> -----Original Message----- > From: Heath Jones > Sent: Wednesday, September 29, 2010 5:16 AM > To: Ronald F. Guilmette > Cc: nanog@nanog.org > Subject: Re: AS11296 -- Hijacked? > > Let me reword... > What is stopping someone coming on the list, making a claim like you > have in an attempt to actually cause a DOS attack, by having some > clumsy network engineers starting to block traffic in reaction to your > post?
There would be several filters for this. Is the person reporting this a known network operator that people trust or is it some Joe Blow out of nowhere that nobody has heard of before? That would make a huge difference. Is the AS assigned to a company that is known to be defunct? That would be another flag. Why would a company that no longer exists have its ASN active and its IPs sending traffic? This would be particularly interesting if the carrier handling the traffic is not a carrier known to have a relationship with that AS in the past. So a pattern of ... AS works for many years, disappears for some period of time, company goes defunct, and some period of time later the AS appears on a completely different carrier without any reassignment from the registrar. Bottom line, there is more to it than someone just popping up on a list saying something. g
