Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-06-29 Thread Randy Bush
> as the recent L(3)/TM global disaster made quite clear, it is not > architecture; it's marketing literature. and let's give a shoutout to jared and mike randy

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-06-29 Thread Randy Bush
hi lazarus, >> in any case the idea still seems silly. > not if you need to appear to be DOING SOMETHING!!! Of course there is that. But in order to be appear to be doing something one has to pledge to do BCP38 and various other things I would consider BCP. All little bits h

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-06-29 Thread Bill Woodcock
> On Apr 16, 2015, at 3:58 AM, David Hofstee wrote: > > Hi, > > I saw the following and thought it would be interesting to share. In case of > a persistent DDoS an ASy can fallback to a small set of (more trustable) > AS'es for their routing: > http://www.trustednetworksinitiative.nl/ It is

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-06-29 Thread manning
is this any different than the architecture Rodney Joffe built 20 years ago? manning bmann...@karoshi.com PO Box 12317 Marina del Rey, CA 90295 310.322.8102 On 1May2015Friday, at 15:41, Jac Kloots wrote: > > Randy, > > On Thu, 30 Apr 2015, Randy Bush wrote: > > in any case the idea sti

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-05-01 Thread Jac Kloots
Randy, On Thu, 30 Apr 2015, Randy Bush wrote: in any case the idea still seems silly. not if you need to appear to be DOING SOMETHING!!! Of course there is that. But in order to be appear to be doing something one has to pledge to do BCP38 and various other things I would consider BCP. All l

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-29 Thread Randy Bush
>>> in any case the idea still seems silly. >> not if you need to appear to be DOING SOMETHING!!! > Of course there is that. But in order to be appear to be doing something > one has to pledge to do BCP38 and various other things I would consider > BCP. All little bits help. except the big logo ma

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-22 Thread Daniel Karrenberg
On 17.04.15 3:49 , Randy Bush wrote: >> in any case the idea still seems silly. > > not if you need to appear to be DOING SOMETHING!!! > > Of course there is that. But in order to be appear to be doing something one has to pledge to do BCP38 and various other things I would consider BCP. All

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread Randy Bush
It's only a problem when it distracts from actually doing something. randy, please excuse tiPos > On Apr 17, 2015, at 12:31, Christopher Morrow wrote: > > On Thu, Apr 16, 2015 at 9:49 PM, Randy Bush wrote: >>> in any case the idea still seems silly. >> >> not if you need to appear to be DOING

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread Christopher Morrow
On Thu, Apr 16, 2015 at 9:49 PM, Randy Bush wrote: >> in any case the idea still seems silly. > > not if you need to appear to be DOING SOMETHING!!! to be fair, I do tend to forget this point :(

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread Randy Bush
> in any case the idea still seems silly. not if you need to appear to be DOING SOMETHING!!!

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread Christopher Morrow
On Thu, Apr 16, 2015 at 4:42 PM, joel jaeggli wrote: > On 4/16/15 1:30 PM, valdis.kletni...@vt.edu wrote: >> On Thu, 16 Apr 2015 22:13:56 +0200, Job Snijders said: >> >>> If you don't want packets from 1312 don't announce to them? >> >> I'm probably at least 4-5 AS's away, and you're probably rout

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread joel jaeggli
On 4/16/15 1:30 PM, valdis.kletni...@vt.edu wrote: > On Thu, 16 Apr 2015 22:13:56 +0200, Job Snijders said: > >> If you don't want packets from 1312 don't announce to them? > > I'm probably at least 4-5 AS's away, and you're probably routed to us > through Cogent or similar large transit. Feel f

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread Valdis . Kletnieks
On Thu, 16 Apr 2015 22:13:56 +0200, Job Snijders said: > If you don't want packets from 1312 don't announce to them? I'm probably at least 4-5 AS's away, and you're probably routed to us through Cogent or similar large transit. Feel free to not announce your routes to Cogent because you don't wa

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread Job Snijders
On Thu, Apr 16, 2015 at 04:09:43PM -0400, valdis.kletni...@vt.edu wrote: > On Thu, 16 Apr 2015 15:39:46 -0400, Christopher Morrow said: > > you're asking your ISP or set of ISPs to 'stop forwarding me packets > > from X and Y and Z' > > > > sure, why do we need a new special group and designation f

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread Valdis . Kletnieks
On Thu, 16 Apr 2015 15:39:46 -0400, Christopher Morrow said: > you're asking your ISP or set of ISPs to 'stop forwarding me packets > from X and Y and Z' > > sure, why do we need a new special group and designation for that? > can't you just no-export your routes to your provider today? (or other

Re: Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread Christopher Morrow
On Thu, Apr 16, 2015 at 6:58 AM, David Hofstee wrote: > Hi, > > I saw the following and thought it would be interesting to share. In case of > a persistent DDoS an ASy can fallback to a small set of (more trustable) > AS'es for their routing: > http://www.trustednetworksinitiative.nl/ > > They h

Trusted Networks Initiative: DDoS fallback set of AS'es

2015-04-16 Thread David Hofstee
Hi, I saw the following and thought it would be interesting to share. In case of a persistent DDoS an ASy can fallback to a small set of (more trustable) AS'es for their routing: http://www.trustednetworksinitiative.nl/ They have a policy with procedural and technical parts, which may be upgrad