Slashdot Mirror
Internet Routing, Looming Disaster?
wiredmikey writes "The Internet's leading architects have considered the rapid growth and fragmentation of core routing tables one of the most significant threats to the long-term stability and scalability of the Internet. In April 2010, about 15% of the world's Internet traffic was hijacked by a set of servers owned by China Telecom. In the technical world, this is typically called a prefix hijack, and it happened due to a couple of wrong tweaks made at China Telecom. Whether this was intentional or not is unknown, but such routing accidents are all too common online. While BGP is the de-facto protocol for inter-domain routing on the Internet, actual routing occurs without checking whether the originator of the route is authorized to do so. The global routing system itself is made up of autonomous systems (AS) which are simply loosely interconnected routing domains. Each autonomous system decides, unilaterally, and even arbitrarily, to trust everything it hears from any other AS, to use that information without validation, and to further transmit that information to its other peers..."
And this is news because?
This is how the BGP internet functions. the last proposed solution was to centralize the BGP trust tables, which is likely a WORSE solution.
if you can't trust your peers: go work in another kitchen.
No, each ISP chooses what routes to accept from what peers. It's called a filter. Smart ISP use routing databases like RIPE to verify what they'll accept and reject automatically. Others do it by hand. Dumb ones accept updates from peers without filtering. It's this last group that needs to update their practices.
Anybody who touches BGP needs to understand route filtering.
* Would I trust everything I see from Sprint? Yes.
* Would I trust anything except what I expect from the local ISP I route to? No.
* Would I expect Sprint to execute the same filtering as above? Yes.
BGP nodes should always have filters on their connections that describe what is allowed to be accepted. Every failure I can think of... and I'm sure most notable ones that have happened... have been caused by failure to properly filter incoming routes.
SIG: HUP
So... what you're saying is we should all start using that nifty authentication feature several routing protocols support, because it would make routing more secure? I suppose the better question is, why haven't we done it?
...just like every other aging technology that increases its workload and interoperability on a scale that was never originally intended.
He who knows best knows how little he knows. - Thomas Jefferson
before we throw this number around anymore, does anyone know approx. how much internet traffic normally goes through China? is the 15% number 15% more than normal, and additional 15%. a baseline is an incredibly important thing.
every anarchist is a baffled dictator. Benito_Mussolini
Really?
It's always amusing when a new pundit discovers exactly how the Internet actually works.
Until they gain enough technical knowledge to be dangerous, they assume that the Internet is just as Hollywood portrays... A rock-solid utility run by the Government that only PhDs and arcanely skilled teenage geniuses can control or understand.
Then they discover just how "fragile" it is, and start telling the people who've been making it work all along that they need to straighten up and fly right, or else a major disaster is going to happen. Good thing they told us.
It's sad that they can't just say "Oh, I guess I didn't understand.". Instead they have to "take charge" of things because otherwise they'd have to accept their own irrelevance, or even (gasp) accept that despite their new-found expertise, they *still* don't really understand.
So straighten up, Cisco... it's obvious to this guy you don't know what you're doing. Fix that BGP thing and do it NOW, you hear him?
That every major ISP carefully plans out and monitors their BGP peering sessions. I do agree that fragmentation is an issue, but not with the blatant Chinese sensationalism. It is against any ISPs best interests to load their BGP metrics in a way to drastically change the current flow of data, as that would introduce network instability. In addition, the author doesn't seem to recognize that roughly 50% of the traffic on the internet today is either Google or Facebook related - they can talk about an elegant and scalable solution all they want, but so long as the traffic looks like it does now, it is the content providers who drive the future of the landscape.
it's a disaster, the internet is collapsing, the world is ending. blah. blah. blah.
The Kruger Dunning explains most post on
And that's why RPKI is under development all over the world.
If so not much has been learned...
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
my router has lots of bandwidth.
Since we are now getting to the final blocks of IPv4, how does this issue effect IPv6? Is this currently an IPv4 issue or will it impact IPv6 too?
Jumpstart the tartan drive.
Then they discover just how "fragile" it is, and start telling the people who've been making it work all along that they need to straighten up and fly right, or else a major disaster is going to happen.
It's very simple; put all ISPs behind NAT routers - Linksys' are perfect. Therefore, all the ISPs will be 192.1.1.xxx and everyone will be under that. The Internet only needs one hundred IP addresses!
My captcha is "urinate" - how fitting.
In April 2010, about 15% of the world's Internet traffic was hijacked by a set of servers owned by China Telecom...
Except of course that after the initial flurry of headlines, analysis showed that the 15% figure was a wild exaggeration, orders of magnitude off...
"would i trust everything i see from bear stearns?"
yes
"would i trust everything i see from lehman brothers?"
yes
oh wait..
When we realize the government has inadequate security we leap together in unison and scream, "Why didn't they fix that loophole before??" But when someone tries to raise awareness about the need to take preventative measures on a large scale, all of a sudden it's "lulz silly journalist." Also, the author is not even a journalist. His name is Ram Mohan, "Executive Vice President and Chief Technology Officer at Afilias, a global provider of Internet infrastructure services including domain name registry and DNS solutions. "
Claims About China's April Internet Hijack Are Overblown
http://tech.slashdot.org/story/10/11/19/1527217/Claims-About-Chinas-April-Internet-Hijack-Are-Overblown
So why is it being repeated over and over again?
because people keep reposting it after reading it while knowing nothing about the topic that's being discussed.
regardless: all this shows is that:
1) a Chinese telecom was advertising routes for someone they shouldn't. 2) it takes a while for the BGP sessions to converge and reveal that two hosts were advertising the same prefixes, 3) the Chinese telecom SHOULD have pulled the local machine that was advertising a prefix to which it was not authoritive, 4) the Chinese telecom decided NOT to do this, revealing awareness that some globally routed prefixes at the local level can be forwarded to local routers before either being captured or properly forwarded.
there is NOTHING new here: this is how BGP works.
In April 2010, about 15% of the world's Internet traffic was hijacked by a set of servers owned by China Telecom.
Wasn't there an article yesterday about how this wasn't true?
It's amazing that in the same breath (definitely on the same page) there are posts promoting/demanding immediate/accelerated acceptance/implementation of IPv6 and then this.
People, wake up - there are significant problems running the current, well compacted address space. Things will only get worse when address space becomes extremely sparse and, for all practical purposes, infinite.
The author complains about "fragmentation of routing tables," but then goes on to talk about route hijacking. Doesn't IPv6 largely fix routing table fragmentation? (Real question -- hoping for answer.) Route hijacking is largely fixed by good routing filter hygiene, as explained in previous posts. Most routing protocols support encryption, which won't help if a trusted router sends you bad routes, but can at least make sure you can tell the difference between trusted and untrusted route updates. I don't think BGP supports encrypted advertisements. Anybody know?
I will create a sig when innovation restarts in the U.S.
I've always wondered when everyone switches to IPv6 doesn't this effectivly double the size of the DFZ's routing table right there as IPv6 network advertisements are independant of v4?
I honestly don't get why routing table size is such a dire issue .. A few hundred thousand or even a few million routes does not seem unreasonable from a memory POV? Even for IPv6 it is not like your going to see many folks advertising much more than a /32? ..gulp..right? :)
Have to keep in mind we are not talking all routers just those few that actually need to pull a full BGP session.
The biggest real fear issue I know of is propogating flappy state changes throughout the global network leading to some form of self-reinforcing congestive collapse but like all things there are countermeasures (route dapending) to address this and available bandwidth for signaling has more than kept up with table growth over time but perhaps not equally in all regions?
Before the world comes to an end and all my traceroutes start seeing stars I would like to mention it is telling the author ommitted route filtering, bogons and basically every measure that exists today to prevent exactly the things he is talking about from his article.. WTF?
WRT to the China incident the 15% number floating around is in the form of *routes* not traffic..again WTF.
Well that's why you encrypt sensitive data. the whole idea of the internet is to be an autonomous HEADLESS system... granite even though the majority of network is "trafficked" through a few very large governmental servers its designed to run without the need of a centralized master and to change that would then introduce the "who should be in charge" question. bottom line is if you dont want everyone to be able to read it either ENCRYPT it or better yet don't put it on the internet to start with!
Yes, here on slashdot. Please mod parent up. I wanted to say this, but I stay as an AC.
If by "problem solved" you mean the IRRs, you need some reality juice.
Most ASs do not use the IRRs, and the data in the IRRs is stale and often incorrect. This has been MEASURED by various RIRs, we see an update of that same presentation every two years, and nothing changes. It doesn't help that self-policing in the IRRs is utter crap (see: proxy objects).
Yes, people will push for RPKI. Deal with it. The anarchy screwed up, failed to uphold enough self-restraint and self-regulation to solve the problem in practice, and now we will have the same kind of crap needed for DNSSEC, now for routing.
Is "Routing Hell" better than "Redirect Hell"? If it is, I'd like to leave the latter ASAP!
Knowing Google's lust for data collection, the Soviet Union is still alive and well inside the psyche of Sergey Brin....
we would have a major conflict in the world, like a WW3 or slightly less, what could the cyberwarriors do? Wouldn't BGP-attacks be on top of the todo-list? Then DNS-rootservers? Or to put it differently, what would you do to cause the most disruption on the enemy?
I actually implemented BGP in our equipment (I mean wrote the protocol implementation) and since I'm advertising as opposed to handling heavy routing, the title of the article got me thinking a little.
/24 for your customers, it's very likely you can go straight up to a top teir provider and not be able to get that /24 from an existing pool of addresses. So, they'll get those addresses from somewhere else. The /8 you get it from might already be being routed to another top teir. Then the /10 is routed to a second tier provider elsewhere who then sold the /12 to a provider on another provider and so forth and so on.
/8s that they got at different periods, they could try and recover all the /8s in a /12 by arranging trades.
By now, the top traffic routers are probably facing such a massive problem with fragmentation of address pools, that it has to be getting nearly impossible to perform any form of routing without enormous tables.
I'm speculating now.
These days if you (as an ISP) need a new
A top teir provider might have a routing table of their own which, cached could consume hundreds of megabytes of entries. Since top tier routers may actually have millions of open routes at a given time, the cache has to be HUGE!!! Far more than could fit comfortably in fast RAM (SRAM for example and certainly no in register space within an ASIC).
The point being that top tier routers, if they worked on more optimal lookup tables would probably be able to handle much higher throughputs reliably. Less dropped packets etc...
So, I'd say that fragmentation of the address space is probably murder on the top tier routers. It would make a great deal of sense that ICANN or whoever would attempt to start detangling the address space a bit. In the case of ISPs who often have a huge pool of
Additionally, it might even be possible to recover a few hundred thousand usuable IPs by consolidating the pools and therefore cutting down the massive number of addresses wasted on line and subnet IPs.
I'm pretty sure the "what needs to be done" list could be generated programmatically by data mining.
There'd be a great deal of benefits to it, but at the cost of actually having to do work to make it happen.
yes, this is how BGP works. and parts of how it works are broken. unauthenticated route origination makes no sense and should be fixed - that's why RPKI makes sense and is likely to get real adoption from serious players.
if nothing is done to restore sanity, there will be more accidents. not fixing what's broken is inexcusable.