[110721] in North American Network Operators' Group
Re: Anyone notice strange announcements for 174.128.31.0/24
daemon@ATHENA.MIT.EDU (Jeroen Massar)
Wed Jan 14 11:09:29 2009
Date: Wed, 14 Jan 2009 17:06:46 +0100
From: Jeroen Massar <jeroen@unfix.org>
To: Simon Lockhart <simon@slimey.org>
In-Reply-To: <6316CD198EC8BC44A9D200F375869F1E4A1737@nkc-mailsrv.nkc.org>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig9A3A4493D24546622740AB75
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Simon Lockhart [mailto:simon@slimey.org] wrote:
> On Wed Jan 14, 2009 at 09:59:14AM +0200, Hank Nussbacher wrote:
>> What if, by doing some research experiment, the researcher discovers=20
>> some unknown and latent bug in IOS or JunOS that causes much of the=20
>> Internet to go belly up? 1 in a billion chance, but nonetheless, a=20
>> headsup would have been in order.
>=20
> Say we had a customer who connected to us over BGP, and they used some
> new experimental BGP daemon. Their announcement was "odd" in some way,
> but appeared clean to us (a Cisco house). Once their announcement hit
> the a Foundry router, it tickled a bug which caused the router to
> propogate the announcement, but also start to blackhole traffic. Oh
> dear, large chunks of the Internet have just gone belly up.
You mean like when people started using 32bit ASNs and all OpenBGPD
implementations went belly up?
See http://www.merit.edu/mail.archives/nanog/msg13416.html
Happening clearly often. People should write proper implementations
(Just in case, OpenBGPD acted correctly as it did it to the letter of
the RFC, though it could have maybe warned the admins)
> Should we have given a heads up to the Internet at large that we were
> turning up this customer?
ASN32 was known quite in advance, that doesn't mean that everybody
updates or that all bugs are found. Vendors tend to deploy things into
the wild which then break, simply because not all combinations of
configuration can ever be tested. Infinite Monkeys etc ;)
> Simon
> (Yes, I'm in the minority that thinks that Randy hasn't done anything
> bad)
Nah, I agree with Randy's experiment too. People should protect their
networks better and this is clearly showing that there are a lot of
vulnerable places in the core internet structure.
Btw folks, when do you start implementing RPSL based filtering?
Clearly a lot are using the BGP monitoring already and seem to love it,
thus take the next step go full SIDR :)
Greets,
Jeroen
--------------enig9A3A4493D24546622740AB75
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFJbg2XKaooUjM+fCMRAsSfAKC5UrH5ol7jHVJXlfMpoIaGcqhLMgCgkfVB
356X8rzg4uaQCcE/CqJiJqU=
=zFXY
-----END PGP SIGNATURE-----
--------------enig9A3A4493D24546622740AB75--
