Valdis.Kletnieks@vt.edu writes:

Is it the case that above.net is black-holing packets with a *destination* in the RBL, but *not* filtering packets with a *source* address from the RBL?

Please tell me how to automatically rebuild an ACL in real time based on advertisements and withdrawals in a BGP feed, and I'll recommend that everybody to that. Meanwhile, the RBL BGP feed only affects destinations.

If so, this would still allow RPC-based attacks (and TCP as well, if the victim's box had bad sequence number prediction).

Yes.