- Test - lists.nanog.org

any dangers of filtering every /24 on full internet table to preserve FIB space ?
by Edvinas Kairys 27 Oct '22

27 Oct '22

Hello, We're considering to buy some Cisco boxes - NCS-55A1-24H. That box has 24x100G, but only 2.2mln route (FIB) memory entries. In a near future it will be not enough - so we're thinking to deny all /24s to save the memory. What do you think about that approach - I know it could provide some misbehavior. But theoretically every filtered /24 could be routed via smaller prefix /23 /22 /21 or etc. But of course it could be a situation when denied /24 will not be covered by any smaller prefix. What do you think about this approach ? Also maybe you know - some advices for edge routers that have at least 8x100G interfaces and "good" memory for prefix count ? Thanks

32 52

Next-gen firewalls and URL / domain reputation and classification
by Devern Adams 26 Oct '22

26 Oct '22

Greetings and good day. What products/services are folks using on their networks for domain reputation or classification-based filtering? There are various vendors (Fortinet, Palo Alto, Talos/Cisco, McAfee, etc) who maintain their own databases for this purpose, and I'm working to make sure a recently acquired domain name is classified and evaluated correctly. I have been seeing reports from end users on a handful of different ISP networks being blocked or redirected to something like safebrowse.io due to this sort of reputation-based filter. Re-classifications have been submitted to a lot of the major vendors in this space, but I don't maintain an exhaustive list, and individual ISPs seem to have varying degrees of success responding to these requests. Any input on the subject, or anecdotes from anyone with operational experience is much appreciated. Thanks, Devern -- Devern Adams devernadams(a)gmail.com

2 1

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 21 Oct '22

21 Oct '22

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 22 Oct, 2022 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 913066 Prefixes after maximum aggregation (per Origin AS): 344590 Deaggregation factor: 2.65 Unique aggregates announced (without unneeded subnets): 440326 Total ASes present in the Internet Routing Table: 73756 Prefixes per ASN: 12.38 Origin-only ASes present in the Internet Routing Table: 63346 Origin ASes announcing only one prefix: 25997 Transit ASes present in the Internet Routing Table: 10410 Transit-only ASes present in the Internet Routing Table: 406 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 55 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1071 Number of instances of unregistered ASNs: 1074 Number of 32-bit ASNs allocated by the RIRs: 40454 Number of 32-bit ASNs visible in the Routing Table: 33551 Prefixes from 32-bit ASNs in the Routing Table: 161990 Number of bogon 32-bit ASNs visible in the Routing Table: 14 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 527 Number of addresses announced to Internet: 3064300672 Equivalent to 182 /8s, 165 /16s and 132 /24s Percentage of available address space announced: 82.8 Percentage of allocated address space announced: 82.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 310145 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 238444 Total APNIC prefixes after maximum aggregation: 67879 APNIC Deaggregation factor: 3.51 Prefixes being announced from the APNIC address blocks: 233482 Unique aggregates announced from the APNIC address blocks: 96704 APNIC Region origin ASes present in the Internet Routing Table: 13033 APNIC Prefixes per ASN: 17.91 APNIC Region origin ASes announcing only one prefix: 3749 APNIC Region transit ASes present in the Internet Routing Table: 1754 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 27 Number of APNIC region 32-bit ASNs visible in the Routing Table: 8277 Number of APNIC addresses announced to Internet: 773734912 Equivalent to 46 /8s, 30 /16s and 66 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-151865 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 266668 Total ARIN prefixes after maximum aggregation: 121596 ARIN Deaggregation factor: 2.19 Prefixes being announced from the ARIN address blocks: 267868 Unique aggregates announced from the ARIN address blocks: 128736 ARIN Region origin ASes present in the Internet Routing Table: 19057 ARIN Prefixes per ASN: 14.06 ARIN Region origin ASes announcing only one prefix: 6949 ARIN Region transit ASes present in the Internet Routing Table: 1929 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 35 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4649 Number of ARIN addresses announced to Internet: 1290070784 Equivalent to 76 /8s, 228 /16s and 235 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 261853 Total RIPE prefixes after maximum aggregation: 120667 RIPE Deaggregation factor: 2.17 Prefixes being announced from the RIPE address blocks: 258723 Unique aggregates announced from the RIPE address blocks: 154172 RIPE Region origin ASes present in the Internet Routing Table: 28174 RIPE Prefixes per ASN: 9.18 RIPE Region origin ASes announcing only one prefix: 12012 RIPE Region transit ASes present in the Internet Routing Table: 3975 Average RIPE Region AS path length visible: 4.2 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10855 Number of RIPE addresses announced to Internet: 716370304 Equivalent to 42 /8s, 178 /16s and 241 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 116487 Total LACNIC prefixes after maximum aggregation: 28055 LACNIC Deaggregation factor: 4.15 Prefixes being announced from the LACNIC address blocks: 116038 Unique aggregates announced from the LACNIC address blocks: 48355 LACNIC Region origin ASes present in the Internet Routing Table: 10983 LACNIC Prefixes per ASN: 10.57 LACNIC Region origin ASes announcing only one prefix: 2685 LACNIC Region transit ASes present in the Internet Routing Table: 2246 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8746 Number of LACNIC addresses announced to Internet: 175887616 Equivalent to 10 /8s, 123 /16s and 213 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 28543 Total AfriNIC prefixes after maximum aggregation: 5600 AfriNIC Deaggregation factor: 5.10 Prefixes being announced from the AfriNIC address blocks: 36428 Unique aggregates announced from the AfriNIC address blocks: 11935 AfriNIC Region origin ASes present in the Internet Routing Table: 1699 AfriNIC Prefixes per ASN: 21.44 AfriNIC Region origin ASes announcing only one prefix: 602 AfriNIC Region transit ASes present in the Internet Routing Table: 325 Average AfriNIC Region AS path length visible: 5.0 Max AfriNIC Region AS path length visible: 31 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1024 Number of AfriNIC addresses announced to Internet: 107936768 Equivalent to 6 /8s, 110 /16s and 252 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9071 8884 50 CHINAMOBILE-CN China Mobile Communicati 7545 5928 786 694 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4192 75 ERX-CERNET-BKB China Education and Rese 7552 3594 1330 20 VIETEL-AS-AP Viettel Group, VN 7713 3501 1042 61 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3389 1877 66 VNPT-AS-VN VNPT Corp, VN 4766 2533 11252 600 KIXS-AS-KR Korea Telecom, KR 9498 2491 499 237 BBIL-AP BHARTI Airtel Ltd., IN 24560 2241 851 415 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 45090 2179 1438 79 TENCENT-NET-AP Shenzhen Tencent Compute Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 7419 10586 2886 AMAZON-02, US 11492 4612 305 508 CABLEONE, US 7155 3899 265 32 VIASAT-SP-BACKBONE, US 22773 3771 3065 348 ASN-CXA-ALL-CCI-22773-RDC, US 16625 3544 1851 2544 AKAMAI-AS, US 6327 3504 1320 63 SHAW, CA 749 3027 50696 2294 DNIC-AS-00749, US 7018 2639 24156 1591 ATT-INTERNET4, US 30036 2600 367 258 MEDIACOM-ENTERPRISE-BUSINESS, US 396982 2554 3479 346 GOOGLE-CLOUD-PLATFORM, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 6909 1730 144 UNI2-AS, ES 9121 6834 1692 17 TTNET, TR 20940 4111 3400 182 AKAMAI-ASN1, NL 39891 4010 234 47 ALJAWWALSTC-AS, SA 8551 3982 374 38 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2946 2290 913 ROSTELECOM-AS, RU 9009 2623 252 1348 M247, RO 6849 2477 339 20 UKRTELNET, UA 34984 2243 357 616 TELLCOM-AS, TR 47331 2076 322 1579 TTNET, TR Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10744 3314 605 Uninet S.A. de C.V., MX 10620 3469 510 837 Telmex Colombia S.A., CO 11830 2301 369 64 Instituto Costarricense de Electricidad 13999 2075 338 538 Mega Cable, S.A. de C.V., MX 28573 1337 2330 260 Claro NXT Telecomunicacoes Ltda, BR 6503 1294 338 520 Axtel, S.A.B. de C.V., MX 3816 1285 722 152 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1089 369 22 Telefonica del Peru S.A.A., PE 11664 1089 181 466 Techtel LMDS Comunicaciones Interactiva 26615 986 2466 43 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1574 393 21 LINKdotNET-AS, EG 24835 1518 521 31 RAYA-AS, EG 36992 1350 1519 270 ETISALAT-MISR, EG 36903 1260 550 99 MT-MPLS, MA 29571 1014 68 32 ORANGE-COTE-IVOIRE, CI 36935 815 520 42 Vodafone-, EG 6713 612 1863 34 IAM-AS, MA 15399 526 53 42 WANANCHI-, KE 37342 486 32 1 MOVITEL, MZ 23889 400 231 14 MauritiusTelecom, MU Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10744 3314 605 Uninet S.A. de C.V., MX 9808 9071 8884 50 CHINAMOBILE-CN China Mobile Communicati 16509 7419 10586 2886 AMAZON-02, US 12479 6909 1730 144 UNI2-AS, ES 9121 6834 1692 17 TTNET, TR 7545 5928 786 694 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4192 75 ERX-CERNET-BKB China Education and Rese 11492 4612 305 508 CABLEONE, US 20940 4111 3400 182 AKAMAI-ASN1, NL 39891 4010 234 47 ALJAWWALSTC-AS, SA Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9071 9021 CHINAMOBILE-CN China Mobile Communications Grou 9121 6834 6817 TTNET, TR 12479 6909 6765 UNI2-AS, ES 7545 5928 5234 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4651 ERX-CERNET-BKB China Education and Research Net 16509 7419 4533 AMAZON-02, US 11492 4612 4104 CABLEONE, US 39891 4010 3963 ALJAWWALSTC-AS, SA 8551 3982 3944 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 20940 4111 3929 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 398083 UNALLOCATED 5.133.124.0/24 399587 UT, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 16641 UNALLOCATED 8.10.194.0/24 3356 LEVEL3, US 16641 UNALLOCATED 8.10.210.0/24 3356 LEVEL3, US 25674 UNALLOCATED 8.12.76.0/24 3356 LEVEL3, US 16641 UNALLOCATED 8.12.250.0/24 3356 LEVEL3, US 25674 UNALLOCATED 8.14.115.0/24 3356 LEVEL3, US 25674 UNALLOCATED 8.19.146.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.136.112.0/24 Origin: 54835 UNASSIGNED 23.136.112.0/24 Transit: 21559 OSNET, PR 23.141.0.0/24 Origin: 395350 UNASSIGNED 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.158.240.0/24 Origin: 13465 UNASSIGNED 23.158.240.0/24 Transit: 33185 HIVE-DATA-CENTER, CA 23.181.240.0/24 Origin: 399613 UNASSIGNED 23.181.240.0/24 Transit: 11992 CENTENNIAL-, PR 24.48.128.0/19 Origin: 29866 OPTICALTEL, US 24.48.128.0/19 Transit: 3257 GTT-BACKBONE GTT, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:39 /11:100 /12:294 /13:589 /14:1202 /15:2046 /16:13513 /17:8343 /18:13980 /19:25194 /20:44406 /21:52220 /22:109690 /23:97714 /24:542921 /25:786 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 9121 5980 6834 TTNET, TR 12479 5918 6909 UNI2-AS, ES 8151 4740 10744 Uninet S.A. de C.V., MX 11492 3519 4612 CABLEONE, US 8551 3446 3982 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 6327 3312 3504 SHAW, CA 39891 3193 4010 ALJAWWALSTC-AS, SA 7155 2988 3899 VIASAT-SP-BACKBONE, US 22773 2782 3771 ASN-CXA-ALL-CCI-22773-RDC, US 6849 2340 2477 UKRTELNET, UA Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1908 2:1029 3:166 4:5 5:3945 6:116 7:5 8:1591 9:1 11:173 12:1623 13:347 14:2375 15:275 16:69 17:360 18:343 20:241 21:4 22:188 23:5967 24:2473 25:6 27:2713 29:19 31:2452 32:94 34:7 35:90 36:1867 37:4484 38:3650 39:753 40:159 41:3969 42:1181 43:2298 44:296 45:16261 46:4225 47:375 49:1719 50:1930 51:242 52:1500 54:394 55:838 56:8 57:78 58:1791 59:1164 60:994 61:2386 62:2542 63:1968 64:5628 65:2327 66:4845 67:2967 68:1377 69:4164 70:1303 71:678 72:2998 74:2652 75:1474 76:599 77:2249 78:3959 79:3156 80:2051 81:1826 82:1527 83:1220 84:1424 85:3744 86:738 87:1914 88:2841 89:3438 90:545 91:7599 92:2078 93:2548 94:3541 95:4799 96:1345 97:348 98:1171 99:739 100:68 101:1064 102:2318 103:30334 104:4544 105:477 106:890 107:2543 108:900 109:4333 110:2019 111:3323 112:2066 113:1551 114:1525 115:2019 116:1922 117:2482 118:2323 119:1853 120:1738 121:1089 122:2555 123:2116 124:1553 125:2188 128:1244 129:981 130:972 131:2007 132:834 133:379 134:1906 135:290 136:869 137:889 138:2528 139:1522 140:1137 141:1475 142:1399 143:1418 144:1204 145:349 146:1879 147:1535 148:2253 149:1830 150:875 151:1120 152:1823 153:469 154:3795 155:1426 156:1638 157:1303 158:1046 159:2185 160:2571 161:1373 162:3502 163:1436 164:1678 165:1635 166:812 167:1717 168:3825 169:893 170:4545 171:852 172:3457 173:3104 174:1034 175:1147 176:3593 177:4746 178:3558 179:2107 180:2340 181:3283 182:3234 183:1939 184:2355 185:19837 186:4533 187:3956 188:4041 189:3450 190:8996 191:1453 192:10982 193:8737 194:7160 195:5062 196:2984 197:2461 198:6005 199:6064 200:7616 201:5833 202:10554 203:10061 204:4562 205:3477 206:3883 207:3444 208:4095 209:4789 210:4338 211:2435 212:4046 213:3561 214:1099 215:53 216:6477 217:2624 218:1294 219:571 220:2046 221:924 222:826 223:2014 End of report

1 0

Detecting, mitigating, and preventing distributed large-scale prefix de-aggregation attacks
by Lars Prehn 20 Oct '22

20 Oct '22

Dear NANOG, Our apologies to those who received this message via multiple channels. My colleagues and I recently revisited the topic of prefix de-aggregation attacks. We believe that the current IPv6 allocation policies combined with the ever-growing number of interconnection opportunities may facilitate those attacks to the point where they may circumvent traditional prevention mechanisms. Hence, we'd like to raise awareness on how to detect, mitigate, and prevent these kinds of attacks. # Prefix De-aggregation Attacks While allocation policies in IPv4 are very tight, even a new LIR can obtain, e.g., a /29 IPv6 address block from RIPE without justification [1]. This /29 may source more than a million unique IPv6 prefixes when using all CIDR sizes between /29 and /48 (the largest CIDR size that is not filtered). To prevent this many prefixes from flooding the DFZ, many ASes set a maximum prefix limit on their eBGP sessions. When initially introduced, these max-prefix limits prevented prefix de-aggregation attacks. In today's hyper-connected world, prefix limits transform these attacks into session-hunting challenges. To better illustrate this relationship, consider the following example: If an adversary combines two remote-peering offerings of BSO's IXReach [2] and Epsilon's Infinity Platform [3], they can establish ports at more than a hundred peering LANs. If this adversary uses Hurricane Electric as their IPv6 transit provider and establish a BGP session at every in-common peering LAN [4], this will lead to 100+ sessions. With a per-session limit of e.g. 500 prefixes, the adversary could redistribute 50K unique prefixes via this setup alone. If an adversary further increases the number of remote peering providers, adds announcements from BGP-enabled VPS services (e.g., Vultr [5] among many others [6]), and contracts additional IPv6 transit providers, they may globally increase the current IPv6 routing table size manifold. Notably, each of these new routes would have a valid ROV status once the adversary adds a single ROA entry for a /29 with a max CIDR size of /48; hence, they would pass the redistribution requirements for various transit providers. While many current router models support multiple million IPv6 routes, especially older models may crash, drop sessions, or behave in other unintended ways when either their FIB or RIB runs out of memory. When the adversary also withdraws all routes simultaneously, the number of updates generated from BGP's path-hunting may further lead to very high load for extended periods of time. To put this into perspective: Some of you might have noticed increased CPU load alongside other effects when Vultr was de-aggregating 12k IPv6 prefixes on October 5th [7]. Using the different methods described above, an highly-motivated adversary might be able to produce 1-2 orders of magnitude more updates. Please note that we performed various smaller (<600 prefixes) de-aggregation tests as part of our research---see sections 6 and 8 in the document referenced at the end of this notification for detailed explanations. While our experimental setup was very similar to the October 5th incident (we also announced address space obtained from SecureBit via VMs within Vultr), we are in no way related to that incident neither did we share any information about our research or findings with individuals outside our research group prior to the start of our private disclosure phase on October 11th. # Detection, Mitigation, and Prevention Mechanisms. Luckily, prefix de-aggregation attacks are easily detectable (e.g., based on prefix-limit notification thresholds or direct routing table size monitoring) and can be mitigated quickly by filtering either the more specifics of the covering prefix or all prefixes announced by the adversary's ASN(s). Effectively, damage can only be done within the human reaction time---which we hope to shorten with this notification. To protect yourself from prefix de-aggregation attacks, you may establish dynamic yet tight per-session limits on all eBGP sessions. As an adversary could enter unreasonably large values into databases such as PeeringDB, we'd recommend to not solely rely on them but also accept at most 1.5-2x the number of yesterday's prefixes for peers and customers and 1.2x yesterday's routing table size for transit providers (which would currently reflect a headroom of ~32k prefixes with a yearly growth rate of <50k prefixes [8]). We'd also recommend ensuring that the summed prefix limits across all sessions do not drastically exceed the router's maximal FIB size. To protect others, you may: (i) ensure that you only redistribute a certain number of routes per origin; currently, AS 9808 announces the most (~4K) IPv6 prefixes. (ii) ensure that you only redistribute a certain number of more-specific routes for each assigned address block; currently, 2409:8000::/20 is the prefix with the most (~10K) more-specifics. If you want to know more about the research that initiated this notification (including our concluded private disclosure process), you may find a write-up at: https://arxiv.org/pdf/2210.10676.pdf Best regards, Lars [1] https://www.ripe.net/publications/docs/ripe-738#initial_size [2] https://www.ixreach.com/services/remote-peering/ [3] https://epsilontel.com/global-network-footprint/internet-exchanges/ [4] https://he.net/peering.html [5] https://www.vultr.com/features/advanced-networking/ [6] https://docs.google.com/spreadsheets/d/1abmV_mXWWCsVxHLfouSivyS7ch-PcUww8S6… <https://docs.google.com/spreadsheets/d/1abmV_mXWWCsVxHLfouSivyS7ch-PcUww8S6…> [7] https://twitter.com/Qrator_Radar/status/1577748939805278209 [8] https://bgp.potaroo.net/v6/as2.0/index.html

2 1

abha
by Randy Bush 20 Oct '22

20 Oct '22

abha ahuja died 21 years ago today; a force in routing, ops, and trying to liberate the culture. fort hose who want to pull threads, http://www.neebu.net/~khuon/abha/ https://archive.nanog.org/resources/scholarships/abha_ahuja there are others here who will have much better cites (hint hint). randy

1 0

RE: Newbies Question: Do I really need to sacrifice Prefix-aggregation to do BGP Load-sharing?
by Pirawat WATANAPONGSE 20 Oct '22

20 Oct '22

Dear all, Before all else: thank you all for the lightning-fast responses (even taking the time zone advantage into account). I really, really, really appreciate all your recommendations. Virtually all of you recommend prepending as the first choice. I also get the feeling that you guys consider de-aggregation “distasteful” (at the least) but sometimes unavoidable. I have considered the prepending myself, but dare not implement it yet for the fear that BGP (Human) Community will burn me alive, witch-hunt style, because of the following reasons: 1. I can see from looking glass(es) that my upstreams already practice prepending (some paths) at their level (at least 3 more hops [x4]), supposedly to “balance” their bandwidth. 2. Should I start prepending mine, I might upset their balance, causing them to prepend more, thus starting a “prepend war”. [I imagine that x20+ prepending starts out this way] The way I see it, prepending (or maybe even the whole BGP-Path thing) is a local-optimization problem: it’s only best for someone, not globally. And the Higher-Tiers (Lower Tier-Numbers) will always “engineer” me in the end. Worse yet, I might be out-voted by de-aggregation insider “cultists” anyway. Which forces me to proactively ask you guys questions about ROV-Overlapping and ROV “Hijack Gap” soon, in another posting with separate “Subject:”. Again, Thank you. Cheers, Pirawat. P.S. [Off-Topic] Any comment on the “SCION” System? Any good (I will even take "academically")? [Reference: https://scion-architecture.net/]

7 7

Prepending
by Sandoiu Mihai 20 Oct '22

20 Oct '22

Hi We have witnessed a lot of prepending in the last days, we got a few internet routes that have 30...200 prepends, did you face the same issue? Regards Mihai

4 3

Newbies Question: Do I really need to sacrifice Prefix-aggregation to do BGP Load-sharing? (the case of Multi-homed + Multi-routers + Multi-upstreams)
by Pirawat WATANAPONGSE 19 Oct '22

19 Oct '22

Dear Guru(s), My apologies if these questions have already been asked; in that case, please kindly point me to the answer(s). I hope the following information sufficiently describes my current "context": - Single customer: ourselves - One big IPv4 block + one big IPv6 block - Native Dual-Stack, Non-tunneling - Non-transit (actually, a “multi-homed Stub”) - “All-green” IRR & RPKI registered (based on IRRexplorer report) - Fully-aggregated route announcement (based on CIDR report) - Two (Cisco) gateway routers on our side - Two upstreams (See the following lines), fully cross-connected to our gateways - One (pure) commercial ISP - One academic consortium ISP (who actually uses the above-mentioned commercial ISP as one of its upstreams as well) My current “situation”: - All inbounds “flock” in through the commercial ISP, overflowing the bandwidth; since (my guess) the academic ISP also uses that commercial ISP as its upstream, there is no way for its path to be shorter. Questions: 1. Do I really have to “de-aggregate” the address blocks, so I can do the “manual BGP load-sharing”? I hate to do it because it will increase the global route-table entries, plus there will be IRR & RPKI “hijack gaps” to contend with at my end. 2. If the answer to the above question is definitely “yes”, please point me to the Best-Practice in doing the “manual BGP load-sharing (on Cisco)”. Right now, all I have is: https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/1… Thanks in advance for all the pointers and help given (off mailing-list is also welcome). Best Regards, Pirawat.

6 5

2022.10.19 NANOG86 community meeting notes
by Matthew Petach 19 Oct '22

19 Oct '22

For anyone who missed the community meeting this morning at NANOG 86 and wants to know what was covered before the official notes and video are available, here's the notes I took from the meeting this morning. And if you missed Geoff Bennett's talk on how optical networking transformed our world, you definitely need to see it when it gets posted. Absolutely worth the price of admission! Thanks! Matt

1 0

Re: AWS Blacklisting?
by Justin H. 19 Oct '22

19 Oct '22

Is it possible this is a geolocation issue? I'm not sure I've heard of that causing a 403 Forbidden, but I'm also not too familiar with AWS. Justin H. William Herrin wrote: > Sounds like "AWS Shield" but I couldn't begin to tell you who to contact. > > On Tue, Oct 18, 2022 at 4:51 PM Justin H. <justindh.ml(a)gmail.com> wrote: >> I have a customer who's suddenly been getting 403's today on AWS hosted >> sites. My google-fu seems to be failing me because I can't seem to find >> any information on who manages that on their side or how to fix the issue. >> >> I've sent an email to amzn-noc-contact(a)amazon.com based on ARIN >> contacts, but it doesn't seem to be a responsive address. >> >> Has anyone had to navigate this particular maze before? >> >> Thank you, >> Justin H. > >

3 2