Re: Prefix Hijack Tool Comaprision

2008-11-17 Thread Andree Toonk
Hi all, .-- My secret spy satellite informs me that at Thu, 13 Nov 2008, Todd Underwood wrote: that's why i recommend that prefix hijacking detection systems do thresholding of peers to prevent a single, rogue, unrepresentative peer from reporting a hijacking when none is really

Prefix Hijack Tool Comaprision

2008-11-13 Thread Scott Weeks
With this last hijack, we see the comparison between PHAS and BGPmon. Does anyone use other hijack tools who would be willing to compare to these two tools wrt time to alert, number of alerts, etc. during this event? How do folks find the extent of the damage? Using BGPlay only or are

Re: Prefix Hijack Tool Comaprision

2008-11-13 Thread Hank Nussbacher
At 10:28 AM 13-11-08 -0800, Scott Weeks wrote: With this last hijack, we see the comparison between PHAS and BGPmon. Does anyone use other hijack tools who would be willing to compare to these two tools wrt time to alert, number of alerts, etc. during this event? How do folks find the

Re: Prefix Hijack Tool Comaprision

2008-11-13 Thread Todd Underwood
hank, all, On Thu, Nov 13, 2008 at 08:57:35PM +0200, Hank Nussbacher wrote: I use all 4 - BGPmon, RIPE, PHAS, and Watchmy.net. BGPMon kicks ass on all of them. RIPE showed up 5-6 hours later. PHAS and Watchmy were nowhere to be seen. is that a bug or a feature? this was a non-event in

Re: Prefix Hijack Tool Comaprision

2008-11-13 Thread Scott Weeks
--- [EMAIL PROTECTED] wrote: From: Todd Underwood [EMAIL PROTECTED] interesting, but it's not operationally significant. i would not consider the fact that PHAS and Watchmy didn't alert any particular criticism of them. but perhaps there was something else to which you were referring.

Re: Prefix Hijack Tool Comaprision

2008-11-13 Thread Alexander Harrowell
It may be the North American NOG, but it's been said before that it functions as a GNOG, G for Global. I don't think Brazil is insignificant. I respect Todd's work greatly, but I think he's wrong on this point. - original message - Subject:Re: Prefix Hijack Tool Comaprision From

Re: Prefix Hijack Tool Comaprision

2008-11-13 Thread Todd Underwood
alexander, all, On Thu, Nov 13, 2008 at 07:56:26PM +, Alexander Harrowell wrote: It may be the North American NOG, but it's been said before that it functions as a GNOG, G for Global. I don't think Brazil is insignificant. I respect Todd's work greatly, but I think he's wrong on this

Re: Prefix Hijack Tool Comaprision

2008-11-13 Thread Alexander Harrowell
OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay is great. - original message - Subject:Re: Prefix Hijack Tool Comaprision From: Todd Underwood [EMAIL PROTECTED] Date: 13/11/2008 8:05 pm alexander, all, On Thu, Nov 13, 2008 at 07:56:26PM +, Alexander

Re: Prefix Hijack Tool Comaprision

2008-11-13 Thread Jack Bates
Todd Underwood wrote: i said that *this* hijacking took place in an insignificant corner of the internet. i mean this AS-map wise rather than geographically. this hijacking didn't even spread beyond one or two ASes, one of whom just happened to be a RIPE RIS peer. Yet for someone

Re: Prefix Hijack Tool Comaprision

2008-11-13 Thread Josh Karlin
of what to send and what to drop. Mohit Date: Thu, 13 Nov 2008 20:27:32 + From: Alexander Harrowell [EMAIL PROTECTED] Subject: Re: Prefix Hijack Tool Comaprision To: Todd Underwood [EMAIL PROTECTED] Cc: nanog@nanog.org OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay