best points to deploy mitigation. Route query asks a SENSS ISP about the best route it has to the cus- tomer's prefix. The provider replies with a full AS path. This enables the customer to diagnose route detour attacks and blackholing and to mitigate them. The victim networks can also ask the SENSS ISP Table 4.1 SENSS messages from the customer to the provider and replies/actions by the provider. Message Fields Reply/action Traffic query Aggregate, duration A list of <tag, #bytes or #packets, direction> for the aggregate Route query Prefix AS paths from the provider to the prefix Traffic filter Aggregate Filter all traffic matching the aggregate Bandwidth guarantee Aggregate, bw Guarantee bandwidth bw for traffic matching the aggregate Route demotion Prefix, <path> Demote route to prefix that has specified AS path segment Route modification Prefix, <path1>, Modify the false AS path segment <path2 to the correct one 4 Software-Defined Networks Principles and Applications to filter, guarantee bandwidth, demote routes, or modify routes for its traffic (see Table 4.1 for details). Traffic filter message asks a SENSS ISP to filter all traffic that matches the aggregate specification. A Bandwidth guarantee message asks a SENSS ISP to guarantee the requested bandwidth to the traffic that matches the aggregate specification. A Route demotion message asks a SENSS ISP to demote all routes to the specified prefix that contain the specified AS path segment. Route modification message asks a SENSS provider to adopt the AS path from the message to the specified prefix. For security, all mes- sages between the victims and SENSS ISPs are encrypted, signed, and timestamped. Further, a SENSS ISP verifies, using RPKI, that the customer is authorized to control traffic and routes for a given IP prefix. This ensures that networks can only influence traffic that flows to or from them. SENSS is well aligned with ISP's interests and capabilities: the infor- mation and services exposed by SENSS interfaces are similar to those that today