----------- scg@gibbard.org wrote: --------------
I am signed up for the Prefix Hijack Alert System
(phas.netsec.colostate.edu) and would be alerted in about 6 hours (or
less?) about a prefix announcement change.I then would deaggregate (as little as possible) to be able to announce
the same more specific as the attacker.
Announcing the same prefix length as the attacker would get you back some
portion of your traffic, rather than all of it. You'd really want to
announce something more specific than what the attacker is announcing.