Subject: [RPSEC] An evaluation of whether an IRR(RIPE) can be used to detect abnormal routing.

From: Georgos Siganos <[email-masked]>
Date: Thu, 10 Feb 2005 18:32:35 -0800

Hello,
For my research, I examined how useful RIPE can be as the foundation of 
a reactive based
system for routing security.
Basically, the question we tried to answer is what can happen today? Is 
there anything better we can do
other than wait for a secure BGP protocol. For a time period of 10 
days, we analyzed the routing table and
the updates that router rrc03 (RIS router at AMS-IX) received. We focus 
only on the prefixes that RIPE
administers. We found that using the RIPE registry, we can validate the 
origin AS for 97%
of the unique prefix,origin tuples. Additionally, for approximately 60% 
of the ASes that register policies in RIPE,
we can not find any deviation between the registered policies and 
actual routing.
You can find more details in our paper at:
http://www.cs.ucr.edu/~siganos/papers/security.pdf

Do you believe that reactive based systems can be a viable short term 
solution?
For example, RIPE is working towards a similar direction with the MyASN 
project.
They don't use the information that exists in their registry, instead 
ISPs need to
explicitly register the prefixes they want to monitor.

I hope you find my work relevant to your working group.
Please let me know if you have any comments or suggestions.
Thanks,
Georgos Siganos

The paper that describes how you can extract the policies from IRR can 
be found at:
http://www.cs.ucr.edu/~siganos/papers/Nemecis.pdf

You can find a demo of my tool at:
http://ira.cs.ucr.edu:8080/Nemecis

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec