On Feb 25, 2008, at 12:51 PM, Alex Pilosov wrote:
** Nobody brought up the important point - the BGP announcement filtering are only as secure as the weakest link. No [few?] peers or transits are filtering "large" ISPs (ones announcing few hundred routes and up). There are a great many of them, and it takes only one of them to mess up filtering a downstream customer for the route to be propagated.
Yes, that was my implicit point to Pekka. Even if you do everything feasible today (i.e., explicitly filter customers, some amount of policy for peers, and perhaps a few hacks for multi-homed customers), you're still pretty much screwed if someone announces your address space. Heck, you're as likely to accept the announcement as anyone.
** Paul Wall brought up the fact that even obviously bogus routes (1/8 and 100/7) were accepted by 99% of internet during an experiment.
I'm not sure why this would surprise anyone.
** What I'd like to see discussed: Issues of filtering your transit downstream customers, who announce thousands of routes. Does *anyone* do it?
Lots of folks do. The interesting bit is that even then, those same providers would accept perhaps even those customer routes from their peers implicitly.
* Typos vs Malicious announcements
** Some ways of "fixing" the problem (such as IRR filtering) only address the typos or unintentional announcements.
You mean as opposed to intentionally malice acts? Well, not completely. See Pekka's email, for example. Of course, it does vary widely across IRRs, etc..
There's full agreement that IRR is full of junk, which is not authenticated in any sort.
Mostly, though not completely.
** Things like PHAS won't work if hijacker keeps the origin-AS same (by getting their upstream to establish session with different ASN)
NO, that's not even necessary. Simple originate the route from the legit AS, and then transit it with the local AS as a transit AS. AS path manipulation is trivial.
** What I'd like to see discussed: Who (ICANN/RIRs/LIRs) is actively working on implementing "chain of trust" of IP space allocations?
* Ways to address the issue without cooperation of 3491: ** Filtering anything coming out of 17557
Bad idea.
** Suggestions given: ** What I'd like to see discussed: Can an network operator, *today*, filter the "possibly bogus" routes from their peers, without manual intervention, and without false positives?
Sure, if they want to dedicate an engineer to it, automate policy deployment and deal with brokenness by turning steam valves.
* Yelling at people who don't filter
That's been productive for over a decade now.
** Per above, 3491 isn't the only one who filters. In fact, claims were made that *nobody* filters "large enough" downstreams. (beyond aspath/maxpref)
Wrong. -danny