Subject: [RPSEC] Topic 2: Section 4.5 Underclaiming - is this a legitimate threat?

From: [email-masked]
Date: Tue, 11 Mar 2003 17:36:25 -0500 (EST)

"An underclaiming threat is defined as an action that an attacker
   illegitimately hides its authorized ownership of some network
   resources."

By this we seem to be stating that a router is under an obligation to
advertise network resources it owns.  Surely that is not so.  An ISP
can be assigned whole blocks of addresses that it has not yet given to
customers.  Or the ISP might want to stop advertising an address
because of some dispute with the customer, e.g., the customer might be
serving up some objectionable material.  Or not paying its bills.  Or
a wireless router might decide to stop announcing a route because it
is overloaded and wants to reserve capacity for existing routes.

Perhaps those cases are supposed to be distinguished by the phrase
"illegitimately hides".  So the listed cases would be where the router
was *legitimately* hiding an address.  But to keep to our purpose of
guiding the protocol designers - how on earth would the protocol carry
data to prove the legitimacy of *not* announcing an address?

I do not believe this should be included as an attack on routing
protocols.  Imagine the hue-and-cry from customers wanting router
vendors or ISP's to provide assurance against this "attack".

Yes, of course hiding an address would be a concern to the customer.
But that's a financial dispute between the customer and the ISP, not a
routing attack.  Just like providing insufficient bandwidth is a
customer concern that is a financial dispute, not a routing attack.

I've cc'd some people who I know have their fingers on the pulse of
the operator community better than I.  They are invited to toss
stones in my general direction.

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Yi Yang <[email-masked]>
Date: Fri, 14 Mar 2003 16:58:39 -0500 (EST)

Sandy,

> customer concern that is a financial dispute, not a routing attack.

One example in my mind is, an underclaiming by misconfiguration, which
doesn't have to happen on the provider side. Customer is running BGP to
its provider and makes some mis-configuration on the customer side so no
one prefix is advertised to the provider.  Isn't this mis-configuration a
threat launched by a subverted router?:-)

Yi