bgp

Bilingual

Economist submission: How the Internet Leaks - Bert Hubert's writings
2 months ago
- Route leaks occur when networks incorrectly announce routes for addresses they don't own, causing internet outages.
- The Border Gateway Protocol (BGP) is based on trust and lacks built-in security, making it vulnerable to mistakes and hijacks.
- Filtering and public route databases can prevent incidents, but adoption is voluntary and inconsistent.
- RPKI Origin Validation offers cryptographic protection with low risk of downtime, and its adoption is increasing.
BGP ORIGIN attribute manipulation and its impact on the Internet
2 months ago
- BGP's ORIGIN attribute indicates how a route was injected, with values IGP (interior), EGP (obsolete), and INCOMPLETE (unknown).
- RFC 4271 states ORIGIN should not be modified, but ~70% of observed paths have altered ORIGIN values, often changed to IGP by transit providers to attract traffic.
- Experiments using BGP Anycast announcements showed nearly 10% of direct peers rewrite ORIGIN to IGP, with Tier-1 ASes disproportionately involved.
- ORIGIN manipulation impacts path selection, redirecting traffic and generating revenue for rewriters, undermining fairness.
- Deprecation of ORIGIN is proposed, with a starting point of setting all routes to IGP by default.
Who's running all those tiny RPKI servers?
3 months ago
- BGP lacks trust, making it vulnerable to prefix hijacks.
- RPKI uses cryptographic ROAs to authorize ASes for prefixes, improving security.
- Small, independent RPKI publication servers exist alongside RIR servers, with diverse operators.
- RPKI prevents BGP hijacks by validating route origins with signed records.
- Small servers are defined as having fewer than 1,300 ROAs.
- Reasons for operating independent servers include RPKIaaS, cross-RIR simplicity, research, control, and learning.
- Dataset analysis shows modest IP space coverage but includes critical services like government domains.
- Most ROAs (91%) are valid, but 7.6% are unknown, and maxLength usage poses risks.
- Many ROAs use maxLength, risking sub-prefix hijacks if not covered by BGP announcements.
- BGPsec is not deployed, limiting additional security.
- Operators cite cross-RIR simplicity and education as motivations for running servers.
- Small server failures could affect specific prefixes and Internet verifiability.
My ASN Journey series (2024)
3 months ago
- The author shares their ASN journey and questions why ordinary people cannot buy IP addresses like domain names, as most IPs are owned by large businesses and governments.
- They created tutorials on acquiring an ASN, setting it up, configuring BGP on a VPS, and other related topics to address the lack of comprehensive guides.
- Advantages of owning an IP address include gaining IPv6 connectivity, avoiding CGNAT issues, having a clean IP for tasks like editing Wikipedia, and reducing CAPTCHAs.
- Limitations involve self-doxxing due to no privacy in ASN registration, potential BGP misconfiguration risks, and contributing to Internet routing table growth.
- Costs include a one-time ASN fee, annual RIPE charges, and VPS expenses, with optional fees for services like FogIXP or ONIX.
- FAQs cover topics such as needing an ASN for BYOIP, IPv4 availability being costly, differences between IP transit and peering, and accessing IPv6-only VPS via Cloudflare WARP.
- Useful resources are provided, including Discord servers, guides, and training materials for networking and ASN setup.

Economist submission: How the Internet Leaks - Bert Hubert's writings

BGP ORIGIN attribute manipulation and its impact on the Internet

Who's running all those tiny RPKI servers?

My ASN Journey series (2024)