[52739] in North American Network Operators' Group
Re: Who does source address validation? (was Re: what's that smell?)
daemon@ATHENA.MIT.EDU (Stephen Gill)
Wed Oct 9 22:06:33 2002
From: "Stephen Gill" <gillsr@yahoo.com>
To: <nanog@merit.edu>
Date: Wed, 9 Oct 2002 21:07:02 -0500
Errors-To: owner-nanog-outgoing@merit.edu
This is a multi-part message in MIME format.
------=_NextPart_000_0019_01C26FD7.D120E180
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Though the docs aren't indexed in the web search tool yet, JUNOS 5.5
adds the ability to perform loose uRPF now.
[edit int <name> unit 0 family inet]
set rpf-check mode loose
Watch for wrapping.
http://www.juniper.net/techpubs/software/junos/junos55/swconfig55-interf
aces/download/swconfig55-interfaces.pdf
Cheers,
-- steve
Date: Tue, 8 Oct 2002 12:29:48 -0400
From: Jared Mauch <jared@puck.Nether.net>
Subject: Re: Who does source address validation? (was Re: what's that
smell?)
On Tue, Oct 08, 2002 at 10:15:28AM -0600, Danny McPherson wrote:
>
>
> > "reachable-via any" means you're only going to drop the packet if
you
> > don't have *ANY* route back to them.
>
> What's a route? An IP RIB instance? A BGP Loc-RIB instance? An IGP
LSDB
> IP prefix entry? A BGP Adj-RIB-In instance?
>
> I think you mean "if you don't have *ANY* **FIB** entry for the
> source address".
>
> If I peer with two large providers on the same router and both
> have prefix D.1 behind them and advertise the prefix to me, it's
> likely that only one of those two paths is going to make it into
> the BGP Loc-RIB (and subsequently, the IP RIB then FIB).
>
> If I use ANY FIB entry as proof that it's a valid source then
> that only addresses RFC1918ish space and only suggest that I
> first need to generate an invalid BGP route for the prefix, then
> spoof the packets. This doesn't fix spoofing with global IP
> addresses.
>
> If I use only entries that occur in the RIB and associate them
> with the receiving interface and receive a packet with an SA of
> D.1 from the peer whose path wasn't installed in the BGP
> Loc-RIB then I'll drop it. (And there's nothing broken with
> this configuration -- it's why we have routers with 1 million
> BGP paths but only 150K routes/fib entries, as I'm sure you
> know).
>
> If you're going to do source address validation then you need
> to associated all potential valid paths for a given prefix with
> the associated ingress interface, else it's mostly useless.
Yes, but if i continue in my ideal situation of people
(mostly) filter their bgp customers, so they won't announce the
1918 space, or similar. even the large peers filter out each other
so they don't pick up 1918 announcements. Plus people use Robs
"Secure IOS Template" to drop extraneous bgp announcements for
unregistered/unassigned space (from IANA).
I'm not purporting this as a solution to all problems on
the internet, but if one walks before one runs this is a reasonable
step in the correct direction. Or at least a nice bandaid (duct tape?)
to help keep the network in a bit more sensible shape. And if everyone
did it, it would help with the orignal problem/statistics posted about
how much 1918 space was hitting one specific root server.
I am interested in hearing other solutions to the problem
including extra validations such as the above, but those aren't
avalable today and what i'm suggesting is in the 12.0S and 12.1E
IOS images and probally others.
- Jared
- --
Jared Mauch | pgp key available via finger from jared@puck.nether.net
clue++; | http://puck.nether.net/~jared/ My statements are only
mine.
------=_NextPart_000_0019_01C26FD7.D120E180
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:st1=3D"urn:schemas-microsoft-com:office:smarttags" =
xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DProgId content=3DWord.Document>
<meta name=3DGenerator content=3D"Microsoft Word 10">
<meta name=3DOriginator content=3D"Microsoft Word 10">
<link rel=3DFile-List href=3D"cid:filelist.xml@01C26FD7.D0529500">
<o:SmartTagType =
namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"PersonName"/>
<o:SmartTagType =
namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"time"/>
<o:SmartTagType =
namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"date"/>
<!--[if gte mso 9]><xml>
<o:OfficeDocumentSettings>
<o:DoNotRelyOnCSS/>
</o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:WordDocument>
<w:SpellingState>Clean</w:SpellingState>
<w:GrammarState>Clean</w:GrammarState>
<w:DocumentKind>DocumentEmail</w:DocumentKind>
<w:EnvelopeVis/>
<w:DrawingGridHorizontalSpacing>6 pt</w:DrawingGridHorizontalSpacing>
=
<w:DisplayHorizontalDrawingGridEvery>2</w:DisplayHorizontalDrawingGridEve=
ry>
=
<w:DisplayVerticalDrawingGridEvery>2</w:DisplayVerticalDrawingGridEvery>
<w:Compatibility>
<w:BreakWrappedTables/>
<w:SnapToGridInCell/>
<w:ApplyBreakingRules/>
<w:WrapTextWithPunct/>
<w:UseAsianBreakRules/>
<w:UseFELayout/>
</w:Compatibility>
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
</w:WordDocument>
</xml><![endif]--><!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;
mso-font-alt:\5B8B\4F53;
mso-font-charset:134;
mso-generic-font-family:auto;
mso-font-pitch:variable;
mso-font-signature:3 135135232 16 0 262145 0;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;
mso-font-charset:134;
mso-generic-font-family:auto;
mso-font-pitch:variable;
mso-font-signature:3 135135232 16 0 262145 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-parent:"";
margin:0in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:SimSun;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;
text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;
text-underline:single;}
span.EmailStyle17
{mso-style-type:personal-compose;
mso-style-noshow:yes;
mso-ansi-font-size:10.0pt;
mso-bidi-font-size:10.0pt;
font-family:Arial;
mso-ascii-font-family:Arial;
mso-hansi-font-family:Arial;
mso-bidi-font-family:Arial;
color:windowtext;}
span.SpellE
{mso-style-name:"";
mso-spl-e:yes;}
span.GramE
{mso-style-name:"";
mso-gram-e:yes;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;
mso-header-margin:.5in;
mso-footer-margin:.5in;
mso-title-page:yes;
mso-paper-source:0;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 10]>
<style>
/* Style Definitions */=20
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";}
</style>
<![endif]-->
</head>
<body lang=3DEN-US link=3Dblue vlink=3Dpurple =
style=3D'tab-interval:.5in'>
<div class=3DSection1>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>Though
the docs aren’t indexed in the web search tool yet, JUNOS 5.5 adds =
the
ability to perform loose <span class=3DSpellE>uRPF</span> =
now.<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>[<span
class=3DGramE>edit</span> <span class=3DSpellE>int</span> <name> =
unit 0 family
<span class=3DSpellE>inet</span>]<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>set</span></font></span><font size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'> <span
class=3DSpellE>rpf</span>-check mode loose<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>Watch
for wrapping…<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'><a
href=3D"http://www.juniper.net/techpubs/software/junos/junos55/swconfig55=
-interfaces/download/swconfig55-interfaces.pdf">http://www.juniper.net/te=
chpubs/software/junos/junos55/swconfig55-interfaces/download/swconfig55-i=
nterfaces.pdf</a><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'>Cheers,<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>--
<span class=3DSpellE><span =
class=3DGramE>steve</span></span><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>Date:
</span></font><st1:date Month=3D"10" Day=3D"8" Year=3D"2002"><font =
size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>Tue,
8 Oct 2002</span></font></st1:date><font size=3D2 face=3D"Courier =
New"><span
style=3D'font-size:10.0pt;font-family:"Courier New"'> =
</span></font><st1:time
Hour=3D"12" Minute=3D"29"><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt;font-family:"Courier =
New"'>12:29:48</span></font></st1:time><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
-0400<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>From:
</span></font><st1:PersonName><font size=3D2 face=3D"Courier New"><span
style=3D'font-size:10.0pt;font-family:"Courier New"'>Jared =
Mauch</span></font></st1:PersonName><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
<jared@puck.Nether.net><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>Subject:
Re: Who does source address validation? (<span class=3DGramE>was</span> =
Re:
what's that smell?)<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>On
</span></font><st1:date Month=3D"10" Day=3D"8" Year=3D"2002"><font =
size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>Tue,
Oct 08, 2002</span></font></st1:date><font size=3D2 face=3D"Courier =
New"><span
style=3D'font-size:10.0pt;font-family:"Courier New"'> at =
</span></font><st1:time
Hour=3D"10" Minute=3D"15"><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt;font-family:"Courier =
New"'>10:15:28AM</span></font></st1:time><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
-0600, Danny McPherson wrote:<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
> "reachable-via any" means you're only going to drop the =
packet
if you<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
> don't have *ANY* route back to them. <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
What's a route?<span style=3D'mso-spacerun:yes'> </span><span =
class=3DGramE>An
IP RIB instance?</span><span style=3D'mso-spacerun:yes'> =
</span><span
class=3DGramE>A BGP Loc-RIB instance?</span><span =
style=3D'mso-spacerun:yes'>
</span>An IGP LSDB<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
IP <span class=3DGramE>prefix</span> entry?<span =
style=3D'mso-spacerun:yes'>
</span><span class=3DGramE>A BGP <span class=3DSpellE>Adj</span>-RIB-In =
instance?</span><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
I think you mean "if you don't have *ANY* **FIB** entry for the =
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>> source =
address".</span></font></span><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
If I peer with two large providers on the same router and both =
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
have prefix D.1 behind them and advertise the prefix to me, =
it's<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<span class=3DGramE>likely</span> that only one of those two paths is =
going to
make it into <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<span class=3DGramE>the</span> BGP Loc-RIB (and subsequently, the IP RIB =
then
FIB).<span style=3D'mso-spacerun:yes'> =
</span><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
If I use ANY FIB entry as proof that it's a valid source then =
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<span class=3DGramE>that</span> only addresses RFC1918ish space and only =
suggest
that I <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<span class=3DGramE>first</span> need to generate an invalid BGP route =
for the
prefix, then <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
spoof the packets.<span style=3D'mso-spacerun:yes'> </span>This =
doesn't fix
spoofing with global IP<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>> addresses.</span></font></span><font =
size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
If I use only entries that occur in the RIB and associate them =
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<span class=3DGramE>with</span> the receiving interface and receive a =
packet with
an SA of <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
D.1 from the peer whose path wasn't installed in the BGP =
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
Loc-RIB then I'll drop it.<span style=3D'mso-spacerun:yes'> =
</span>(And
there's nothing broken with <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<span class=3DGramE>this</span> configuration -- it's why we have =
routers with 1
million <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
BGP paths but only 150K routes/fib entries, as I'm sure you =
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
know).<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
If you're going to do source address validation then you need =
<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<span class=3DGramE>to</span> associated all potential valid paths for a =
given
prefix with <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>>
<span class=3DGramE>the</span> associated ingress interface, else it's =
mostly
useless.<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'><span
style=3D'mso-tab-count:1'> </span>Yes, but =
if <span
class=3DSpellE>i</span> continue in my ideal situation of =
people<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>(<span
class=3DGramE>mostly</span>) filter their <span =
class=3DSpellE>bgp</span>
customers, so they won't announce the<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>1918 space, or =
similar.</span></font></span><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'><span
style=3D'mso-spacerun:yes'> </span><span class=3DGramE>even</span> =
the large
peers filter out each other<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>so</span></font></span><font size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
they don't pick up 1918 announcements.<span =
style=3D'mso-spacerun:yes'>
</span>Plus people use Robs <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>"Secure
IOS Template" to drop extraneous <span class=3DSpellE>bgp</span>
announcements for<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier =
New"'>unregistered/unassigned</span></font></span><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
space (from IANA).<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'><span
style=3D'mso-tab-count:1'> </span>I'm not
purporting this as a solution to all problems =
on<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>the</span></font></span><font size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
internet, but if one walks before one runs this is a =
reasonable<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>step</span></font></span><font size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'> in
the correct direction.<span style=3D'mso-spacerun:yes'> =
</span><span
class=3DGramE>Or at least a nice <span class=3DSpellE>bandaid</span> =
(duct tape?)</span><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>to</span></font></span><font size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
help keep the network in a bit more sensible shape.<span
style=3D'mso-spacerun:yes'> </span>And if =
everyone<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>did</span></font></span><font size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
it, it would help with the <span class=3DSpellE>orignal</span> =
problem/statistics
posted about<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>how</span></font></span><font size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
much 1918 space was hitting one specific root =
server.<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'><span
style=3D'mso-tab-count:1'> </span>I am =
interested
in hearing other solutions to the problem<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>including</span></font></span><font size=3D2
face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
extra validations such as the above, but those =
aren't<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DSpellE><span class=3DGramE><font size=3D2 face=3D"Courier =
New"><span
style=3D'font-size:10.0pt;font-family:"Courier =
New"'>avalable</span></font></span></span><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
today and what <span class=3DSpellE>i'm</span> suggesting is in the =
12.0S and
12.1E<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'>IOS images and <span =
class=3DSpellE>probally</span>
others.</span></font></span><font size=3D2 face=3D"Courier New"><span
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'><span
style=3D'mso-tab-count:1'> </span>- =
Jared<o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New"'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>-
-- <o:p></o:p></span></font></p>
<p class=3DMsoNormal =
style=3D'mso-layout-grid-align:none;text-autospace:none'><st1:PersonName>=
<font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>Jared
<span class=3DGramE>Mauch</span></span></font></st1:PersonName><span
class=3DGramE><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;
font-family:"Courier New"'><span style=3D'mso-spacerun:yes'> =
</span>|</span></font></span><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>
<span class=3DSpellE>pgp</span> key available via finger from
jared@puck.nether.net<o:p></o:p></span></font></p>
<p class=3DMsoNormal><span class=3DGramE><font size=3D2 face=3D"Courier =
New"><span
style=3D'font-size:10.0pt;font-family:"Courier =
New"'>clue</span></font></span><font
size=3D2 face=3D"Courier New"><span =
style=3D'font-size:10.0pt;font-family:"Courier New"'>++;<span
style=3D'mso-spacerun:yes'> </span>| <a
href=3D"http://puck.nether.net/~jared/">http://puck.nether.net/~jared/</a=
><span
style=3D'mso-spacerun:yes'> </span>My statements are only =
mine.</span></font><font
size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p=
>
</div>
</body>
</html>
------=_NextPart_000_0019_01C26FD7.D120E180--
