[88284] in North American Network Operators' Group
Re: So -- what did happen to Panix?
daemon@ATHENA.MIT.EDU (Joe Abley)
Fri Jan 27 11:39:56 2006
In-Reply-To: <20060127161205.GA20094@vacation.karoshi.com.>
Cc: Randy Bush <randy@psg.com>, Jared Mauch <jared@puck.nether.net>,
NANOG list <nanog@nanog.org>
From: Joe Abley <jabley@isc.org>
Date: Fri, 27 Jan 2006 11:39:27 -0500
To: bmanning@vacation.karoshi.com
Errors-To: owner-nanog@merit.edu
On 27-Jan-2006, at 11:12, bmanning@vacation.karoshi.com wrote:
> but by definition, the right-most entry is the prefix origin...
Suppose AS 9327 decides to originate 198.32.6.0/24, but prepends 4555
to the AS_PATH as it does so. Suppose 9327's uses a transit provider
which builds prefix filters from the IRR, and the "as9327" aut-num
object is modified to include policy which suggests 9327 provides
transit for 4555. Suppose this is not actually the case, though, and
in fact 9327 is a rogue AS which is trying to capture 4555's traffic.
The rest of the world sees a prefix with an AS_PATH attribute which
ends with "9327 4555".
In this case, from the point of view of those trying to discern
legitimacy of advertisements, what is the origin of the prefix? Is it
4555, or 9327?
Is it possible to tell, from just the right-most entry in the AS_PATH
attribute?
Joe
[note: 9327 is not a rogue AS, in fact. This is just hypothetical :-)]
