North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: [admin] [summary] RE: YouTube IP Hijacking

  • From: Danny McPherson
  • Date: Mon Feb 25 15:15:45 2008


On Feb 25, 2008, at 12:51 PM, Alex Pilosov wrote:
** Nobody brought up the important point - the BGP announcement filtering
are only as secure as the weakest link. No [few?] peers or transits are
filtering "large" ISPs (ones announcing few hundred routes and up). There
are a great many of them, and it takes only one of them to mess up
filtering a downstream customer for the route to be propagated. 

Yes, that was my implicit point to Pekka.  Even if you do everything
feasible today (i.e., explicitly filter customers, some amount of policy
for peers, and perhaps a few hacks for multi-homed customers), you're
still pretty much screwed if someone announces your address space.
Heck, you're as likely to accept the announcement as anyone.

** Paul Wall brought up the fact that even obviously bogus routes (1/8 and
100/7) were accepted by 99% of internet during an experiment.

I'm not sure why this would surprise anyone.

** What I'd like to see discussed: Issues of filtering your transit
downstream customers, who announce thousands of routes. Does *anyone* do
it? 

Lots of folks do.  The interesting bit is that even then, those
same providers would accept perhaps even those customer
routes from their peers implicitly.

* Typos vs Malicious announcements

** Some ways of "fixing" the problem (such as IRR filtering) only address
the typos or unintentional announcements. 

You mean as opposed to intentionally malice acts?  Well,
not completely.  See Pekka's email, for example.  Of course,
it does vary widely across IRRs, etc..

There's full agreement that IRR
is full of junk, which is not authenticated in any sort.

Mostly, though not completely.

** Things like PHAS won't work if hijacker keeps the origin-AS same (by
getting their upstream to establish session with different ASN) 

NO, that's not even necessary.  Simple originate the route from
the legit AS, and then transit it with the local AS as a transit AS.
AS path manipulation is trivial.

** What I'd like to see discussed: Who (ICANN/RIRs/LIRs) is actively
working on implementing "chain of trust" of IP space allocations?

* Ways to address the issue without cooperation of 3491:
** Filtering anything coming out of 17557

Bad idea.


** Suggestions given:
** What I'd like to see discussed: Can an network operator, *today*,
filter the "possibly bogus" routes from their peers, without manual
intervention, and without false positives?


Sure, if they want to dedicate an engineer to it, automate policy
deployment and deal with brokenness by turning steam valves.

* Yelling at people who don't filter

That's been productive for over a decade now.

** Per above, 3491 isn't the only one who filters. In fact, claims
were made that *nobody* filters "large enough" downstreams. (beyond
aspath/maxpref)

Wrong.

-danny