[169498] in North American Network Operators' Group
Re: Filter on IXP
daemon@ATHENA.MIT.EDU (=?ISO-8859-1?Q?J=E9r=F4me_Nicolle?)
Fri Feb 28 10:43:25 2014
Date: Fri, 28 Feb 2014 16:42:59 +0100
From: =?ISO-8859-1?Q?J=E9r=F4me_Nicolle?= <jerome@ceriz.fr>
To: nanog@nanog.org
In-Reply-To: <922B21F2-D3E9-41C4-A3CE-39D8B4565842@exchange.peer1.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Hi Chris,
Le 23/02/2014 01:43, Chris Laffin a écrit :
> It would be really cool if peering exchanges could police ntp on their connected members.
Well, THIS looks like the worst idea ever. Wasting ASIC ressources on
IXP's dataplanes is a wet-dream for anyone willing to kill the network.
IXP's neutrality is a key factor to maintain reasonable interconnexion
density.
Instead, IXPs _could_ enforce BCP38 too. Mapping the route-server's
received routes to ingress _and_ egress ACLs on IXP ports would mitigate
the role of BCP38 offenders within member ports. It's almost like uRPF
in an intelligent and useable form.
A noticeable side-effect is that members would be encouraged to announce
their entire customer-cones to ensure egress trafic from a non-exchanged
prefix would not be dropped on the IX's port.
By the way, would anyone know how to generate OpenFlow messages to push
such filters to member ports ? Would there be any smat way to do that on
non-OpenFlow enabled dataplanes (C6k...) ?
Best regards,
--
Jérôme Nicolle
+33 6 19 31 27 14
