- routing-wg - mailman.ripe.net

TC x IRRd 4.2
by Rubens Kuhl 28 Apr '21

28 Apr '21

Hi all. TC IRR, an IRR operator focused on Brazilian networks, just changed to IRRd 4.2. The new version allowed TC to deploy RPKI validation (thanks NTT for sponsoring that development) and expose HTTPS endpoints for WHOIS and submission that we hope will foster innovation around the database. Every precaution was taken for this migration to be seamless for other IRR operators, including matching of serial numbers. Every IRR server that mirrored TC and supported -j status query was verified that it followed and still correctly follows database journals. But if anything appears broken, please let me know or e-mail db-admin(a)bgp.net.br. Thanks, Rubens

2 1

Re: [routing-wg] [anti-abuse-wg] AS8003 and U.S. Department of Defense routing
by Randy Bush 27 Apr '21

27 Apr '21

[ brian lured me into the abuse circle; so reposting with routing ] interesting wg to do routing security analysis. as i do really not know the dod's or their proxy's motive(s), i can not say much about their tactics let alone strategy. i do know, and have actually seen and experienced, part of 11/8 being used as if it was 1918 space; ripe bologna was the first time. and the food in that town was fantastic! a /8 telescope would pick up leakage patterns as well as the current shotgun blast of announcements (i presume folk have looked at the actual announcements). i would naïvely think that the /8 might be slightly more easily analyzed than the pieces. maybe, as the telescope analysis shows focused leaks, they are trying to disrupt those focused uses with these focused announcements. but, if an op is using 11.12.666.0/23 internally, would they be careless enough to accept an exogenous announcement of that space? i guess i should not underestimate carelessness. is some random (small, i hope) isp using my address space internally as 1918 equivalent abusive, beyond their customers maybe not be able to reach my network? if so, maybe the vigilantes are looking in the wrong direction. randy --- randy(a)psg.com `gpg --locate-external-keys --auto-key-locate wkd randy(a)psg.com` signatures are back, thanks to dmarc header butchery

1 0

AS8003 and U.S. Department of Defense routing
by Ronald F. Guilmette 25 Apr '21

25 Apr '21

Greetings friends, I though that you all might like to be aware of this: https://apnews.com/article/technology-business-government-and-politics-b26a… Regards, rfg

1 0

Weekly Routing Table Report
by cscora＠apnic.net 23 Apr '21

23 Apr '21

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 24 Apr, 2021 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 857293 Prefixes after maximum aggregation (per Origin AS): 324456 Deaggregation factor: 2.64 Unique aggregates announced (without unneeded subnets): 406443 Total ASes present in the Internet Routing Table: 71149 Prefixes per ASN: 12.05 Origin-only ASes present in the Internet Routing Table: 61197 Origin ASes announcing only one prefix: 25304 Transit ASes present in the Internet Routing Table: 9952 Transit-only ASes present in the Internet Routing Table: 318 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 38 Max AS path prepend of ASN ( 37385) 33 Prefixes from unregistered ASNs in the Routing Table: 1013 Number of instances of unregistered ASNs: 1024 Number of 32-bit ASNs allocated by the RIRs: 35805 Number of 32-bit ASNs visible in the Routing Table: 29816 Prefixes from 32-bit ASNs in the Routing Table: 138622 Number of bogon 32-bit ASNs visible in the Routing Table: 26 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 497 Number of addresses announced to Internet: 3031282560 Equivalent to 180 /8s, 173 /16s and 179 /24s Percentage of available address space announced: 81.9 Percentage of allocated address space announced: 81.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 291090 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 226990 Total APNIC prefixes after maximum aggregation: 65614 APNIC Deaggregation factor: 3.46 Prefixes being announced from the APNIC address blocks: 223063 Unique aggregates announced from the APNIC address blocks: 89596 APNIC Region origin ASes present in the Internet Routing Table: 11532 APNIC Prefixes per ASN: 19.34 APNIC Region origin ASes announcing only one prefix: 3302 APNIC Region transit ASes present in the Internet Routing Table: 1622 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 30 Number of APNIC region 32-bit ASNs visible in the Routing Table: 6680 Number of APNIC addresses announced to Internet: 771997952 Equivalent to 46 /8s, 3 /16s and 193 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-143673 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 246095 Total ARIN prefixes after maximum aggregation: 113015 ARIN Deaggregation factor: 2.18 Prefixes being announced from the ARIN address blocks: 246524 Unique aggregates announced from the ARIN address blocks: 117903 ARIN Region origin ASes present in the Internet Routing Table: 18782 ARIN Prefixes per ASN: 13.13 ARIN Region origin ASes announcing only one prefix: 6813 ARIN Region transit ASes present in the Internet Routing Table: 1950 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 29 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3832 Number of ARIN addresses announced to Internet: 1264127744 Equivalent to 75 /8s, 89 /16s and 15 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 244552 Total RIPE prefixes after maximum aggregation: 113812 RIPE Deaggregation factor: 2.15 Prefixes being announced from the RIPE address blocks: 240539 Unique aggregates announced from the RIPE address blocks: 141455 RIPE Region origin ASes present in the Internet Routing Table: 27905 RIPE Prefixes per ASN: 8.62 RIPE Region origin ASes announcing only one prefix: 11992 RIPE Region transit ASes present in the Internet Routing Table: 3888 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 38 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10142 Number of RIPE addresses announced to Internet: 711050880 Equivalent to 42 /8s, 97 /16s and 198 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 112705 Total LACNIC prefixes after maximum aggregation: 26332 LACNIC Deaggregation factor: 4.28 Prefixes being announced from the LACNIC address blocks: 113867 Unique aggregates announced from the LACNIC address blocks: 46980 LACNIC Region origin ASes present in the Internet Routing Table: 10738 LACNIC Prefixes per ASN: 10.60 LACNIC Region origin ASes announcing only one prefix: 2702 LACNIC Region transit ASes present in the Internet Routing Table: 2025 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 33 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8361 Number of LACNIC addresses announced to Internet: 176082944 Equivalent to 10 /8s, 126 /16s and 208 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-272796 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 25937 Total AfriNIC prefixes after maximum aggregation: 4937 AfriNIC Deaggregation factor: 5.25 Prefixes being announced from the AfriNIC address blocks: 32803 Unique aggregates announced from the AfriNIC address blocks: 10059 AfriNIC Region origin ASes present in the Internet Routing Table: 1457 AfriNIC Prefixes per ASN: 22.51 AfriNIC Region origin ASes announcing only one prefix: 495 AfriNIC Region transit ASes present in the Internet Routing Table: 297 Average AfriNIC Region AS path length visible: 5.2 Max AfriNIC Region AS path length visible: 38 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 801 Number of AfriNIC addresses announced to Internet: 107602432 Equivalent to 6 /8s, 105 /16s and 226 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 6346 8996 55 CMNET-GD Guangdong Mobile Communication 7545 5732 783 669 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4754 4192 74 ERX-CERNET-BKB China Education and Rese 7713 3523 1023 56 TELKOMNET-AS-AP PT Telekomunikasi Indon 7552 3482 1330 20 VIETEL-AS-AP Viettel Group, VN 45899 2901 1896 54 VNPT-AS-VN VNPT Corp, VN 4766 2434 11104 565 KIXS-AS-KR Korea Telecom, KR 9498 2336 481 236 BBIL-AP BHARTI Airtel Ltd., IN 4755 2119 441 191 TATACOMM-AS TATA Communications formerl 45090 2098 1197 72 CNNIC-TENCENT-NET-AP Shenzhen Tencent C Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 5030 9345 2242 AMAZON-02, US 11492 4752 315 712 CABLEONE, US 7155 4030 264 32 VIASAT-SP-BACKBONE, US 22773 3935 3005 249 ASN-CXA-ALL-CCI-22773-RDC, US 16625 3430 1767 2427 AKAMAI-AS, US 6327 3360 1317 69 SHAW, CA 30036 2559 373 127 MEDIACOM-ENTERPRISE-BUSINESS, US 209 2531 5037 484 CENTURYLINK-US-LEGACY-QWEST, US 5650 2345 2997 1640 FRONTIER-FRTR, US 5972 2231 451 784 DNIC-ASBLK-05800-06055, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 47331 7796 1045 3498 TTNET, TR 12479 6489 1725 144 UNI2-AS, ES 20940 3579 3347 204 AKAMAI-ASN1, NL 8551 3351 379 41 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 39891 3266 187 22 ALJAWWALSTC-AS, SA 12389 2908 2284 898 ROSTELECOM-AS, RU 9009 2413 247 1290 M247, GB 34984 2216 357 586 TELLCOM-AS, TR 13188 1610 100 31 TRIOLAN, UA 58224 1580 883 574 TCI, IR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8518 3474 575 Uninet S.A. de C.V., MX 10620 3412 526 615 Telmex Colombia S.A., CO 11830 2494 369 62 Instituto Costarricense de Electricidad 7303 1899 2063 72 Telecom Argentina S.A., AR 13999 1672 447 424 Mega Cable, S.A. de C.V., MX 6503 1443 311 475 Axtel, S.A.B. de C.V., MX 28573 1386 2276 224 CLARO S.A., BR 3816 1229 644 147 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1130 377 39 Telefonica del Peru S.A.A., PE 11664 1002 212 400 Techtel LMDS Comunicaciones Interactiva Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1586 393 22 LINKdotNET-AS, EG 24835 1443 486 27 RAYA-AS, EG 36992 1202 1537 176 ETISALAT-MISR, EG 36903 1181 536 114 MT-MPLS, MA 29571 731 68 11 ORANGE-COTE-IVOIRE, CI 6713 549 1863 34 IAM-AS, MA 36935 517 522 40 Vodafone-, EG 37342 487 32 1 MOVITEL, MZ 15399 483 48 24 WANANCHI-, KE 23889 439 232 16 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8518 3474 575 Uninet S.A. de C.V., MX 47331 7796 1045 3498 TTNET, TR 12479 6489 1725 144 UNI2-AS, ES 9808 6346 8996 55 CMNET-GD Guangdong Mobile Communication 7545 5732 783 669 TPG-INTERNET-AP TPG Telecom Limited, AU 16509 5030 9345 2242 AMAZON-02, US 4538 4754 4192 74 ERX-CERNET-BKB China Education and Rese 11492 4752 315 712 CABLEONE, US 7155 4030 264 32 VIASAT-SP-BACKBONE, US 22773 3935 3005 249 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 6489 6345 UNI2-AS, ES 9808 6346 6291 CMNET-GD Guangdong Mobile Communication Co.Ltd. 7545 5732 5063 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4754 4680 ERX-CERNET-BKB China Education and Research Net 47331 7796 4298 TTNET, TR 11492 4752 4040 CABLEONE, US 7155 4030 3998 VIASAT-SP-BACKBONE, US 22773 3935 3686 ASN-CXA-ALL-CCI-22773-RDC, US 7713 3523 3467 TELKOMNET-AS-AP PT Telekomunikasi Indonesia, ID 7552 3482 3462 VIETEL-AS-AP Viettel Group, VN Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 18604 UNALLOCATED 8.25.204.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 46766 UNALLOCATED 8.44.208.0/24 3356 LEVEL3, US 40544 UNALLOCATED 12.0.33.0/24 6461 ZAYO-6461, US 46505 UNALLOCATED 12.7.131.0/24 7018 ATT-INTERNET4, US 15132 UNALLOCATED 12.9.150.0/24 1239 SPRINTLINK, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.141.0.0/24 Origin: 395350 UNASSIGNED Transit: 11426 TWC-11426-CAROLINAS, US 23.142.80.0/24 Origin: 398481 REDMERCURY, US Transit: 209319 IPV6ROUTING, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:41 /11:103 /12:297 /13:586 /14:1193 /15:1947 /16:13532 /17:8334 /18:13883 /19:25773 /20:42564 /21:51465 /22:106771 /23:91238 /24:498129 /25:1408 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 47331 6976 7796 TTNET, TR 12479 5442 6489 UNI2-AS, ES 11492 3803 4752 CABLEONE, US 6327 3168 3360 SHAW, CA 7155 3118 4030 VIASAT-SP-BACKBONE, US 8151 3084 8518 Uninet S.A. de C.V., MX 22773 2964 3935 ASN-CXA-ALL-CCI-22773-RDC, US 8551 2815 3351 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 39891 2801 3266 ALJAWWALSTC-AS, SA 30036 2234 2559 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1882 2:1107 3:111 4:19 5:3527 6:65 7:5 8:1502 9:1 11:36 12:1748 13:362 14:2303 15:76 16:15 17:320 18:93 20:128 22:188 23:4654 24:2386 25:2 27:2524 29:19 31:2326 32:113 34:2 35:40 36:1318 37:3762 38:2068 39:610 40:160 41:3863 42:926 43:2118 44:239 45:14968 46:3704 47:319 49:1615 50:1773 51:92 52:1236 54:223 55:755 56:8 57:58 58:1716 59:1206 60:889 61:2365 62:2224 63:1959 64:5286 65:2382 66:5159 67:2860 68:1154 69:4075 70:1399 71:690 72:3182 74:2587 75:1486 76:685 77:2031 78:3697 79:2490 80:1867 81:1651 82:1361 83:1122 84:1271 85:3381 86:708 87:1781 88:2698 89:3009 90:443 91:7316 92:1750 93:2539 94:3111 95:4438 96:1268 97:345 98:990 99:969 100:92 101:1052 102:1409 103:25991 104:3739 105:435 106:725 107:2256 108:707 109:4026 110:2007 111:2940 112:1970 113:1622 114:1468 115:1891 116:1901 117:2313 118:2331 119:1900 120:1103 121:1079 122:2266 123:2209 124:1571 125:2082 128:1365 129:965 130:848 131:2036 132:753 133:356 134:1595 135:290 136:746 137:923 138:2296 139:1175 140:735 141:1190 142:1154 143:1265 144:1261 145:331 146:1412 147:1308 148:2213 149:1411 150:806 151:1079 152:1548 153:394 154:2387 155:1318 156:1495 157:1178 158:916 159:2041 160:2117 161:1142 162:3291 163:983 164:1504 165:1389 166:594 167:1772 168:3567 169:681 170:4172 171:765 172:2140 173:2946 174:988 175:1084 176:3115 177:4335 178:2899 179:1969 180:2321 181:2591 182:3207 183:1857 184:2426 185:18182 186:4203 187:3188 188:3299 189:2847 190:8848 191:1370 192:10670 193:8021 194:6592 195:4724 196:2881 197:2380 198:6057 199:6026 200:7410 201:5334 202:10571 203:10089 204:4657 205:3335 206:3557 207:3348 208:4018 209:4662 210:4236 211:2190 212:3678 213:3339 214:1229 215:61 216:6185 217:2539 218:1161 219:709 220:2089 221:977 222:965 223:1863 End of report

1 0

How BGP routes can get 'stuck' in the Default-Free Zone
by Job Snijders 21 Apr '21

21 Apr '21

Dear group, I'd like to draw your attention to an excellent article on an intricate interaction between BGP and TCP which can result in 'zombie routes' in the BGP Default-Free Zone. https://blog.benjojo.co.uk/post/bgp-stuck-routes-tcp-zero-window My current running theory on the root cause of some mishaps in the global routing system is that certain BGP implementations can end up in a broken state where such systems will still generate and send out KEEPALIVE messages, but are unable to process other BGP messages (and such a system instructs all its peers to not send new data by signalling a zero TCP receive window). This is "Problem #1". "Problem #2" is that almost all BGP implementations are unable to robustly deal with systems suffering from Problem #1. Allmost all BGP implementations assume that when KEEPALIVE messages don't make it across the wire, the remote system will initiate the session tear down. But of course, if the remote system is in such a broken state that it can't issue session tear downs ... the combined system state is perpetually broken. The Security Section of https://datatracker.ietf.org/doc/html/draft-spaghetti-idr-bgp-sendholdtimer elaborates on three detrimental facets of the above situation. It is quite rare for systems to end up in the "Problem #1" state, but when it happens, all systems connected to the broken node probably are better off disconnecting from such a system than perpetually forwarding (and potentially blackholing) Internet traffic into the broken system. Kind regards, Job

1 0

Weekly Routing Table Report
by cscora＠apnic.net 16 Apr '21

16 Apr '21

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 17 Apr, 2021 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 856506 Prefixes after maximum aggregation (per Origin AS): 324269 Deaggregation factor: 2.64 Unique aggregates announced (without unneeded subnets): 406158 Total ASes present in the Internet Routing Table: 71094 Prefixes per ASN: 12.05 Origin-only ASes present in the Internet Routing Table: 61156 Origin ASes announcing only one prefix: 25289 Transit ASes present in the Internet Routing Table: 9938 Transit-only ASes present in the Internet Routing Table: 311 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 38 Max AS path prepend of ASN ( 37385) 33 Prefixes from unregistered ASNs in the Routing Table: 1009 Number of instances of unregistered ASNs: 1016 Number of 32-bit ASNs allocated by the RIRs: 35730 Number of 32-bit ASNs visible in the Routing Table: 29751 Prefixes from 32-bit ASNs in the Routing Table: 138298 Number of bogon 32-bit ASNs visible in the Routing Table: 22 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 522 Number of addresses announced to Internet: 2948654208 Equivalent to 175 /8s, 192 /16s and 228 /24s Percentage of available address space announced: 79.6 Percentage of allocated address space announced: 79.6 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 290756 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 226747 Total APNIC prefixes after maximum aggregation: 65533 APNIC Deaggregation factor: 3.46 Prefixes being announced from the APNIC address blocks: 222874 Unique aggregates announced from the APNIC address blocks: 89504 APNIC Region origin ASes present in the Internet Routing Table: 11485 APNIC Prefixes per ASN: 19.41 APNIC Region origin ASes announcing only one prefix: 3285 APNIC Region transit ASes present in the Internet Routing Table: 1637 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 30 Number of APNIC region 32-bit ASNs visible in the Routing Table: 6646 Number of APNIC addresses announced to Internet: 771967232 Equivalent to 46 /8s, 3 /16s and 73 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-143673 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 245811 Total ARIN prefixes after maximum aggregation: 112965 ARIN Deaggregation factor: 2.18 Prefixes being announced from the ARIN address blocks: 246236 Unique aggregates announced from the ARIN address blocks: 117767 ARIN Region origin ASes present in the Internet Routing Table: 18794 ARIN Prefixes per ASN: 13.10 ARIN Region origin ASes announcing only one prefix: 6828 ARIN Region transit ASes present in the Internet Routing Table: 1937 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 30 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3828 Number of ARIN addresses announced to Internet: 1181045760 Equivalent to 70 /8s, 101 /16s and 84 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 244219 Total RIPE prefixes after maximum aggregation: 113807 RIPE Deaggregation factor: 2.15 Prefixes being announced from the RIPE address blocks: 240165 Unique aggregates announced from the RIPE address blocks: 141357 RIPE Region origin ASes present in the Internet Routing Table: 27886 RIPE Prefixes per ASN: 8.61 RIPE Region origin ASes announcing only one prefix: 11977 RIPE Region transit ASes present in the Internet Routing Table: 3881 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 38 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10121 Number of RIPE addresses announced to Internet: 711148416 Equivalent to 42 /8s, 99 /16s and 67 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 112880 Total LACNIC prefixes after maximum aggregation: 26286 LACNIC Deaggregation factor: 4.29 Prefixes being announced from the LACNIC address blocks: 114025 Unique aggregates announced from the LACNIC address blocks: 47055 LACNIC Region origin ASes present in the Internet Routing Table: 10744 LACNIC Prefixes per ASN: 10.61 LACNIC Region origin ASes announcing only one prefix: 2705 LACNIC Region transit ASes present in the Internet Routing Table: 2026 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 33 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8358 Number of LACNIC addresses announced to Internet: 176329728 Equivalent to 10 /8s, 130 /16s and 148 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-272796 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 25839 Total AfriNIC prefixes after maximum aggregation: 4925 AfriNIC Deaggregation factor: 5.25 Prefixes being announced from the AfriNIC address blocks: 32684 Unique aggregates announced from the AfriNIC address blocks: 10000 AfriNIC Region origin ASes present in the Internet Routing Table: 1453 AfriNIC Prefixes per ASN: 22.49 AfriNIC Region origin ASes announcing only one prefix: 494 AfriNIC Region transit ASes present in the Internet Routing Table: 292 Average AfriNIC Region AS path length visible: 5.2 Max AfriNIC Region AS path length visible: 38 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 798 Number of AfriNIC addresses announced to Internet: 107735808 Equivalent to 6 /8s, 107 /16s and 235 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 6292 8996 55 CMNET-GD Guangdong Mobile Communication 7545 5732 783 674 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4740 4192 74 ERX-CERNET-BKB China Education and Rese 7713 3524 1022 55 TELKOMNET-AS-AP PT Telekomunikasi Indon 7552 3477 1330 21 VIETEL-AS-AP Viettel Group, VN 45899 2899 1896 54 VNPT-AS-VN VNPT Corp, VN 4766 2433 11104 565 KIXS-AS-KR Korea Telecom, KR 9498 2328 473 234 BBIL-AP BHARTI Airtel Ltd., IN 4755 2116 441 190 TATACOMM-AS TATA Communications formerl 45090 2099 1197 72 CNNIC-TENCENT-NET-AP Shenzhen Tencent C Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 4983 9329 2237 AMAZON-02, US 11492 4747 315 716 CABLEONE, US 7155 4030 264 32 VIASAT-SP-BACKBONE, US 22773 3918 3005 247 ASN-CXA-ALL-CCI-22773-RDC, US 16625 3389 1758 2415 AKAMAI-AS, US 6327 3359 1317 70 SHAW, CA 30036 2562 374 93 MEDIACOM-ENTERPRISE-BUSINESS, US 209 2528 5053 486 CENTURYLINK-US-LEGACY-QWEST, US 5650 2343 2996 1636 FRONTIER-FRTR, US 5972 2224 450 782 DNIC-ASBLK-05800-06055, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 47331 7790 1044 3499 TTNET, TR 12479 6436 1724 143 UNI2-AS, ES 20940 3573 3347 204 AKAMAI-ASN1, NL 39891 3266 187 22 ALJAWWALSTC-AS, SA 8551 3248 379 41 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2905 2284 899 ROSTELECOM-AS, RU 9009 2390 246 1288 M247, GB 34984 2215 357 587 TELLCOM-AS, TR 13188 1610 100 31 TRIOLAN, UA 58224 1577 883 575 TCI, IR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8499 3473 572 Uninet S.A. de C.V., MX 10620 3409 526 607 Telmex Colombia S.A., CO 11830 2493 369 62 Instituto Costarricense de Electricidad 7303 1897 2063 73 Telecom Argentina S.A., AR 13999 1663 447 430 Mega Cable, S.A. de C.V., MX 6503 1443 311 475 Axtel, S.A.B. de C.V., MX 28573 1390 2274 223 CLARO S.A., BR 3816 1224 640 150 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1128 377 39 Telefonica del Peru S.A.A., PE 11664 1003 212 401 Techtel LMDS Comunicaciones Interactiva Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1585 393 22 LINKdotNET-AS, EG 24835 1443 486 27 RAYA-AS, EG 36992 1200 1537 176 ETISALAT-MISR, EG 36903 1188 529 109 MT-MPLS, MA 29571 728 68 11 ORANGE-COTE-IVOIRE, CI 6713 548 1863 34 IAM-AS, MA 36935 514 522 40 Vodafone-, EG 37342 487 32 1 MOVITEL, MZ 15399 476 47 17 WANANCHI-, KE 23889 439 232 16 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8499 3473 572 Uninet S.A. de C.V., MX 47331 7790 1044 3499 TTNET, TR 12479 6436 1724 143 UNI2-AS, ES 9808 6292 8996 55 CMNET-GD Guangdong Mobile Communication 7545 5732 783 674 TPG-INTERNET-AP TPG Telecom Limited, AU 16509 4983 9329 2237 AMAZON-02, US 11492 4747 315 716 CABLEONE, US 4538 4740 4192 74 ERX-CERNET-BKB China Education and Rese 7155 4030 264 32 VIASAT-SP-BACKBONE, US 22773 3918 3005 247 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 6436 6293 UNI2-AS, ES 9808 6292 6237 CMNET-GD Guangdong Mobile Communication Co.Ltd. 7545 5732 5058 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4740 4666 ERX-CERNET-BKB China Education and Research Net 47331 7790 4291 TTNET, TR 11492 4747 4031 CABLEONE, US 7155 4030 3998 VIASAT-SP-BACKBONE, US 22773 3918 3671 ASN-CXA-ALL-CCI-22773-RDC, US 7713 3524 3469 TELKOMNET-AS-AP PT Telekomunikasi Indonesia, ID 7552 3477 3456 VIETEL-AS-AP Viettel Group, VN Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 211471 UNALLOCATED 5.59.76.0/24 33932 EVERYWAN-AS everyWAN, ES 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 18604 UNALLOCATED 8.25.204.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 46766 UNALLOCATED 8.44.208.0/24 3356 LEVEL3, US 40544 UNALLOCATED 12.0.33.0/24 6461 ZAYO-6461, US 46505 UNALLOCATED 12.7.131.0/24 7018 ATT-INTERNET4, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.141.0.0/24 Origin: 395350 UNASSIGNED Transit: 11426 TWC-11426-CAROLINAS, US 23.142.80.0/24 Origin: 397881 STINGERS, US Transit: 398481 REDMERCURY, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:12 /9:12 /10:40 /11:102 /12:296 /13:585 /14:1192 /15:1950 /16:13550 /17:8359 /18:13875 /19:25829 /20:42484 /21:51436 /22:106580 /23:91139 /24:497665 /25:1400 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 47331 6970 7790 TTNET, TR 12479 5388 6436 UNI2-AS, ES 11492 3801 4747 CABLEONE, US 6327 3166 3359 SHAW, CA 7155 3118 4030 VIASAT-SP-BACKBONE, US 8151 3068 8499 Uninet S.A. de C.V., MX 22773 2951 3918 ASN-CXA-ALL-CCI-22773-RDC, US 39891 2801 3266 ALJAWWALSTC-AS, SA 8551 2712 3248 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 30036 2238 2562 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1878 2:1106 3:110 4:19 5:3557 6:64 7:5 8:1511 9:1 11:36 12:1749 13:359 14:2301 15:74 16:15 17:320 18:93 20:128 22:188 23:4648 24:2396 25:2 27:2505 29:19 31:2326 32:113 34:2 35:40 36:1309 37:3763 38:2067 39:610 40:161 41:3849 42:925 43:2126 44:238 45:14914 46:3664 47:319 49:1597 50:1766 51:92 52:1217 54:220 55:758 56:8 57:57 58:1726 59:1200 60:888 61:2396 62:2217 63:1960 64:5300 65:2385 66:5153 67:2871 68:1151 69:4058 70:1398 71:689 72:3181 74:2591 75:1483 76:686 77:2031 78:3696 79:2423 80:1865 81:1652 82:1345 83:1121 84:1264 85:3354 86:705 87:1774 88:2705 89:3014 90:433 91:7324 92:1744 93:2539 94:3101 95:4433 96:1259 97:345 98:986 99:969 100:90 101:1048 102:1368 103:25945 104:3716 105:435 106:730 107:2245 108:710 109:3986 110:2000 111:2942 112:1968 113:1622 114:1460 115:1886 116:1899 117:2303 118:2344 119:1898 120:1105 121:1079 122:2266 123:2217 124:1573 125:2088 128:1367 129:956 130:838 131:2043 132:756 133:355 134:1614 135:295 136:749 137:925 138:2304 139:1182 140:737 141:1189 142:1152 143:1254 144:1257 145:330 146:1395 147:1300 148:2212 149:1416 150:807 151:1079 152:1551 153:394 154:2342 155:1320 156:1487 157:1169 158:919 159:2042 160:2102 161:1125 162:3289 163:976 164:1501 165:1344 166:596 167:1778 168:3576 169:669 170:4254 171:764 172:2129 173:2939 174:986 175:1091 176:3114 177:4366 178:2896 179:1939 180:2317 181:2584 182:3220 183:1836 184:2415 185:18153 186:4214 187:3215 188:3299 189:2850 190:8887 191:1431 192:10665 193:7995 194:6583 195:4727 196:2883 197:2370 198:6049 199:6020 200:7392 201:5356 202:10601 203:10077 204:4647 205:3348 206:3541 207:3366 208:4009 209:4654 210:4252 211:2197 212:3695 213:3343 214:1225 215:61 216:6174 217:2530 218:1159 219:708 220:2081 221:973 222:971 223:1859 End of report

1 0

Issue affecting rsync RPKI repository fetching
by Nathalie Trenaman 15 Apr '21

15 Apr '21

Dear colleagues, We have been made aware of an issue that may affect some users who use RPKI relying party (RP) software that uses rsync. Please note that by default, only rpki-client reads from rsync; the rest of the RPs prefer the RPKI Repository Delta Protocol (RRDP). The issue appears to create some inconsistency between the RPKI repository and rsync clients. In more detail, an RRDP client reads a complete state for a specific “serial” from the repository. In contrast, an rsync client syncs the state in multiple steps. First, a list of files is copied, followed by updates for files that have been copied. In an affected scenario, a certificate is added and one of the other files (the manifest) is modified after the file list has been sent. By reading the new manifest, but not copying the new file (it is not on the rsync file list), the repository copied by the rsync client contains an invalid manifest (a file is missing) and the RP software rejects it. We are planning on changing our publication infrastructure and using the same "revisions" RRDP uses for the content of the rsync repository. Rsync is an officially supported distribution protocol for RPKI repository data, and it is one of our highest priorities that the data published is atomic and consistent. We plan to release the new publication infrastructure in Q2/Q3 2021. Part of this work will mitigate these non-repeatable-reads for clients using rsync. We will update you on our progress during RIPE 82, taking place online from 17-21 May 2021. Kind regards, Nathalie Trenaman RIPE NCC

8 14

New on RIPE Labs: Does The Internet Route Around Damage? - Edition 2021
by Alun Davies 14 Apr '21

14 Apr '21

Dear colleagues, In this new article on RIPE Labs, to investigate whether the Internet routes around damage in 2021, Emile Aben carries out an analysis of the impact of the recent LINX London outage. The full article is available now on the new and improved RIPE Labs: https://labs.ripe.net/author/emileaben/does-the-internet-route-around-damag… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

RPKI: how to migrate an entire industry from RSYNC to RRDP?
by Job Snijders 13 Apr '21

13 Apr '21

Hi all, Some might be wondering what the deal is with RSYNC and RRDP? Why it is critical to continue to support RSYNC in the mid-term? What's the industry's plan to migrate from RSYNC to RRDP? TL;DR - All RIRs need to support both RSYNC and RRDP until at least 2024. - All RRDP-capable validators need to make sure they are fully backwards compatible with RSYNC, until RIRs no longer observe RSYNC traffic. Some background: ---------------- The development of the RPKI technology stack began more than a decade ago in the IETF. From the start, RSYNC was the preferred synchronisation protocol between RPKI publication servers (such as 'rpki.ripe.net') and Relying Parties (the likes of Telia, NTT, Amazon, me, and you). RSYNC was picked for a number of reasons: it was available & easy. A core concept of the RPKI technology stack is that RPKI objects can be transported via any means: carrier pigeon (RFC 2549 ;-), USB stick, FTP, RSYNC, ... anything! This is possible because RPKI exclusively relies on 'object security', the RPKI objects themselves contain all information that is required to perform X.509-based validation. As time went by, a second approach was developed to synchronize RPs to fresh data generated by CAs. It was recognized that where RSYNC servers need to calculate the 'difference' between the client has and what the server has (right after the RSYNC client connects), such data could also be generated a-priori and stored in static files. Pre-generating such a 'journal' of all changes in a repository is considered to be far efficient than calculating it on the fly. The RRDP protocol has many appealing properties! In 2017 the RRDP protocol was published as IETF RFC as 'nice to have' synchronization protocol for the RPKI. Since then, more and more Publication Servers operators and RP software implementers worked to support the new RRDP protocol alongside the old RSYNC protocol. With two options available, how to migrate? ------------------------------------------- This Gordian Knot has two aspects: all deployed RPKI repository operators have to support RRDP, and all deployed Relying Party have to support RRDP. This means that for a succesful transition, for a moment in time, all stakeholders have to support both RSYNC and RRDP. The industry has not yet reached that point. I expect this to happen somewhere in 2023. At this moment of writing, not all Relying Party software, and not all RPKI Repository Operators support RRDP. Based on various communications in the IETF it is clear everyone is working towards implementing RRDP support. However producing a safe implementation of RRDP is not a trivial task, it takes time. As RSYNC existed first and RRDP came later, everyone should be allowed ample time to make the transition. While everyone waits for everyone to deploy RRDP capable software, the trick is to PREFER synchronizing via RRDP (and if it fails try RSYNC). Relevant Internet-Draft: https://datatracker.ietf.org/doc/draft-ietf-sidrops-prefer-rrdp/ The concept this is somewhat analogous to 'Happy Eyeballs': for a period of time many considered it advantageous for global IPv6 deployment to give IPv6 just a little bit of a head start compared to IPv4. People knew that purposefully degrading IPv4 would not motivate people to embrace IPv6. Also, preferring RRDP (and only using RSYNC in case of RRDP failure), makes life easier for RPKI Repository operators: it should be possible for them to temporarily disable the RRDP webserver and expect clients to use RSYNC instead. Knowing that clients will gracefully fall back to RSYNC lowers the barrier to deploy RRDP. Once all RP implementations have embraced the 'prefer RRDP' strategy, and those implemenations have trickled down into the hands of network operators and deployed in the field, Repository Operators will observe less and less clients connecting to the RSYNC service and more and more syncing via RRDP, to the point where it becomes self-evident publication via RSYNC can maybe even be decommissioned all together. TL;DR - general availability of software which prefers RRDP over RSYNC, combined with patience, should be sufficient of a plan to migrate! :) Current status -------------- Current versions of OpenBSD rpki-client supports RSYNC. The team is actively working to also support RRDP. The hope is to release a stable version later this year. OpenBSD supports releases for one year, thus any deprecation of RSYNC services should be post-poned at least until Spring 2023 to avoid disenfranchising existing deployments in the field. The RIPE NCC Validator RRDP implementation is broken. It is trivial for any RRDP Repository Operator to remotely crash the entire RIPE NCC validator process. Luckily the software is almost End-Of-Life and soon won't be relevant anymore. Current versions of Routinator are unable to fall back to RSYNC. However in November 2020, the team indicated they would fix this in the next release (which has yet to happen). Perhaps somewhat counterintuitive, an inability to fallback to RSYNC, makes migrating towards RRDP harder for the industry. For a peer-reviewed scientific publication on this phenomena see: https://dl.acm.org/doi/10.1145/3419394.3423622 I've not inspected how other validators behave, and we should keep in mind proprietary rsync-only validator implementations might exist this community is not aware of! How to move forward in the short term? -------------------------------------- RIPE NCC must support RSYNC as a first-class service. The RPKI via RSYNC is a LIVE production system. The global Internet routing system relies on the Trust Anchors to publish correctly. The suggestion it might take six months (from report to resolution) is too long of a waiting period for this type of issue. There are known negative interactions between inconsistent RPKI publications & BGP routing in the Default-Free Zone. This affects all Internet users. It is not possible to get hundreds of operators to migrate to RRDP overnight, but it is possible for RIPE NCC to improve RSYNC publication (while the world very slowly moves to RRDP). Kind regards, Job

2 1

RPKI Route Origin Validation on RIPE NCC Network
by Nathalie Trenaman 13 Apr '21

13 Apr '21

Dear colleagues, (My colleagues are drafting a reply on the rsync issue) Following up on my previous email and the discussion we had in this mailing last about enabling Route Origin Validation (ROV) invalid == reject on the RIPE NCC’s network, AS3333, I am happy to inform you that we will be going ahead on Monday, 19 April. I have written a RIPE Labs article with more information, which you can find at: https://labs.ripe.net/author/nathalie_nathalie/rpki-and-as3333-or-how-we-ea… Thank you very much for your contributions, discussion and support. Kind Regards, Nathalie Trenaman Routing Security Programme Manager RIPE NCC

1 0