Subject: Re: [RPSEC] Basis of Requirements?

From: Sandy Murphy <[email-masked]>
Date: Mon, 3 Oct 2005 11:24:00 -0400 (EDT)

>This  WG was established with a scope that includes security for 
>routing, but not forwarding.
>...
>However, it certainly makes sense to 
>develop countermeasures to routing attacks if these countermeasures 
>preclude attacks that can not be effected by the same parties solely 
>through forwarding attacks.

I would second this.  A router can mis-forward any traffic that happens
to come its way.  Given the condition of the FIB's in other routers,
it might be able to mis-forward so as to make a routing loop.
But the ability to affect the routing protocol might make it possible
to *make* traffic go through specific routers, whether to that router's
gain or pain, and to *make* the FIB's in other routers suitable for
the creation of a routing loop.

It's the deterministic ability to create a situation to the bad guy's
benefit that makes routing attacks different from forwarding attacks.

At the last NANOG, there was a discussion of AS9121's announcement
of 100K+ routes. No amount of mis-forwarding could have had the same
ill-effect.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Paul Jakma <[email-masked]>
Date: Mon, 3 Oct 2005 17:24:28 +0100 (IST)

On Mon, 3 Oct 2005, Sandy Murphy wrote:

> of 100K+ routes. No amount of mis-forwarding could have had the 
> same ill-effect.

Indeed. And it's not the first time that kind of thing has happened.

regards,
-- 
Paul Jakma	[email-masked]	[email-masked]	Key ID: 64A2FF6A
Fortune:
The price of greatness is responsibility.