May 2021 - routing-wg - mailman.ripe.net

Re: [routing-wg] [cooperation-wg] Update on NIS 2: Proposed amendments by the Parliament alter scope on (root) DNS
by Nick Hilliard 07 May '21

07 May '21

Marco Hogewoning wrote on 07/05/2021 15:30: > Personally I am not that worried about this particular amendment. > IMHO the way it is worded leaves it fairly open as to what > technologies to deploy, with RPKI being just flagged as an example. ok noted. > Important as well is that changing the recital like this, doesn't > alter the scope of the directive. In that sense it only stresses the > need for entities that fall within the scope to think about routing > security and take appropriate measures to prevent the risks in that > area. And I think we can all acknowledge that those risks do exist, > so would be hard to argue against. Yep, definitely no intention to argue against the principal. We all - community, legislators, etc - agree on the importance of routing security. The only concern I had was whether codifying specific ways of handling this was advisable, but if they're not being codified, that's fine. Nick

1 0

Weekly Routing Table Report
by cscora＠apnic.net 07 May '21

07 May '21

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 08 May, 2021 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 857788 Prefixes after maximum aggregation (per Origin AS): 324705 Deaggregation factor: 2.64 Unique aggregates announced (without unneeded subnets): 407262 Total ASes present in the Internet Routing Table: 71214 Prefixes per ASN: 12.05 Origin-only ASes present in the Internet Routing Table: 61232 Origin ASes announcing only one prefix: 25265 Transit ASes present in the Internet Routing Table: 9982 Transit-only ASes present in the Internet Routing Table: 323 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 31 Max AS path prepend of ASN (206999) 29 Prefixes from unregistered ASNs in the Routing Table: 1076 Number of instances of unregistered ASNs: 1083 Number of 32-bit ASNs allocated by the RIRs: 35977 Number of 32-bit ASNs visible in the Routing Table: 29920 Prefixes from 32-bit ASNs in the Routing Table: 139163 Number of bogon 32-bit ASNs visible in the Routing Table: 24 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 567 Number of addresses announced to Internet: 3030129536 Equivalent to 180 /8s, 156 /16s and 27 /24s Percentage of available address space announced: 81.8 Percentage of allocated address space announced: 81.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 290936 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 226816 Total APNIC prefixes after maximum aggregation: 65462 APNIC Deaggregation factor: 3.46 Prefixes being announced from the APNIC address blocks: 222971 Unique aggregates announced from the APNIC address blocks: 89686 APNIC Region origin ASes present in the Internet Routing Table: 11571 APNIC Prefixes per ASN: 19.27 APNIC Region origin ASes announcing only one prefix: 3319 APNIC Region transit ASes present in the Internet Routing Table: 1639 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 31 Number of APNIC region 32-bit ASNs visible in the Routing Table: 6727 Number of APNIC addresses announced to Internet: 772779264 Equivalent to 46 /8s, 15 /16s and 173 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-147769 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 247094 Total ARIN prefixes after maximum aggregation: 113150 ARIN Deaggregation factor: 2.18 Prefixes being announced from the ARIN address blocks: 247473 Unique aggregates announced from the ARIN address blocks: 118039 ARIN Region origin ASes present in the Internet Routing Table: 18804 ARIN Prefixes per ASN: 13.16 ARIN Region origin ASes announcing only one prefix: 6805 ARIN Region transit ASes present in the Internet Routing Table: 1941 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 30 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3858 Number of ARIN addresses announced to Internet: 1263454208 Equivalent to 75 /8s, 78 /16s and 200 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 244357 Total RIPE prefixes after maximum aggregation: 114021 RIPE Deaggregation factor: 2.14 Prefixes being announced from the RIPE address blocks: 240348 Unique aggregates announced from the RIPE address blocks: 141608 RIPE Region origin ASes present in the Internet Routing Table: 27896 RIPE Prefixes per ASN: 8.62 RIPE Region origin ASes announcing only one prefix: 11961 RIPE Region transit ASes present in the Internet Routing Table: 3892 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10157 Number of RIPE addresses announced to Internet: 710176128 Equivalent to 42 /8s, 84 /16s and 109 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 112598 Total LACNIC prefixes after maximum aggregation: 26389 LACNIC Deaggregation factor: 4.27 Prefixes being announced from the LACNIC address blocks: 113721 Unique aggregates announced from the LACNIC address blocks: 46926 LACNIC Region origin ASes present in the Internet Routing Table: 10746 LACNIC Prefixes per ASN: 10.58 LACNIC Region origin ASes announcing only one prefix: 2685 LACNIC Region transit ASes present in the Internet Routing Table: 2032 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 30 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8375 Number of LACNIC addresses announced to Internet: 176254208 Equivalent to 10 /8s, 129 /16s and 109 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-272796 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 25846 Total AfriNIC prefixes after maximum aggregation: 4926 AfriNIC Deaggregation factor: 5.25 Prefixes being announced from the AfriNIC address blocks: 32708 Unique aggregates announced from the AfriNIC address blocks: 10493 AfriNIC Region origin ASes present in the Internet Routing Table: 1454 AfriNIC Prefixes per ASN: 22.50 AfriNIC Region origin ASes announcing only one prefix: 495 AfriNIC Region transit ASes present in the Internet Routing Table: 302 Average AfriNIC Region AS path length visible: 5.1 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 803 Number of AfriNIC addresses announced to Internet: 107021568 Equivalent to 6 /8s, 97 /16s and 5 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 6324 8996 55 CMNET-GD Guangdong Mobile Communication 7545 5761 782 671 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4762 4192 74 ERX-CERNET-BKB China Education and Rese 7713 3520 1023 56 TELKOMNET-AS-AP PT Telekomunikasi Indon 7552 3498 1330 20 VIETEL-AS-AP Viettel Group, VN 45899 2804 1896 54 VNPT-AS-VN VNPT Corp, VN 4766 2428 11104 562 KIXS-AS-KR Korea Telecom, KR 9498 2339 481 237 BBIL-AP BHARTI Airtel Ltd., IN 4755 2124 441 192 TATACOMM-AS TATA Communications formerl 45090 2097 1197 71 CNNIC-TENCENT-NET-AP Shenzhen Tencent C Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 5077 9369 2238 AMAZON-02, US 11492 4773 316 611 CABLEONE, US 7155 4027 264 32 VIASAT-SP-BACKBONE, US 22773 3930 2998 245 ASN-CXA-ALL-CCI-22773-RDC, US 16625 3453 1776 2428 AKAMAI-AS, US 6327 3358 1317 68 SHAW, CA 30036 2557 372 159 MEDIACOM-ENTERPRISE-BUSINESS, US 209 2535 5037 485 CENTURYLINK-US-LEGACY-QWEST, US 5650 2251 2986 1570 FRONTIER-FRTR, US 5972 2231 451 777 DNIC-ASBLK-05800-06055, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 47331 7782 1044 3503 TTNET, TR 12479 6576 1725 146 UNI2-AS, ES 20940 3600 3347 204 AKAMAI-ASN1, NL 39891 3266 187 22 ALJAWWALSTC-AS, SA 8551 3091 378 40 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2905 2281 890 ROSTELECOM-AS, RU 9009 2420 247 1297 M247, GB 34984 2218 357 588 TELLCOM-AS, TR 13188 1610 100 31 TRIOLAN, UA 58224 1591 886 579 TCI, IR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8557 3476 579 Uninet S.A. de C.V., MX 10620 3419 526 617 Telmex Colombia S.A., CO 11830 2492 369 62 Instituto Costarricense de Electricidad 7303 1690 2058 68 Telecom Argentina S.A., AR 13999 1684 432 441 Mega Cable, S.A. de C.V., MX 6503 1444 311 476 Axtel, S.A.B. de C.V., MX 28573 1393 2280 224 CLARO S.A., BR 3816 1233 648 150 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1128 377 38 Telefonica del Peru S.A.A., PE 11664 1003 210 401 Techtel LMDS Comunicaciones Interactiva Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1590 393 22 LINKdotNET-AS, EG 24835 1445 494 28 RAYA-AS, EG 36992 1195 1473 176 ETISALAT-MISR, EG 36903 1183 537 110 MT-MPLS, MA 29571 731 68 11 ORANGE-COTE-IVOIRE, CI 6713 593 1863 34 IAM-AS, MA 36935 516 522 40 Vodafone-, EG 37342 487 32 1 MOVITEL, MZ 15399 483 48 22 WANANCHI-, KE 23889 439 232 16 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8557 3476 579 Uninet S.A. de C.V., MX 47331 7782 1044 3503 TTNET, TR 12479 6576 1725 146 UNI2-AS, ES 9808 6324 8996 55 CMNET-GD Guangdong Mobile Communication 7545 5761 782 671 TPG-INTERNET-AP TPG Telecom Limited, AU 16509 5077 9369 2238 AMAZON-02, US 11492 4773 316 611 CABLEONE, US 4538 4762 4192 74 ERX-CERNET-BKB China Education and Rese 7155 4027 264 32 VIASAT-SP-BACKBONE, US 22773 3930 2998 245 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 6576 6430 UNI2-AS, ES 9808 6324 6269 CMNET-GD Guangdong Mobile Communication Co.Ltd. 7545 5761 5090 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4762 4688 ERX-CERNET-BKB China Education and Research Net 47331 7782 4279 TTNET, TR 11492 4773 4162 CABLEONE, US 7155 4027 3995 VIASAT-SP-BACKBONE, US 22773 3930 3685 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3498 3478 VIETEL-AS-AP Viettel Group, VN 7713 3520 3464 TELKOMNET-AS-AP PT Telekomunikasi Indonesia, ID Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 18604 UNALLOCATED 8.25.204.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 40544 UNALLOCATED 12.0.33.0/24 6461 ZAYO-6461, US 46505 UNALLOCATED 12.7.131.0/24 7018 ATT-INTERNET4, US 15132 UNALLOCATED 12.9.150.0/24 1239 SPRINTLINK, US 3577 UNALLOCATED 12.19.197.0/24 209 CENTURYLINK-US-LEGACY-QWEST, Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.141.0.0/24 Origin: 395350 UNASSIGNED Transit: 11426 TWC-11426-CAROLINAS, US 23.142.80.0/24 Origin: 398481 REDMERCURY, US Transit: 209319 IPV6ROUTING, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:41 /11:103 /12:297 /13:587 /14:1192 /15:2001 /16:13498 /17:8339 /18:13892 /19:25788 /20:42463 /21:51348 /22:106915 /23:91408 /24:498478 /25:1409 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 47331 6963 7782 TTNET, TR 12479 5527 6576 UNI2-AS, ES 11492 3818 4773 CABLEONE, US 6327 3167 3358 SHAW, CA 8151 3120 8557 Uninet S.A. de C.V., MX 7155 3115 4027 VIASAT-SP-BACKBONE, US 22773 2968 3930 ASN-CXA-ALL-CCI-22773-RDC, US 39891 2801 3266 ALJAWWALSTC-AS, SA 8551 2556 3091 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 30036 2228 2557 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1884 2:1195 3:122 4:19 5:3531 6:65 7:5 8:1522 9:1 11:164 12:1753 13:361 14:2291 15:75 16:15 17:325 18:93 20:128 21:1 22:188 23:4709 24:2403 25:2 27:2523 29:19 31:2322 32:111 34:2 35:40 36:1323 37:3770 38:2082 39:611 40:160 41:3822 42:928 43:2115 44:248 45:14912 46:3701 47:320 49:1609 50:1777 51:100 52:1239 54:224 55:771 56:8 57:57 58:1716 59:1201 60:904 61:2339 62:2251 63:1959 64:5331 65:2384 66:5119 67:2894 68:1152 69:4087 70:1386 71:688 72:3178 74:2587 75:1486 76:687 77:2020 78:3705 79:2230 80:1862 81:1630 82:1362 83:1125 84:1277 85:3408 86:711 87:1796 88:2699 89:2986 90:453 91:7320 92:1751 93:2516 94:3115 95:4433 96:1280 97:347 98:993 99:970 100:92 101:1042 102:1408 103:26034 104:3745 105:435 106:726 107:2266 108:719 109:4028 110:2015 111:2960 112:1962 113:1539 114:1457 115:1905 116:1893 117:2312 118:2340 119:1882 120:1124 121:1065 122:2273 123:2218 124:1570 125:2072 128:1225 129:1228 130:854 131:2026 132:757 133:360 134:1607 135:290 136:682 137:928 138:2295 139:1166 140:734 141:1191 142:1164 143:1290 144:1264 145:329 146:1416 147:1308 148:2210 149:1407 150:811 151:1070 152:1557 153:395 154:2419 155:1335 156:1495 157:1176 158:914 159:2039 160:2120 161:1160 162:3293 163:989 164:1517 165:1383 166:595 167:1766 168:3579 169:683 170:4272 171:768 172:2171 173:2947 174:993 175:1077 176:3141 177:4293 178:2892 179:1924 180:2269 181:2610 182:3209 183:1843 184:2424 185:18202 186:4179 187:3166 188:3281 189:2874 190:8849 191:1399 192:10693 193:8064 194:6595 195:4734 196:2883 197:2378 198:6064 199:6031 200:7395 201:5336 202:10568 203:10112 204:4655 205:3344 206:3546 207:3388 208:4027 209:4698 210:4266 211:2198 212:3677 213:3328 214:1222 215:61 216:6188 217:2507 218:1163 219:708 220:2086 221:961 222:880 223:1846 End of report

1 0

Re: [routing-wg] [cooperation-wg] Update on NIS 2: Proposed amendments by the Parliament alter scope on (root) DNS
by Nick Hilliard 07 May '21

07 May '21

Marco Hogewoning wrote on 07/05/2021 11:12: > We will continue to track the legislative process and keep you > informed about the progress. Hi Marco, [cc: routing-wg] Thanks for the work y'all have been doing to sort out some of the DNS scoping issues. This is really worthwhile and it looks like it changes the proposed text from something which was completely unworkable to something which isn't entirely unreasonable. I had a quick skim through the rest of the document and came across Amendment 13: > (54a) In order to safeguard the security and to prevent abuse and > manipulation of electronic communications networks and services, the > use of interoperable secure routing standards should be promoted to > guarantee the integrity and robustness of routing functions across > the ecosystem of internet carriers. > Justification > Interoperable secure routing standards are for example Resource-PKI. I'm quite concerned to see this thrown into the proposed directive at this time. Speaking as an operator who implements RPKI in multiple contexts, I'm not confident that it's matured as a technology to the point that it would be advisable to codify it in legislation. There are several reasons here, e.g. protocol limitations, implementation limitations and potential future scope creep. The protocol limitations relate to the fact that RPKI currently only deals with route origin validation, and it is trivial to bypass the security gains it provides. Geoff Huston has written a couple of articles on this over the last while, and while there are legitimate reasons to want to deploy RPKI, it's also important to understand what it can and cannot do at the moment. In particular, it lacks any scope for routing policy management, which is an integral part of routing security. Operationally, there are still significant problems relating to RPKI TA availability and integrity, and there's been a good bit of discussion on the ripe routing-wg and at the ietf about local cache synchronisation problems. In terms of scope creep, I'd be concerned that if legislators feel that RPKI is appropriate to name in legislation, they may also feel that there might be benefit to other protocols which have been defined with the aim of addressing routing security. BGPsec would be one of these. I totally get why legislators would feel that adding routing security into the cybersecurity directive would be a good thing to do, but I don't think we're there yet with the technology side of things. Would it be possible to see whether there's consensus on this position, and whether we could present some of this to the EUPARL committee in the same way that the DNS proposals were handled? Nick

2 1

request to enable ICMP echo-reply on rpki.ripe.net?
by Job Snijders 07 May '21

07 May '21

Hi RIPE NCC, hi all, In today's troubleshooting adventure, an operator experienced difficulty pinpointing where exactly a connectivity issue between them and rpki.ripe.net (193.0.6.138 + 2001:67c:2e8:22::c100:68a) resided. It would be helpful if RIPE NCC reverted disabling responding to ICMP echo requests originating from the Internet. Would it be possible to adjust the firewall settings to accomodate troubleshooting and monitoring? Right now connectivity testing has to be performed directly against the rsync daemon's internet-exposed TCP port (873) - but it would be much cheaper and faster for both the tester and the service hoster if instead ICMP echo requests could be used as an early warning system (rather than the rsync service itself). $ ping -c 6 rpki.ripe.net PING rpki.ripe.net (193.0.6.138): 56 data bytes --- rpki.ripe.net ping statistics --- 6 packets transmitted, 0 packets received, 100.0% packet loss The above test result differs compared to sending echo requests to molamola.ripe.net or manus.authdns.ripe.net. Kind regards, Job

8 12