Remote

Bryton Herdes

@next_hopself@mastodon.social

mastodon 4.8.0-nightly.2026-10-06

Father of 2 | Principal Network Troublemaker at Cloudflare | JNCIE-SP #3023 | Views are my own

30 Followers

40 Following

4 Posts

Joined January 05, 2026

Bryton Herdes @next_hopself@mastodon.social

· 4mo ago

Let’s talk malformed AS_PATHs. Unless you’re enforcing the “First AS” of received routes, you’re vulnerable to hijacks that not even ASPA validation can prevent. Read more here, and enforce the First AS in BGP. https://blog.cloudflare.com/enforce-first-as-bgp/

Cloudflare Blog

Enforcing the First AS in BGP AS PATHs

BGP is vulnerable to routing hijacks and path leaks that negatively impact traffic on the Internet. RPKI helps solve some of these problems, but for some forged paths, we need to rely on a simpler mechanism: First AS enforcement in BGP.

Bryton Herdes @next_hopself@mastodon.social

· 3mo ago

ASPA object typo? Saw this in a path w/ @mingwei@infosec.exchange 🇨🇭AS8298 ↔️ 🇨🇭AS58299 ↔️ 🇺🇸AS13335 AS relationship is inferred as peer-peer between 8298 and 58299. ASPA object for AS8298 defines AS52899 as a provider, thinking that's meant to be AS58299 🙂 https://radar.cloudflare.com/routing/rpki/as8298#rpki-aspa-providers

radar.cloudflare.com

Bryton Herdes @next_hopself@mastodon.social

· 2mo ago

Our research suggests Internet routing would be better off without influence by the ORIGIN attribute. In modern BGP, it doesn’t really make sense to have. Read more in our post https://blog.cloudflare.com/bgp-origin-attribute/

Cloudflare Blog

BGP ORIGIN attribute manipulation and its impact on the Internet

By doing in-depth testing, we found nearly 70% of BGP paths experience ORIGIN attribute rewrites by transit providers seeking traffic advantages. We examine the global impact of this practice and argue for deprecating ORIGIN in route selection.

Bryton Herdes @next_hopself@mastodon.social

· 7mo ago

@mingwei@infosec.exchange and I wrote about how ASPA is going to make routing security better, and some new Cloudflare Radar features that'll help track adoption.

https://blog.cloudflare.com/aspa-secure-internet/

Cloudflare Blog

ASPA: making Internet routing more secure

ASPA is the cryptographic upgrade for BGP that helps prevent route leaks by verifying the path network traffic takes. New features in Cloudflare Radar make tracking its adoption easy.