Subject: Re: [RPSEC] Topic 2: Section 4.5 Underclaiming - is this a legitimate threat?

From: Radia Perlman - Boston Center for Networking <[email-masked]>
Date: Tue, 11 Mar 2003 21:06:16 -0500

I agree completely with Sandy on this. BGP even
has a way of configuring a router to only tell
certain information to certain neighbors.

Besides, if a router is maliciously not saying
what it can reach, it's doing the world a favor,
since the fewer things that get routed through
such a router, the better.

Radia

<[email-masked]> wrote:
>
>   "An underclaiming threat is defined as an action that an attacker
>   illegitimately hides its authorized ownership of some network
>   resources."
>
>By this we seem to be stating that a router is under an obligation to
>advertise network resources it owns.  Surely that is not so.  An ISP
>can be assigned whole blocks of addresses that it has not yet given to
>customers.  Or the ISP might want to stop advertising an address
>because of some dispute with the customer, e.g., the customer might be
>serving up some objectionable material.  Or not paying its bills.  Or
>a wireless router might decide to stop announcing a route because it
>is overloaded and wants to reserve capacity for existing routes.
>
>Perhaps those cases are supposed to be distinguished by the phrase
>"illegitimately hides".  So the listed cases would be where the router
>was *legitimately* hiding an address.  But to keep to our purpose of
>guiding the protocol designers - how on earth would the protocol carry
>data to prove the legitimacy of *not* announcing an address?
>
>I do not believe this should be included as an attack on routing
>protocols.  Imagine the hue-and-cry from customers wanting router
>vendors or ISP's to provide assurance against this "attack".
>
>Yes, of course hiding an address would be a concern to the customer.
>But that's a financial dispute between the customer and the ISP, not a
>routing attack.  Just like providing insufficient bandwidth is a
>customer concern that is a financial dispute, not a routing attack.
>
>I've cc'd some people who I know have their fingers on the pulse of
>the operator community better than I.  They are invited to toss
>stones in my general direction.
>
>--Sandy
>_______________________________________________
>RPSEC mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/rpsec

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec