On 3/18/10 1:22 PM, Larry Blunk wrote: > > Not easier to manipulate the origin, just better results > from such techniques. If maxlength is used, but not > all the most specifics are actually announced, an attacker could > announce a more specific from the block that will > pass validation with a manipulated origin. Without a > maxlength, they can still manipulate the origin to validate, but > they are limited to announcing a prefix of the same length > as an existing announcement. Such attacks will likely be > considerably more limited in scope of impact than a more > specific of an existing announcement.
It might also be worth noting here that while you're referring to origin *AS*, origin code manipulation in many cases will garner much more diverted traffic, even if prefixes are of equal length. E.g., some large ISPs have been known to reset "incomplete" to "internal" and have dramatic impacts on transited traffic rates.. -danny _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
