Subject: Re: [RPSEC] issue: ASPATH

From: Sandy Murphy <[email-masked]>
Date: Mon, 14 Mar 2005 15:22:33 -0500 (EST)

>Are you saying that the ISP erroneously accepted an advertisement 
>from the multi-homed subscriber that advertised some portion of the 
>ISP's address space, or some address space NOT associated with the 
>subscriber, and as a result changed it's forwarding tables?

The NANOG note said only that the major ISP started routing traffic
through the customer.  The suggestion was that this was to ease the
ISP's crosscountry backbone failure.  There was a suggestion that this
was deliberate on the part of the ISP - a configuration made this
happen.  Whether this configuration was just poorly thought out
to begin with or a change instituted for the occasion was not discussed.

So there was not a suggestion that routing was involved in the
forwarding change.

>Secondly, with regard to the subscriber's forwarding tables in the 
>BGP speakers that connect to the ISP, why would they have entries to 
>forward INBOUND traffic for any but their own prefixes?

We're reaching the limit of my knowledge of router practices here.
But I think the customer's edge routers forwarding tables have to have
entries to the rest of the Internet for the customer user to reach
the rest of the Internet.  But that the customer's edge routers
would/could generally have filters to prevent the entry of traffic
destined for non-customer addresses.  Protection is in the filter
not in the forwarding table.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Sandy Murphy <[email-masked]>
Date: Mon, 14 Mar 2005 18:20:21 -0500 (EST)

>>> You can't gaurantee the traffic will take the path described in the 
>>> routing information
>>
>> Yep.
>>
>>> you can't gaurantee every transit AS listed agrees with this specific 
>>> traffic stream transiting, nor the final hop AS agrees this is the 
>>> correct entry point.
>>
>> Why not?  If something is propogated along the same path as the update 
>> that comes from the AS saying "I agree with this transiting", I would say 
>> that would gaurantee that the AS says that.
>
>Doesn't this contradict what we just agreed on above? :-)

Not what I thought we said.

I thought:

you said we couldn't gaurantee that the AS would agree.

I said "sure we can - have the AS sign something that says it agrees"

Now, if you are looking for a gaurantee that the AS would fulfill
its agreement and do what it agreed to do, well, that's a different
matter.

--Sandy