Summary

  • Petros Gigis told RIPE 92 that packet counters and BGP can flag an unfamiliar ingress point, but cannot establish whether traffic claiming a source address actually came from that source.
  • His openPenny tool selects a small TCP traffic slice, deliberately drops a few packets and looks for retransmission. In his own technical account, tests with 12 dropped packets across multiple flows reached false-positive rates as low as one in a million; that is a tested configuration, not a promise for every network.

The alarm says a prefix has appeared at an unexpected entrance. Before an operator starts hunting a route leak, Petros Gigis wants to know whether the packets carry an honest source address. A forger can put someone else's prefix into a stream. The ingress counter dutifully records its arrival, and the resulting incident may exist only in the dashboard.

At RIPE 92, Gigis presented openPenny as a way for a transit ISP to separate these cases. The network might have several points of presence and notice a source prefix arriving where it rarely has. NetFlow and sFlow show where and how much traffic entered. BGP shows advertised paths. Neither observation by itself verifies that the arriving packets came from the claimed source. In the question period, Jen Linkova asked why the ISP could not simply inspect the TCP handshake. Gigis's answer was about position: a network carrying a connection between others does not terminate it or have the endpoint's connection state.

OpenPenny uses a more mischievous test. Its passive mode watches selected mirrored flows without changing traffic. Its active mode diverts a narrow slice through a local analysis box, drops a small number of TCP packets and checks whether the flow retransmits them. A real closed-loop connection can react to missing data; one-way spoofed packets cannot answer in the same way. The official talk description identifies commodity x86 hardware and packet-processing frameworks for the proposed ISP deployment.

The researchers' reported 12 drops were spread across multiple flows. In the conditions they tested, the false-positive rate fell as low as one in a million. Gigis also lists the complications: loss elsewhere, load balancing, different TCP behaviour and an adversary trying to imitate a response. A positive test establishes a genuine component of the observed aggregate. The exact route and cause of its change still require investigation.

That is the useful division of labour. An ISP can spend hours explaining an apparent path shift that was merely spoofed background traffic. It can also miss a real data-plane detour if the control-plane route never reached its monitors. Gigis's test aims to make the ingress observation credible before either mistake becomes an operational decision. The scarce resource it protects is the engineer's attention.

Sources: RIPE 92 primary transcript · official talk page · RIPE 92 RACI profile · Gigis's technical account.