Subject: Re: BGP security in practice

From: [email-masked]
Date: Mon, 4 Nov 2002 11:37:28 -0500 (EST)

>It also occurs to me (courtesy of a NANOG conversation) that one
>can do incredibly evil things to traffic flows that is difficult
>to catch just by tweaking route origin.

Intersting.  Can you tell me more, or was this one of those conversations
whose details are understood to be on the QT?

--Sandy

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 4 Nov 2002 12:02:26 -0500

> whose details are understood to be on the QT?

See a conversation on idr a while back about how "origin can be
changed to affect routing policy".

Basically, where you *think* the provider may be applying default
policy at some point and you think path lengths are equal, tweaking
the origin at one point in the network may cause traffic streams
to make a *hard* turn.

For example, here's something from a current view of the Internet.
bash-2.05$ grep '       Path:.*Incomplete' gated_dump | wc -l
    1963
bash-2.05$ grep '       Path:.*IGP' gated_dump | wc -l
   43573
bash-2.05$ grep '       Path:.*EGP' gated_dump | wc -l
    40

This would argue that you could introduce intentionally suboptimal
paths just by making a lot of things that are origin IGP as origin
incomplete.

It would make an interesting experiment to see exactly what *does*
happen.

-- 
Jeff Haas 
NextHop Technologies