His little ISP is AS267, which is a SHOCKINGLY low number. That's like.. the ISP equiv of a 4 digit slashdot id, or owning something like sodapop.com.
He's also one of the authors of RFC 5575, which is a pretty big deal in the DDoS world.
20220607|arin|US|asn|888|1|assigned|66e25d155d3f3d57ff208733b59f8cc8
20220607|arin|US|asn|889|1|assigned|5b048aafff56a02f895e68ac5188853b
20220607|arin|US|asn|890|1|assigned|708d3f11915973323c76a5f95fa2d775
20220607|arin|US|asn|891|1|assigned|ab9bfca0becd32b7fe44c7ea0ba1aac3
20220607|arin|US|asn|892|1|assigned|0b9118a23862aab1647fd26939f7b219
20220607|arin|US|asn|893|1|assigned|57d59e6dfd1cd07523724f9cf5fc572b
20220607|arin|US|asn|894|1|assigned|0a932835b90a81bffeb1539b4bc93040
There is also a market for reselling ASN's that aren't needed anymore: https://auctions.ipv4.global (filter by ASN)
Here's this one:
(An ASN is a BGP4 network number; think of it as an address in the backbone routing network.)
I'm being a bit lazy here but do you happen to know if there is a way to consume this programatically? I'm thinking RSS or perhaps an API?
Edit: For the benefit of others who might be interested, I've just subscribed using Feedbin's [0] email-to-RSS feature so updates will appear in my RSS reader!
The internet is decentralized. Basically, each autonomous system is its own network. This means that they need to connect with one another in order to allow traffic between each other. This is called peering. In order to peer with another network you must have an ASN.
The number doesn't matter.
And packet inspection is a good fit for F's [FPGA's] by their very nature, DDoS's are squirrely and ASICs get stale, you need to reprogram you F's on the fly to catch that attack in-progress. So to adapt to new attacks on the fly, or update based on new fashions of DDoS's, patch vulnerabilities, and plus they're harder to reverse-engineer than ASICs, they're strong against that, good crypto to protect the bitstreams that define them. Basically built for that. ASICs on the other hand, can just have the lid scraped, take a photo, done. (Though to some extent they do put functionality on memory that gets lost if the chip is turned off during abduction, that can be done, the line between F's and ASICs is not truly that sharp).
A lot of DDoS's are done by state-sponsored or -affiliated or -harbored adversaries, capturing the ASIC that stops the DDoS is a real thing. Reverse engineering usually happens in another country, another jurisdiction. Under smiling eyes, blind eyes, can't get the police to go there, can't get extradition, maybe sue, maybe get them punished within the country that harbors them.[1]
[1] I read in China there was a Chinese man who traveled to New Zealand and murdered somebody, I think a woman. But he would not be extradited. Instead, the New Zealanders presented their evidence in Chinese court, which found it had merit and credibility enough to imprison the murder, within China, so he paid for his crimes fully. All without extraditing one of their own.
So, not on that map, but it was part of ARPANET by the time the TCP/IP protocol was introduced in 1983[0], per this map: https://www.historyofinformation.com/image.php?id=6456
[0]: https://blog.google/inside-google/googlers/marking-birth-of-...
That protocol is called BGP, or border gateway protocol. Most people's familiarity with that initialism, if any, comes from reports of major outages which occur when BGP routing --- effectively the list of peers to which a given AS connects --- gets fuxnored. This happens with somewhat distressing regularity (though not exceptionally high frequency), and along with some other notable failure points in modern telecoms (say, SIM spoofing, DDoS, or good old social engineering) is not-so-charmingly naive in its architecture of implied trust and lack of technical safeguards against either accident or malice.
As originally specified, ASNs ranged to 65,536 distinct systems (16 bits). That's since been bumped up to 32 bits, for 4,294,967,296 distinct systems.
Some old hands would track network abuse by ASN or a somewhat finer gradation, CIDR (classless internet domain routing), which tend to aggregate poorly-behaved networks into identifiable aggregates. That was somewhat more tenable with the smaller number of providers, though power laws and Zipf functions mean that bad behaviour does stil tend to self-organise in useful ways. Growth in indirection (VPNs and Tor) challenge this somewhat, with gateways now being identified as abuse sources, which is ... problematic.
