Subject: Re: signs & wonders

From: Vince Fuller <[email-masked]>
Date: Wed, 9 Sep 98 15:10:51 PDT

> Er, not really.  It allows anyone to announce thier intent. And, as
> has been shown historically (check the MERIT daily stats) that AS 
> operators do, in fact, announce all kinds of prefixes that they should
> not. What is not always clear is why they should not.

Bill-

Allowing anyone to announce intent without any sort of authorization and
authentication mechanism to reliabily tie those announcements to the address
allocation hierarchy (and, preferably also to the separate hiearchy that
defines "permission to route") is pretty useless. This limitation on
utility, combined with poor centralized database characteristics, explain
why at least some providers don't do a whole lot with the current IRR.

While I am exactly a hearty supporter of the RPS effort (I question whether
the amount of time and effort spent in designing a new database language was
really worthwhile), I do believe that the combination of rps-auth, rps-dist,
and a simple set of information (i.e. AS-to-prefix mappings, and maybe even
documentation of AS-to-AS topology, if more extensive path checking is 
desired) maintained using RPSL as a universal data format could provide a
useful tool for performing reasonably robust route sanity checking. 

In case anyone cares, a working group composed of engineers from some of
the IOPS member organizations has been approaching the routing robustness
problem from the point of view of defining requirements for a solution. We
have come to the conclusion that the result of the RPS effort should provide
a superset of functionality needed to build this solution. And, as far as
any of us can tell, there doesn't appear to be any alternative solution in
the works (the "DNS-BGP kluge" doesn't cut it for a number of reasons).

RPS may not be perfect and, as I mentioned above, has suffered somewhat from
a lack of focus on the real problem (authntication/authorization of data in
a distributed manner) but at least those involved are trying to solve the
problem instead of just bitching from the sidelines.

	--Vince

---

From: Joe Abley <[email-masked]>
Date: Thu, 10 Sep 1998 12:15:03 +1200

> the works (the "DNS-BGP kluge" doesn't cut it for a number of reasons).

Have I missed some discussion on why the "DNS-BGP kludge" is deficient?
Just out of interest, could you elaborate on some of those reasons?

Joe

-- 
Joe Abley <[email-masked]>      Tel +64 9 912-4065, Fax +64 9 912-5008
Network Architect, CLEAR Net                      http://www.clear.net.nz/

---

From: Anne Louise Gockel <[email-masked]>
Date: Fri, 11 Sep 1998 17:06:40 -0400 (EDT)

> the works (the "DNS-BGP kluge" doesn't cut it for a number of reasons).

Is there a summary of this work anywhere?  Is this an active working
group? 

					-Anne