On Fri, Mar 9, 2012 at 9:26 AM, John Levine <jo...@iecc.com> wrote: > >do, but I don't think the primary driver is spam, because spam generates > a lower > >income stream, and has higher risks of being RBL or otherwise blocked, > and can be > >achieved quickly by use of unrouted space. > > I think you overestimate how technically sophisticated snowshoers are. > I just don't see a lot of spam from hit and run route announcements. >
More like, they're as sophisticated as they need to be in their routing. All their sophistication goes into figuring out ISP spam filtering and bypassing it. Those phantom route incidents are more often than not associated with bot traffic, ddos etc rather than snowshoe spam. -- Suresh Ramasubramanian (ops.li...@gmail.com)
