[RSSAC Caucus] Incident Response for ICANN

[Alejandro Acosta]

On 3/3/23 11:28 AM, Wessels, Duane wrote:
>
>> On Mar 2, 2023, at 7:00 PM, Alejandro Acosta <alejandro at lacnic.net> wrote:
>>
>> P.S2. I don't think it's possible, but it would be nice if there is a way to "simulate" what could have happen (scope) if the prefix would have had a ROA.
> This essentially did happen because two prefix hijacks happened at the same time: 2001:500:a8::/48 (NASA) and 2001:500:2f::/48 (ISC).  The first does not have a ROA but the second does.  According to our preliminary investigation, the hijacked prefix without ROA was seen at 5 of 520 vantage points, while the prefix with ROA was seen at 2 of 520.

This is quite interesting, thanks for sharing, nice catch, RPKI did his 
job :-)

I was not aware of the F root, I will take a look.


Thanks,


>
> DW
>
>