Subject: Re: [RPSEC] BGP Requirements Draft

From: Sandy Murphy <[email-masked]>
Date: Fri, 23 Sep 2005 14:16:17 -0400 (EDT)

>>>I think the second is more rigerous: the first point checks, whether
>>>the path actually exists, the second point whether the UPDATE actually
>>>travels the path. This is an additional check to me, so the check is
>>>more rigorous.
> 
> It's not, really. In the "pure" sense, in a system without aggregation 
> and filtering, it is more rigorous. In the real world, where 
> aggregation, ECMP, and filtering are all done "in due course," any 
> benefit gained quickly falls out, other than "non-repudiation" (however 
> you'd like to define that term).

Note that if you only check the AS_PATH for adjacencies, the loop
check becomes meaningless - the check does not ensure that the
UPDATE was generated by traversing all those AS's, so checking for
your own AS in the AS_PATH is fruitless.

Which means you are giving up on BGP being loop-free.  That's a
bit more than "non-repudiation".

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Fri, 23 Sep 2005 22:03:22 -0400

> bit more than "non-repudiation".

?????

Nope. As long as your AS isn't in the AS path, the path is loop free. 
Otherwise, AS Sets would be meaningless in the first place.

:-)

Russ

- -- 
[email-masked] CCIE <>< Grace Alone