Re: bad announcement taxonomy

[Owen DeLong]

> On Nov 20, 2015, at 07:07 , t...@pelican.org wrote:
> 
> On Friday, 20 November, 2015 14:05, "Jared Mauch"  
> said:
> 
>> Did someone say NAT?
>> 
>> https://www.youtube.com/watch?v=v26BAlfWBm8
> 
> Now *that's* how to make my Friday afternoon!  You, sir, win the Internet for 
> today.
> 
> Regards,
> Tim.
> 
> 

You’re awarding him this?

https://www.youtube.com/watch?v=iDbyYGrswtg 


Owen

Re: bad announcement taxonomy

[t...@pelican.org]

On Friday, 20 November, 2015 14:05, "Jared Mauch"  said:

> Did someone say NAT?
> 
> https://www.youtube.com/watch?v=v26BAlfWBm8

Now *that's* how to make my Friday afternoon!  You, sir, win the Internet for 
today.

Regards,
Tim.

Re: bad announcement taxonomy

[Jared Mauch]

Did someone say NAT?

https://www.youtube.com/watch?v=v26BAlfWBm8

- Jared

> On Nov 19, 2015, at 4:03 PM, Baker, Byrn  wrote:
> 
> Don't get on Kens bad side.
> 
> 
> 
> -Original Message-
> From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Ken Matlock
> Sent: Thursday, November 19, 2015 12:44 PM
> To: valdis.kletni...@vt.edu
> Cc: North American Network Operators' Group
> Subject: Re: bad announcement taxonomy
> 
> Origin NAT? ;)
> 
> Ken
> 
>> On Nov 18, 2015, at 11:15 PM, valdis.kletni...@vt.edu wrote:
>> 
>> On Wed, 18 Nov 2015 18:21:32 -0600, David Edelman said:
>>> How about Origin Obfuscation
>> 
>> Obfuscation implies intent.  Most leaks and mis-announcements don't 
>> have intent because they're whoopsies.

RE: bad announcement taxonomy

[Baker, Byrn]

Don't get on Kens bad side.



-Original Message-
From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Ken Matlock
Sent: Thursday, November 19, 2015 12:44 PM
To: valdis.kletni...@vt.edu
Cc: North American Network Operators' Group
Subject: Re: bad announcement taxonomy

Origin NAT? ;)

Ken

> On Nov 18, 2015, at 11:15 PM, valdis.kletni...@vt.edu wrote:
> 
> On Wed, 18 Nov 2015 18:21:32 -0600, David Edelman said:
>> How about Origin Obfuscation
> 
> Obfuscation implies intent.  Most leaks and mis-announcements don't 
> have intent because they're whoopsies.

Re: bad announcement taxonomy

[Randy Bush]

> Well, if you take a route, change its origin as your own (or any
> other) and re-announce it (perhaps just a smaller prefix of it) I
> would assume some intent.
> 
> Or they are super whoopsies.

the original 7007, telkom malasia, ... were super whoopsies.  the
classic of redistributing bgp into igp and then igp back to bgp
(unfiltered, no sugar or cream).  the kind of stuff we warn about in
class.

randy

Re: bad announcement taxonomy

[Valdis . Kletnieks]

On Thu, 19 Nov 2015 15:24:09 -0800, Arturo Servin said:

> Well, if you take a route, change its origin as your own (or any other) and
> re-announce it (perhaps just a smaller prefix of it) I would assume some
> intent.
>
> Or they are super whoopsies.

AS7007 was a whoopsie.  And in fact, I'll go out on a limb and say that
most, if not all, EGP->IGP->EGP re-injections are whoopsies.

Because let's face it, if you had *intent*, you'd just start announcing it.

Re: bad announcement taxonomy

[Arturo Servin]

On Wed, Nov 18, 2015 at 10:15 PM,  wrote:

> > How about Origin Obfuscation
>
> Obfuscation implies intent.  Most leaks and mis-announcements don't
> have intent because they're whoopsies.
>

Well, if you take a route, change its origin as your own (or any other) and
re-announce it (perhaps just a smaller prefix of it) I would assume some
intent.

Or they are super whoopsies.

.as

Re: bad announcement taxonomy

[Ken Matlock]

Origin NAT? ;)

Ken

> On Nov 18, 2015, at 11:15 PM, valdis.kletni...@vt.edu wrote:
> 
> On Wed, 18 Nov 2015 18:21:32 -0600, David Edelman said:
>> How about Origin Obfuscation
> 
> Obfuscation implies intent.  Most leaks and mis-announcements don't
> have intent because they're whoopsies.

Re: bad announcement taxonomy

[Randy Bush]

> So 7007 (laundering) might be (or not) a subset of a hijack which is a
> subset of mis-origination.
> What's the tree for a leak? I think a more structured approach is
> necessary if we are to delve on
> both technical definitions and intent.

you can make it as complex as you want.  and you're not even the worst i
have been sent.  but i won't play.  i believe those terms are sufficient
and can be combined.

randy

Re: bad announcement taxonomy

[Aris Lambrianidis]

Randy Bush wrote:
> some friends and i were talking about recent routing cfs, and found we
> needed a clearer taxonomy.  i throw this out.
>
> leak - i receive P and send it on to folk to whom i should not send
>it for business reasons (transit, peer, ...)
>
> mis-origination - i originate P when i do not own it
>
> hijack - an intentional mis-origination
>
> 7007 - i receive P (or some sub/superset), process it in some way
>(likely through my igp), and re-originate it, or part of it,
>as my own
>
> we need a name for 7007 other then vinnie
So 7007 (laundering) might be (or not) a subset of a hijack which is a
subset of mis-origination.
What's the tree for a leak? I think a more structured approach is
necessary if we are to delve on
both technical definitions and intent.

--Aris

Re: bad announcement taxonomy

[Valdis . Kletnieks]

On Wed, 18 Nov 2015 18:21:32 -0600, David Edelman said:
> How about Origin Obfuscation

Obfuscation implies intent.  Most leaks and mis-announcements don't
have intent because they're whoopsies.


pgpjuzzo1qQew.pgp
Description: PGP signature

Re: bad announcement taxonomy

[David Edelman]

How about Origin Obfuscation

--Dave

Dave Edelman


> On Nov 18, 2015, at 16:51, Joe Abley  wrote:
> 
> 
> 
>> On 18 Nov 2015, at 15:55, Arturo Servin wrote:
>> 
>> Laundered route
> 
> The routes in question are not just being laundered, they're being bleached.
> 
> 
> Joe

Re: bad announcement taxonomy

[Joe Abley]

On 18 Nov 2015, at 15:55, Arturo Servin wrote:

> Laundered route

The routes in question are not just being laundered, they're being bleached.


Joe

Re: bad announcement taxonomy

[Arturo Servin]

Laundered route

I like it.

Or re-originated laundered route (it has more meaning but a bit too long)

.as

On Wed, 18 Nov 2015 at 09:33 Casey Russell  wrote:

> I think Tony's on the right track here.  I vote we call this "Route
> Laundering", the people who do it "Route Launderers", and the routes
> themselves "Laundered Routes".
>
> I actually had a little trouble spelling the different forms of
> laundering.  So I looked them up..
>
>
> "I can't believe what a bunch of nerds we are. We're looking up "money
> laundering" in a dictionary."
>
> Casey Russell
> Network Engineer
> Kansas Research and Education Network
>
> 2029 Becker Drive, Suite 282
>
> Lawrence, KS  66047
> (785)856-9820  ext 9809
> cruss...@kanren.net
>
> On Wed, Nov 18, 2015 at 4:40 AM, Tony Finch  wrote:
>
> > Randy Bush  wrote:
> > >
> > > leak - i receive P and send it on to folk to whom i should not send
> > >it for business reasons (transit, peer, ...)
> > >
> > > 7007 - i receive P (or some sub/superset), process it in some way
> > >(likely through my igp), and re-originate it, or part of it,
> > >as my own
> > >
> > > we need a name for 7007 other then vinnie
> >
> > Laundered leak?
> >
> > Tony.
> > --
> > f.anthony.n.finchhttp://dotat.at/
> > German Bight, Humber, Thames, Dover: West or northwest, backing southwest
> > for
> > a time, 6 to gale 8, increasing severe gale 9 at times, perhaps storm 10
> > later
> > in German Bight and Humber. Rough or very rough, occasionally high later
> in
> > German Bight and Humber. Rain at times. Good, occasionally poor.
> >
>

Re: bad announcement taxonomy

[Casey Russell]

I think Tony's on the right track here.  I vote we call this "Route
Laundering", the people who do it "Route Launderers", and the routes
themselves "Laundered Routes".

I actually had a little trouble spelling the different forms of
laundering.  So I looked them up..


"I can't believe what a bunch of nerds we are. We're looking up "money
laundering" in a dictionary."

Casey Russell
Network Engineer
Kansas Research and Education Network

2029 Becker Drive, Suite 282

Lawrence, KS  66047
(785)856-9820  ext 9809
cruss...@kanren.net

On Wed, Nov 18, 2015 at 4:40 AM, Tony Finch  wrote:

> Randy Bush  wrote:
> >
> > leak - i receive P and send it on to folk to whom i should not send
> >it for business reasons (transit, peer, ...)
> >
> > 7007 - i receive P (or some sub/superset), process it in some way
> >(likely through my igp), and re-originate it, or part of it,
> >as my own
> >
> > we need a name for 7007 other then vinnie
>
> Laundered leak?
>
> Tony.
> --
> f.anthony.n.finchhttp://dotat.at/
> German Bight, Humber, Thames, Dover: West or northwest, backing southwest
> for
> a time, 6 to gale 8, increasing severe gale 9 at times, perhaps storm 10
> later
> in German Bight and Humber. Rough or very rough, occasionally high later in
> German Bight and Humber. Rain at times. Good, occasionally poor.
>

Re: bad announcement taxonomy

[Stefan Fouant]

> On Nov 18, 2015, at 9:45 AM, Roland Dobbins  wrote:
> 
>> On 18 Nov 2015, at 21:40, William Herrin wrote:
>> 
>> Creating jargon down in the weeds, though, that's a bad thing.
> 
> 'AS 7007' is jargon to those unaware of the history and context.

https://en.m.wikipedia.org/wiki/AS_7007_incident

He can thank me later 😜

Stefan Fouant
JNCIE-SEC, JNCIE-SP, JNCIE-ENT, JNCI
m (703) 625-6243

Re: bad announcement taxonomy

[Nigel Titley]

On 18/11/2015 13:46, Randy Bush wrote:

how about re-origination?

+1 Mis-distribution. or may be Mis-redistribution

you lost the part of the language which made clear that the *origin* has
been changed.

Fenced

Re: bad announcement taxonomy

[Mattia Rossi]

Am 18.11.2015 um 13:08 schrieb William Herrin:

On Wed, Nov 18, 2015 at 6:51 AM, William Herrin  wrote:

On Wed, Nov 18, 2015 at 5:06 AM, Randy Bush  wrote:

some friends and i were talking about recent routing cfs, and found we
needed a clearer taxonomy.  i throw this out.

leak - i receive P and send it on to folk to whom i should not send
it for business reasons (transit, peer, ...)

mis-origination - i originate P when i do not own it

hijack - an intentional mis-origination

7007 - i receive P (or some sub/superset), process it in some way
(likely through my igp), and re-originate it, or part of it,
as my own

we need a name for 7007 other then vinnie

mis-origination. When you non-maliciously announce P as if you own it
(even though you do not) the exact details of how you screwed the
pooch are not externally important. And we have enough obscure names
for things as it is.

For that matter, just call it a hijack like it is. Don't legitimize
originating a prefix you don't own by giving it an innocuous name.


So probably it should be structured like this:

  _ leak
/
hijack - mis-origination (which should be better 
described as: I originate P when I don't have the right to)

   \__ origin scrubbing (I like that)

It's a hijack (the result)  in any case. If you want to differentiate 
between malice and stupidity/ignorance just call it "malicious hijack" 
opposed to  "accidental hijack". And then list the cause (leak, 
mis-origination, origin scrubbing)


Cheers,

Mat

Re: bad announcement taxonomy

[Matthias Waehlisch]

On Wed, 18 Nov 2015, Randy Bush wrote:

> >> 7007 - i receive P (or some sub/superset), process it in some way
> >>(likely through my igp), and re-originate it, or part of it,
> >>as my own
> >>
> >> we need a name for 7007 other then vinnie
> > 
> > Laundered leak?
> 
> how about re-origination?
> 
  might be misleading in case you don't re-originate P exactly but only 
"part of it". 

  What about "origin scrubbing".


Cheers
  matthias


-- 
Matthias Waehlisch
.  Freie Universitaet Berlin, Inst. fuer Informatik, AG CST
.  Takustr. 9, D-14195 Berlin, Germany
.. mailto:waehli...@ieee.org .. http://www.inf.fu-berlin.de/~waehl
:. Also: http://inet.cpt.haw-hamburg.de .. http://www.link-lab.net

Re: bad announcement taxonomy

[Roland Dobbins]

On 18 Nov 2015, at 21:40, William Herrin wrote:

> Creating jargon down in the weeds, though, that's a bad thing.

'AS 7007' is jargon to those unaware of the history and context.

---
Roland Dobbins 

Re: bad announcement taxonomy

[William Herrin]

On Wed, Nov 18, 2015 at 8:50 AM, Mattia Rossi
 wrote:
> So probably it should be structured like this:
>
>   _ leak
> /
> hijack - mis-origination (which should be better described
> as: I originate P when I don't have the right to)
>\__ origin scrubbing (I like that)
>
> It's a hijack (the result)  in any case. If you want to differentiate
> between malice and stupidity/ignorance just call it "malicious hijack"
> opposed to  "accidental hijack". And then list the cause (leak,
> mis-origination, origin scrubbing)


Hi Mat,

I object to jargon on general principle. Excessive jargon makes
technical disciplines needlessly inaccessible to folks who aren't
steeped in the lore.

Now and then there's a concept of such routine utility within the
discipline that it's worth abbreviating into a word or short phrase.
In that case, words that imply the concept are a good choice. Route
Hijack is a good example of this.

Creating jargon down in the weeds, though, that's a bad thing. Unwise.
Something to be deliberately avoided.

Regards,
Bill Herrin



-- 
William Herrin  her...@dirtside.com  b...@herrin.us
Owner, Dirtside Systems . Web: 

Re: bad announcement taxonomy

[Alejandro Acosta]

El 11/18/2015 a las 7:16 AM, Randy Bush escribió:
>>> how about re-origination?
>> +1 Mis-distribution. or may be Mis-redistribution
> you lost the part of the language which made clear that the *origin* has
> been changed.

mutant?

>
> randy

Re: bad announcement taxonomy

[William Herrin]

On Wed, Nov 18, 2015 at 6:51 AM, William Herrin  wrote:
> On Wed, Nov 18, 2015 at 5:06 AM, Randy Bush  wrote:
>> some friends and i were talking about recent routing cfs, and found we
>> needed a clearer taxonomy.  i throw this out.
>>
>> leak - i receive P and send it on to folk to whom i should not send
>>it for business reasons (transit, peer, ...)
>>
>> mis-origination - i originate P when i do not own it
>>
>> hijack - an intentional mis-origination
>>
>> 7007 - i receive P (or some sub/superset), process it in some way
>>(likely through my igp), and re-originate it, or part of it,
>>as my own
>>
>> we need a name for 7007 other then vinnie
>
> mis-origination. When you non-maliciously announce P as if you own it
> (even though you do not) the exact details of how you screwed the
> pooch are not externally important. And we have enough obscure names
> for things as it is.

For that matter, just call it a hijack like it is. Don't legitimize
originating a prefix you don't own by giving it an innocuous name.

-Bill


-- 
William Herrin  her...@dirtside.com  b...@herrin.us
Owner, Dirtside Systems . Web: 

Re: bad announcement taxonomy

[Randy Bush]

> Reorigination?

tried that and folk have been pushing back

> Mis-re-origination?

remiss-origination?  :)

Re: bad announcement taxonomy

[Todd Underwood]

Reorigination?

Mis-re-origination?
On Nov 18, 2015 22:53, "Randy Bush"  wrote:

> > What about "origin scrubbing".
>
> so now it has no origin?
>

Re: bad announcement taxonomy

[William Herrin]

On Wed, Nov 18, 2015 at 5:06 AM, Randy Bush  wrote:
> some friends and i were talking about recent routing cfs, and found we
> needed a clearer taxonomy.  i throw this out.
>
> leak - i receive P and send it on to folk to whom i should not send
>it for business reasons (transit, peer, ...)
>
> mis-origination - i originate P when i do not own it
>
> hijack - an intentional mis-origination
>
> 7007 - i receive P (or some sub/superset), process it in some way
>(likely through my igp), and re-originate it, or part of it,
>as my own
>
> we need a name for 7007 other then vinnie

mis-origination. When you non-maliciously announce P as if you own it
(even though you do not) the exact details of how you screwed the
pooch are not externally important. And we have enough obscure names
for things as it is.

-Bill

-- 
William Herrin  her...@dirtside.com  b...@herrin.us
Owner, Dirtside Systems . Web: 

Re: bad announcement taxonomy

[Randy Bush]

> What about "origin scrubbing".

so now it has no origin?

Re: bad announcement taxonomy

[Randy Bush]

>> how about re-origination?
> 
> +1 Mis-distribution. or may be Mis-redistribution

you lost the part of the language which made clear that the *origin* has
been changed.

randy

Re: bad announcement taxonomy

[Aftab Siddiqui]

On Wed, 18 Nov 2015 at 22:29 Randy Bush  wrote:

> >> 7007 - i receive P (or some sub/superset), process it in some way
> >>(likely through my igp), and re-originate it, or part of it,
> >>as my own
> >>
> >> we need a name for 7007 other then vinnie
> >
> > Laundered leak?
>
> how about re-origination?
>

+1 Mis-distribution. or may be Mis-redistribution

Leak, Mis-origination, Hijack.. they all have something in common i.e.
#culprit
but re-origination sounds pretty legitimate.
-- 
Best Wishes,

Aftab A. Siddiqui

Re: bad announcement taxonomy

[Randy Bush]

>> 7007 - i receive P (or some sub/superset), process it in some way
>>(likely through my igp), and re-originate it, or part of it,
>>as my own
>>
>> we need a name for 7007 other then vinnie
> 
> Laundered leak?

how about re-origination?

Re: bad announcement taxonomy

[Tony Finch]

Randy Bush  wrote:
>
> leak - i receive P and send it on to folk to whom i should not send
>it for business reasons (transit, peer, ...)
>
> 7007 - i receive P (or some sub/superset), process it in some way
>(likely through my igp), and re-originate it, or part of it,
>as my own
>
> we need a name for 7007 other then vinnie

Laundered leak?

Tony.
-- 
f.anthony.n.finchhttp://dotat.at/
German Bight, Humber, Thames, Dover: West or northwest, backing southwest for
a time, 6 to gale 8, increasing severe gale 9 at times, perhaps storm 10 later
in German Bight and Humber. Rough or very rough, occasionally high later in
German Bight and Humber. Rain at times. Good, occasionally poor.

Re: bad announcement taxonomy

[Roland Dobbins]

On 18 Nov 2015, at 17:06, Randy Bush wrote:

> we need a name for 7007 other then vinnie

Mis-distribution?

---
Roland Dobbins 

bad announcement taxonomy

[Randy Bush]

some friends and i were talking about recent routing cfs, and found we
needed a clearer taxonomy.  i throw this out.

leak - i receive P and send it on to folk to whom i should not send
   it for business reasons (transit, peer, ...)

mis-origination - i originate P when i do not own it

hijack - an intentional mis-origination

7007 - i receive P (or some sub/superset), process it in some way
   (likely through my igp), and re-originate it, or part of it,
   as my own

we need a name for 7007 other then vinnie

randy