Re: using IRR tools for BGP route filtering

[Jessica Yu <jyy_99 () yahoo com>]

If every ISP does prefix based filtering on its
downstream customers, the integrity of the Internet
routing system will be improved a lot. The document
below proposes such a model:

http://www.iops.org/Documents/routing.html

                           --Jessica
--- Danny McPherson <danny () tcb net> wrote:
> > i emphatically DO NOT think that large providers
> should filter other
> > peers. i think the large providers should filter
> their own announcements,
> > by carefully verifying what a downstream wishes to
> announce before
> > accepting it, filtering the customer
> announcements, and aggregating their
> > announcements to peers. 
>
> I believe Randy's point is that it'd be really nice
> to filter prefixes 
> learned from peers, but even if the routing
> databases were up to date, 
> reliable and useful, the routers can't perform the
> policy matches against
> filters fast enough.  
>
> And I agree completely.  The fact that pretty much
> any network with an
> AS number could take any Internet subnet completely
> offline in a matter 
> of -- what, ~8 minutes(?), intentionally or
> unintentionally, well, 
> I think it's pretty amazing.  The only way a service
> provider can protect
> their customers from this is by applying
> prefix-based filtering to all
> their peers.
>
>
> Of course, this requires valid, accessible, up to
> date IP registration
> information.  It also routers that can store
> hundreds of thousands of 
> lines of policies.  Then, the routers have to be
> able to perform matches
> on the policies when processing updates.  All this
> is at the "control
> plane".
>
> Then, ideally, the routers would be able to utilize
> the same set of 
> policies to perform packet filtering functions in
> the "data plane",
> which is even more interesting.
>
> These two components alone would make the overall
> Internet 
> infrastructure far more reliable and secure than it
> is today,
> no doubt.
>
> > i think its silly to try and regulate the world
> from ones own corner. 
> > regulate your corner, and encourage others to do
> the same. i don't care if
> > said encouragement is by tacit agreememnt, or
> bound up in legealese in
> > peering agreements.
>
> I don't think it's silly at all to regulate the
> policies one employs in
> in their network in order to increase overall
> destination availability 
> to ones customers.  Policies of this nature only
> require support of the
> network that implements them.  Other than requiring
> peers to keep registry 
> information up to date, they impact the peer
> networks no way whatsoever.
>
> -danny


__________________________________________________
Do You Yahoo!?
Send instant messages with Yahoo! Messenger.
http://im.yahoo.com/