find clues for a
> localized hijacking of 8.8.8.8 for the probes I looked at (out of the
> 10 total in that measurement). The fact that 8.8.8.8 is anycast may
> make it hard to distinguish between changes due to anycast flapping or
> localized hijacks.

Do the allocated probes stay fixed or rotate over time?  (I’m new here, so hope the question isn’t too dumb).

- Jared