Subject: Re: [OPSEC] pccw as17557 leak...

From: "Paul Ferguson" <[email-masked]>
Date: Wed, 27 Feb 2008 19:18:47 GMT

- -- Ron Bonica <[email-masked]> wrote:

>I think that it would helpful if this working group were to produce a
>document (or two) recommending BGP policy for ISP.

If you do decide to do this, please engage people in the operational
community. Please.

Over on the NANOG list, as many of you are probably already aware,
this issue is one that has been highlighted on several ocassions --
the fact that appropriate RFCs and BCPs exist to address specific
operational issues, yet many ISPs choose to ignore them or are
simply ignorant of them.

Separate problems, but certainly there is a lesson to be
learned here: the operational community has long known that
filtering downstream/customer ASs for prefix announcements is
a Good Thing, yet the majority of ISPs on the planet simply do
not do it...

- - ferg

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: "Smith, Donald" <[email-masked]>
Date: Thu, 28 Feb 2008 10:59:43 -0700

A lot of us do filter customer BGP announcements.
Most of us only allow our customers to announce their own AS and
netblocks.
Most won't advertise anything smaller then a /24 for their customers.

In peering especially with other large peers filtering 
announcements to the set of blocks "owned" by the peer is a bad idea.
If a partial network outage causes your peer to be the best path to you
from some portion of the internet you WANT the packets to use the best
path not the path that is now broken:)

RM=for(1)
{manage_risk(identify_risk(product[i++]) &&
(identify_threat[product[i++]))}
[email-masked] giac 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Paul Ferguson
> Sent: Wednesday, February 27, 2008 12:19 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [OPSEC] pccw as17557 leak...
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.6.3 (Build 3017)
> 
> wj8DBQFHxbeVq1pz9mNUZTMRAnsRAJ4ugSnmh8m/9W6s6nVFrITMP55ziACgxmb8
> YdUCHYvWrodg4D/xOOW7V0M=
> =A4Ox
> -----END PGP SIGNATURE-----
> 
> 
> --

This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly 
prohibited and may be unlawful.  If you have received this communication 
in error, please immediately notify the sender by reply e-mail and destroy 
all copies of the communication and any attachments.
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: Mark Smith <[email-masked]>
Date: Thu, 28 Feb 2008 07:07:35 +1030

On Wed, 27 Feb 2008 19:18:47 GMT

> If you do decide to do this, please engage people in the operational

(Am an operator ...)

It seems to me that they're the ones not engaging. They seem to be the
ones not signing up to IETF mailing lists, or spending time reading
drafts and providing feedback.

If they choose not to be involved in a process they can be, I don't
think they can blame the other party for their own lack of involvement.

> operational issues, yet many ISPs choose to ignore them or are

It seems to me that remaining ignorant is a choice they've decided to
make, and one that the IETF can't really force them to make
differently. "For the good of the Internet" doesn't seem to hold much
sway ...

-- 

        "Sheep are slow and tasty, and therefore must remain constantly
         alert."
                                   - Bruce Schneier, "Beyond Fear"
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: "David Harrington" <[email-masked]>
Date: Fri, 29 Feb 2008 12:05:07 -0500

Hi,

[Am not an operator ...; am a professional standards developer]

The IETF produces products (standards, BCPs, et al ) and the operators
are our potential customers. Standards are our real products, and BCPs
are our white papers.

As with most producers of products, you cannot force customers to use
your products correctly, you can only work to explain why it is to
their benefit to do so. Maybe the RFCs and BCPs they ignore are heavy
on technical engineering details, and short on why it is beneficial to
customers to use our products properly.

I don't think we should not produce BCPs because they might be
ignored. We should work on improving our BCPs to highlight how
following best current practices will benefit the operators, and the
companies they work for. (But not producing marketing fluff.)

And, of course, promoting the BCPs at NOGs would be helpful, through
tutorials and presentations. Many vendors promote the effective use of
their products through tutorials and white papers rather than waiting
for customers to get involved by signing up for the vendors' internal
mailing lists for product engineering. ;-)

David Harrington
[email-masked]
[email-masked]
[email-masked]

> On Behalf Of Mark Smith
> Sent: Wednesday, February 27, 2008 3:38 PM
> To: Paul Ferguson
> Cc: [email-masked]