Methods and apparatus for managing network traffic

1. A method of managing undesirable network traffic transmitted from a source node to a destination node over a communications network, comprising:

receiving, by a computing device, a first notification of a routing rule change for the destination node;

determining, by a computing device, a first network entity corresponding to the destination node and indicated by the first notification;

determining, based on the first network entity, an identifier;

determining, by a computing device, a network address of a node maintaining network routing rules for the first network entity and the destination node based on the identifier and public data;

querying, by a computing device, the node maintaining network routing rules for one or more routing rules based on the network address;

receiving a response to the query from the node maintaining network routing rules;

determining, via a computing device, one or more network routing rules based on the response to the query;

applying at least one of the determined one or more network routing rules to at least one network device;

determining a network path toward the source node;

determining a network address for a device managed by a second network entity, different than the first network entity, based on the network path;

determining the second network entity based on the network path and the network address of the device managed by the second network entity;

determining, based on the second network entity, a second identifier;

determining a node maintaining network routing rules for the second network entity based on the second identifier and public data; and

transmitting, by a computing device, a second notification of the routing rule change to the node maintaining network routing rules for the second network entity over the communications network.

2. The method of claim 1 , wherein an applied network routing rule governs network traffic between the source and destination node.

3. The method of claim 1 , wherein the public data is public Domain Name Service (DNS) data.

4. The method of claim 1 , further comprising authenticating the first notification by successfully decrypting data indicated by the first notification.

5. The method of claim 1 , wherein determining a network path comprises performing Internet Control Message Protocol (ICMP) source routing.

6. The method of claim 1 , wherein determining a network path comprises performing a reverse Domain Name Service (DNS) lookup.

7. The method of claim 1 , wherein the first notification of the routing rule change is received by a third network entity, and determining a network path is based on routing tables maintained by the third network entity.

8. The method of claim 1 , wherein determining a network path is based, at least in part, on a log of packets transmitted or received over a particular network interface.

9. The method of claim 1 , wherein determining the second network entity based on the network path comprises:

determining an upstream node on the network path; and

determining a second node maintaining network routing rules for the upstream node on the network path, wherein the second node is maintained by the second network entity.

10. An apparatus for managing undesirable network traffic transmitted from a source node to a destination node over a communications network, comprising:

one or more hardware processors; and

one or more memories, coupled to the one or more processors, wherein the one or more processors are configured to fetch instructions from the one or more memories, and the one or more memories are configured to store:

a notification module comprising processor instructions configured to receive a first notification of a routing rule change for the destination node;

an authentication module comprising processor instructions configured to:

determine a first network entity corresponding to the destination node and indicated by the first notification,

determine, based on the first network entity, an identifier;

determine a network address of a node maintaining network routing rules for the first network entity and the destination node based on the identifier and public data;

query the node maintaining network routing rules for one or more routing rules based on the network address;

receive a response to the query from the node maintaining network routing rules;

determine one or more network routing rules based on the response to the query;

a network device control module comprising processor instructions configured to apply at least one of the determined one or more network routing rules to at least one network device;

a network path determination module comprising processor instructions configured to determine a network path toward the source node;

an entity determination module comprising processor instructions configured to:

determine a network address for a device managed by a second network entity, different than the first network entity, based on the network path, and

determine the second network entity based on the network path and the network address of the device managed by the second network entity;

determine, based on the second network entity, a second identifier;

determine a node maintaining network routing rules for the second network entity based on the second identifier and public data; and

an entity notification module comprising processor instructions configured to transmit a second notification of the routing rule change to the node maintaining network routing rules for the second network entity over the communications network.

11. The apparatus of claim 10 , wherein the public data is public Domain Name Service (DNS) data.

12. An apparatus for managing undesirable network traffic transmitted from a source node to a destination node over a communications network, comprising:

means for receiving a first notification of a routing rule change for the destination node;

means for determining a first network entity corresponding to the destination node and indicated by the first notification;

means for determining, based on the first network entity, an identifier;

means for determining a network address of a node maintaining network routing rules for the first network entity and the destination node based on the identifier and public data;

means for querying the node maintaining network routing rules for one or more routing rules based on the network address;

means for receiving a response to the query from the node maintaining network routing rules;

means for determining one or more network routing rules based on the response to the query;

means for applying at least one of the determined one or more network routing rules to at least one network device;

means for determining a network path toward the source node;

means for determining a network address for a device managed by a second network entity, different than the first network entity, based on the network path;

means for determining the second network entity based on the network path and the network address of the device managed by the second network entity;

means for determining, based on the second network entity, a second identifier;

means for determining a node maintaining network routing rules for the second network entity based on the second identifier and public data; and

means for transmitting, by a computing device, a second notification of the routing rule change to the node maintaining network routing rules for the second network entity over the communications network.

13. The apparatus of claim 12 , wherein the public data is public Domain Name Service (DNS) data.

14. A non-transitory, computer readable medium storing instructions that when executed by a processor cause it to perform a method for managing undesirable network traffic transmitted from a source node to a destination node over a communications network, the method comprising:

receiving a first notification of a routing rule change for the destination node;

determining a first network entity corresponding to the destination node and indicated by the first notification;

determining, based on the first network entity, an identifier;

determining a network address of a node maintaining network routing rules for the first network entity and the destination node based on the identifier and public data;

querying the node maintaining network routing rules for one or more routing rules based on the network address;

receiving a response to the query from the node maintaining network routing rules;

determining one or more network routing rules based on the response to the query;

applying at least one of the determined one or more network routing rules to at least one network device;

determining a network path toward the source node;

determining a network address for a device managed by a second network entity, different than the first network entity, based on the network path;

determining the second network entity based on the network path and the network address of the device managed by the second network entity;

determining, based on the second network entity, a second identifier;

determining a node maintaining network routing rules for the second network entity based on the second identifier and public data; and

transmitting, by a computing device, a second notification of the routing rule change to the node maintaining network routing rules for the second network entity over the communications network.

15. The non-transitory, computer readable medium of claim 14 , wherein the public data is public Domain Name Service (DNS) data.