28 Aug
2008
28 Aug
'08
1:40 a.m.
On Thu, Aug 28, 2008 at 1:22 AM, Patrick W. Gilmore <patrick@ianai.net> wrote:
Assuming it is in the "wrong" place, you may be able to detect the intrusion. But most people do not run traceroutes all day and watch for it to change. If you run the traceroute after the attack starts, well, how are you to know that br01-pos07-$FOO-$BAR is wrong and br03-10GE02-$BLAH-$BAR is right?
Uhhh... network monitoring with traceroute and topology tools. There are several off-the-shelf varieties to choose from, and I know of several providers that use them. -Jim P.