Subject: Re: [RPSEC] issue: ASPATH

From: Sandy Murphy <[email-masked]>
Date: Tue, 8 Mar 2005 15:44:47 -0500 (EST)

>you raise a very good point, i.e., the current version of the
>document refers to existence of links but fails to define the
>reference basis for this, nor does it say why mere existence of a
>link is the right sort of check to make.

Well, for one thing, it is a fairly (comparatively) easy check to
make that will flag a large number of the potential bogus AS_PATHs -
speaking just in terms of the number of sequences that could be
formed from the thousands of AS's.  And it could be based on info
that is realtively static (peering agreements, tho not active
peerings of course).

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 8 Mar 2005 18:21:17 -0500

>that is realtively static (peering agreements, tho not active

I agree that it would rule out many bogus paths, but is also allows 
many bogus paths, in the general case, including in examples you gave!

What we are discussing is how different is the graph one gets from 
looking at AS connectivity as defined in a prefix-constrained 
fashion, vs. non-directional, prefix-free graph. I have done this 
comparison, using RV data, and there is a world of difference. If 
this data is representative, then the number of paths that would pass 
the simple connectivity test, vs. reality (as expressed via 
propagated routes) is enormous.

Steve

---

From: Russ White <[email-masked]>
Date: Thu, 10 Mar 2005 12:52:33 -0500 (Eastern Standard Time)

> looking at AS connectivity as defined in a prefix-constrained fashion, 
> vs. non-directional, prefix-free graph. I have done this comparison, 
> using RV data, and there is a world of difference. If this data is 
> representative, then the number of paths that would pass the simple 
> connectivity test, vs. reality (as expressed via propagated routes) is 
> enormous.

Can you provide an example of this? Such an example would have to:

-- Be permanent (not transient).

-- Not disobey the other requirements already given (that each router on an 
eBGP edge rejects all routes without the configured peer's AS in the most 
recent spot of the AS Path).

-- Direct traffic that doesn't already (in theory, at least), flow through 
the attacking AS?

I don't know of any such situations.

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone

---

From: Stephen Kent <[email-masked]>
Date: Thu, 10 Mar 2005 22:15:13 -0500

At 12:52 PM -0500 3/10/05, Russ White wrote:
>>this data is representative, then the number of paths that would 
>>pass the simple connectivity test, vs. reality (as expressed via 
>-- Not disobey the other requirements already given (that each 
>router on an eBGP edge rejects all routes without the configured 
>peer's AS in the most recent spot of the AS Path).
>
>-- Direct traffic that doesn't already (in theory, at least), flow 
>through the attacking AS?
>

There may be some confusion about what I said above, based on your 
questions, so I'll give some more details and you can see whether the 
questions still seem relevant.

We examined RV data over various intervals, typically 30 days at a 
time. We constructed graphs based on different assumptions one can 
infer from the data, So, for example, if you see a route advertised 
by AS 1, for prefix A, and that path goes through AS 3, 17 and 9, 
then you can feel fairly confident that traffic destined to A and 
starting in AS 1 will traverse AS 3 and 17 en route to AS 9. 
(Whether AS 9 is the real origin AS is debatable, as we have seen.)

However, the graph one gets from this data is pretty sparse relative 
to total Internet connectivity, because it reflects a tiny fraction 
of all ASes as origins. One has to extrapolate from that data 
considerably to try to fill in the blanks. Assuming that each AS 
along the path would route traffic for the same prefix the same ways 
helps a little, but still leaves lots of gaps. Ignoring the prefix 
specificity, e.g., assuming that all traffic destined to all prefixes 
advertised by the origin AS will follow the same path, also helps 
expand coverage. Finally, though, to get fairly broad coverage, one 
needs to ignore directionality, as well as prefix specificity. At 
that point you have a graph that largely ignores all of the policies 
that affect BGP route propagation. And, that graph does not show any 
private peering links. One can detect these links via analysis of 
skitter data, and comparing it to RV data, Siuch comparison suggests 
that a substantial fraction of all links are not advertised in BGP, 
to a broad set of ASes. What this suggests is that a graph that shows 
all links between ASes is very different from the much more 
constrained graph that reflects actual advertisements which, in turn, 
reflects policies, when ASes behave.

Steve