Re: NTT->HE earlier today (~10am EDT)

[Tore Anderson <tore () fud no>]

* Mike Leber

> I was thinking that when I posted yesterday.
>
> These were announcements from a peer, not customer routes.
>
> We are lowering our max prefix limits on many peers as a result of this.
>
> We are also going towards more prefix filtering on peers beyond bogons 
> and martians.

Hi Mike,

You're not mentioning RPKI here. Any particular reason why not?

If I understand correctly, in today's leak the origin AS was
changed/reset, so RPKI ought to have saved the day. (At least Grzegorz'
day, considering that 33 of AS43996's prefixes are covered by ROAs.)

Tore

> > At Tue, 30 Jun 2015 10:27:21 +0200, Grzegorz Janoszka wrote:
> > > We have just received alert from bgpmon that AS58587 Fiber @ Home
> > > Limited has hijacked most of our (AS43996) prefixes and Hurricane
> > > Electric gladly accepted them.