Subject: Re: [OPSEC] pccw as17557 leak...

From: "Paul Ferguson" <[email-masked]>
Date: Thu, 28 Feb 2008 05:35:35 GMT

- -- Roland Dobbins <[email-masked]> wrote:

>On Feb 28, 2008, at 12:14 PM, Paul Ferguson wrote:
>
>> Just because there has been "lengthy discourse" on various related
>> issues, I certainly think that much more dialog is needed, simply
>> due to the fact that serious operational insecurities continue to
>> resurface.
>
>Concur.  However, in order to have a productive discussion, it's  
probably a good idea to a) understand the history to date, b)  
understand the current state of the art, such as as it is, from both a  
technological and an operational standpoint, and c) to assume that  
other participants in the discussion have invested time in both a) and  
b), unless they demonstrate otherwise.

Okay.

So, with regards to the AS17557 leakage:

[a] History has shown, to date, that it is childishly simple to
inject prefixes into the global routing system. [1]

[b] The state of the art? I'm not even sure what that means. This
is undeniably a state-of-the-art operational issue, and personally,
I'm not banking on any technological solutions to this problem.

[c] This is most certainly a desired goal.

- - ferg

[1] On a related note, last week at NANOG, some beer-drinking
ISP engineering folks got together one evening for a "Bogon
Injection BoF" to see how many networks on the planet accepted
(and also propagated) various bogons which they injected at various
places in the global Internet. It is appalling how much fun that
had (meaning: it is appalling how many networks don't do even the
most basic bogon filtering).

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: Roland Dobbins <[email-masked]>
Date: Thu, 28 Feb 2008 13:15:22 +0700

> inject prefixes into the global routing system. [1]

Yes, and there are also BCPs and features and techniques intended to  
mitigate the ill effects of same, techniques that folks like you and  
many other folks have promulgated for many years, of which we're all  
aware.

> is undeniably a state-of-the-art operational issue

In other words, there are various features and techniques which exist  
today intended to address various aspects of this problem set; as you  
and others rightly point out, these features and techniques are not  
universally deployed, or anything close to it, which leaves us in our  
current sad state of affairs.

> I'm not banking on any technological solutions to this problem.

Does this mean that these classical problems (route hijacking, source  
spoofing, et. al.)  are essentially insoluble in practice, given the  
inertia, entropy, and general failure of the operational community to  
solve them after 15 years (30+ years, if one takes into consideration  
equivalent issues in X.25 networks)?  I'm not asking rhetorically,  
it's a serious question.

> (meaning: it is appalling how many networks don't do even the
> most basic bogon filtering)

Right.  So if there's no technological solution, then in what domain  
does the solution, if any, lie?  And if there is no technological  
solution, then how can this WG make a contribution to said solution,  
assuming one is possible?

-----------------------------------------------------------------------
Roland Dobbins <[email-masked]> // +66.83.266.6344 mobile

      If you don't know what to do, it's harder to do it.

                    -- Malcom Forbes