Re: [anti-abuse-wg] Defining routing abuse
Should that also be treated as a policy violation? This is clearly intentional.
I believe what’s described in the Qrator article could be a leaking route optimizer (like Noction) not a new hijack type. Doug Madory Director of Internet Analysis, Oracle @internetintel Hanover, NH +1 603-676-5067
On Sat, Apr 13, 2019 at 3:55 PM Doug Madory <douglas.madory@oracle.com> wrote:
Should that also be treated as a policy violation? This is clearly intentional. I believe what’s described in the Qrator article could be a leaking route optimizer (like Noction) not a new hijack type.
Probably. The title of the article refers mostly to the imaginary case in the "ideal attack" section, not to the particular incident. But, anyway, it is a hijack by perception: the LIR managing the prefixes didn't authorize the split announcement. Also, frankly, it's not really clear if it's an optimizer just *leaking* or that's on purpose. My point is exactly that: figuring out whether there's an intent behind a routing violation or not is hard. -- Töma
But, anyway, it is a hijack by perception: the LIR managing the prefixes didn't authorize the split announcement. Also, frankly, it's not really clear if it's an optimizer just *leaking* or that's on purpose.
Has this route split (not including 25s) been visible globally? Hijacks or simular behavior happening only in scope of certain IXP are undoubtfully problematic in terms of automated issue escalation as IXP members probably had some sort of agreement on traffic engineering and whatever else being used within a limited scope. The 2019-03 is not about having a purpose or not and I highly doubt that it will be possible to define legal matters for hijacks with limited visibility scope as no trusted parties could observe it at a time. Covering all possible misuses of a global routing table certainly seems possible when we are describing global leaks, because everything else is a matter of trusted route propagation and not the application of a policy where trusted actors not always be able detect the problem at all. tl;dr - don't try to fix all possible leak scenarios with the policy, consider only ones been globally (a bad term, yeah) visible where space owner has a complaint against the leak
On Sat, Apr 13, 2019 at 6:10 PM Andrey Korolyov <andrey@xdel.ru> wrote:
The 2019-03 is not about having a purpose or not
You are now in disagreement with the very text of the proposal, and in particular, though not limited to, section 3 "Scope: Accidental vs. Deliberate": ---- start ---- A distinction can be made between accidental or deliberate hijacks from available routing datasets, looking at parameters such as duration, recurrence, possible goals, and the size of hijacked blocks. Other parameters may also be considered in the future. ---- end ----
consider only ones been [visible] globally (a bad term, yeah)
Yeah, indeed. -- Töma
---- start ---- A distinction can be made between accidental or deliberate hijacks from available routing datasets, looking at parameters such as duration, recurrence, possible goals, and the size of hijacked blocks. Other parameters may also be considered in the future. ---- end ----
Whoops, that was fun part my mind completely obsoleted and slipped out from the current understanding of the proposal. As I've stated about a month ago in one of original threads derived from message with the proposal, the intention will be shadowed out, the better the large bad actor is. AFAICS nobody have ever proposed clear 'intentional' distinction over entire set of threads. To add another remark to this, even trusted 'expert' parties could disagree on that subtle matter, making the punishing decision, whatever it would be, with false positives and false negatives all over the place. I'd suggest to remove any relations with behavior of human entities from the draft at least, as even technical part of the proposal seem to be very far from being objective.
On Sat, Apr 13, 2019 at 6:32 PM Andrey Korolyov <andrey@xdel.ru> wrote:
Whoops, that was fun part my mind completely obsoleted and slipped out from the current understanding of the proposal.
Yeah, the thread is quite long already.
AFAICS nobody have ever proposed clear 'intentional' distinction over entire set of threads.
Exactly the idea of not treating accidental leaks as a policy violation seems to be the authors' goal from the day one. (in fact, allowing route leaks to be in the scope of the proposal would only make things even more messy IMO) -- Töma
participants (3)
-
Andrey Korolyov -
Doug Madory -
Töma Gavrichenkov