Glossary
What Is MOAS Conflict?
A MOAS (Multiple Origin AS) conflict is when the same BGP prefix is announced by more than one autonomous system — sometimes a route hijack, sometimes legitimate anycast.
How Whisper models it
isMoas marks the prefix; CONFLICTS_WITH names each competing origin AS.
MATCH (ap:ANNOUNCED_PREFIX)-[:CONFLICTS_WITH]->(a:ASN) WHERE ap.isMoas = true RETURN ap.name, collect(a.name)[0..5] LIMIT 8
Each block of IP addresses (a prefix) should be announced into BGP by a single origin network. When two or more autonomous systems announce the same prefix, you have a MOAS — Multiple Origin AS — conflict.
MOAS has benign causes (anycast, traffic engineering, mergers) and malicious ones (BGP hijacks that redirect traffic to an attacker). Telling them apart needs context: the prefix's RPKI status, the reputation of the conflicting networks, and the routing history.
WhisperGraph surfaces MOAS directly — announced prefixes carry an `isMoas` flag and a `CONFLICTS_WITH` edge to each conflicting AS — so one query lists every prefix in conflict and the networks involved, no looking-glass tab-hopping.
See it in practice
Run it live in these use cases: Spot BGP hijacks & route anomalies.