From mailman-bounces@core3.amsl.com Fri Feb 1 05:01:58 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AE8B428DCD8 for ; Fri, 1 Feb 2008 05:01:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.582 X-Spam-Level: X-Spam-Status: No, score=-2.582 tagged_above=-999 required=5 tests=[AWL=0.017, BAYES_00=-2.599] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id je-l1o8QUuT8 for ; Fri, 1 Feb 2008 05:01:58 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4158128C820 for ; Fri, 1 Feb 2008 05:00:21 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: ietf.org mailing list memberships reminder From: mailman-owner@ietf.org To: opsec-archive@optimus.ietf.org X-No-Archive: yes Message-ID: Date: Fri, 01 Feb 2008 05:00:13 -0800 Precedence: bulk X-BeenThere: mailman@core3.amsl.com X-Mailman-Version: 2.1.9 List-Id: X-List-Administrivia: yes Sender: mailman-bounces@core3.amsl.com Errors-To: mailman-bounces@core3.amsl.com This is a reminder, sent out once a month, about your ietf.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. You can visit the URLs to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. In addition to the URL interfaces, you can also use email to make such changes. For more info, send a message to the '-request' address of the list (for example, mailman-request@ietf.org) containing just the word 'help' in the message body, and an email message will be sent to you with instructions. If you have questions, problems, comments, etc, send them to mailman-owner@ietf.org. Thanks! http://www.ietf.org/mailman/options/opsec/opsec-archive%40optimus.ietf.org From mailman-bounces@core3.amsl.com Fri Feb 1 05:02:07 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 55C3128DECD for ; Fri, 1 Feb 2008 05:02:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.582 X-Spam-Level: X-Spam-Status: No, score=-2.582 tagged_above=-999 required=5 tests=[AWL=0.017, BAYES_00=-2.599] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id POvAOj-10ZDg for ; Fri, 1 Feb 2008 05:02:07 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 53CE928C873 for ; Fri, 1 Feb 2008 05:00:22 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: ietf.org mailing list memberships reminder From: mailman-owner@ietf.org To: opsec-archive@optimus.ietf.org X-No-Archive: yes Message-ID: Date: Fri, 01 Feb 2008 05:00:14 -0800 Precedence: bulk X-BeenThere: mailman@core3.amsl.com X-Mailman-Version: 2.1.9 List-Id: X-List-Administrivia: yes Sender: mailman-bounces@core3.amsl.com Errors-To: mailman-bounces@core3.amsl.com This is a reminder, sent out once a month, about your ietf.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. You can visit the URLs to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. In addition to the URL interfaces, you can also use email to make such changes. For more info, send a message to the '-request' address of the list (for example, mailman-request@ietf.org) containing just the word 'help' in the message body, and an email message will be sent to you with instructions. If you have questions, problems, comments, etc, send them to mailman-owner@ietf.org. Thanks! http://www.ietf.org/mailman/options/opsec/opsec-archive%40optimus.ietf.org From opsec-bounces@ietf.org Fri Feb 1 08:11:34 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 719F628C224; Fri, 1 Feb 2008 08:11:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.166 X-Spam-Level: X-Spam-Status: No, score=-2.166 tagged_above=-999 required=5 tests=[AWL=0.433, BAYES_00=-2.599] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ApF6yVyDH62M; Fri, 1 Feb 2008 08:11:32 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B44DD28C1EE; Fri, 1 Feb 2008 08:08:56 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 73AB728C1C9 for ; Fri, 1 Feb 2008 08:08:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7dxhQgH4HPsx for ; Fri, 1 Feb 2008 08:08:51 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id B006B28C26A for ; Fri, 1 Feb 2008 08:07:45 -0800 (PST) Received: from [10.250.4.65] (63-138-16-2.customer.static.ip.paetec.net [63.138.16.2] (may be forged)) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m11G848O007778 for ; Fri, 1 Feb 2008 16:08:05 GMT (envelope-from joelja@bogus.com) Message-ID: <47A343D0.3090108@bogus.com> Date: Fri, 01 Feb 2008 08:07:44 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> <200802010427.m114R79n013321@venus.xmundo.net> In-Reply-To: <200802010427.m114R79n013321@venus.xmundo.net> X-Enigmail-Version: 0.95.5 X-Virus-Scanned: ClamAV 0.91.1/5640/Fri Feb 1 15:35:19 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Fernando Gont wrote: > At 02:01 a.m. 31/01/2008, you wrote: > >> I would say that a router that strictly codes to RFC 1812 is a router >> which can be attacked and used to attack others. As Don mentioned, >> routers today need a lot more capabilities and reset of expectations. >> >> Consideration - a total relook at RFC 1812 - updating it so that all >> routers behave the same way - in a way that it is safe from attack >> and cannot be used to attack others. > > The same thing applies to most RFCs, including RFC 1122 (host > requirements), the core TCP and IP specifications, and so on. What's > really bad is is that people seem to feel happy about it. > > I doubt whether we would ever be able to get consensus to rewrite RFC > 1122 or RFC 1812. The older the RFC, the more controversial it turns out to be. Which is why I think bcp is the proper place to address this for now: A. operational experience suggests deviation from original requirements is wise. B. making alterations to the base documents supporting ipv4 at this late date seems like a non-starter. The time to be hacking alterations into ipv4 has long since passed. > Think about any of the most well known network attacks we have faced > in the past (Smurf, SYN-flood, netkill, or whatever), and try to find > a reference to them in any IETF RFC. Only since a couple of years ago > we have had IDs or RFCs on a few of these issues (ICMP attacks, > TCP-based attacks, SYN-floods)... but most of these efforts ended up > in Informational RFCs (rather than Standards track)... > > Kind regards, > > -- > Fernando Gont > e-mail: fernando@gont.com.ar || fgont@acm.org > PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 > > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > http://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 1 10:12:41 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6C62E3A697D; Fri, 1 Feb 2008 10:12:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.455 X-Spam-Level: X-Spam-Status: No, score=-2.455 tagged_above=-999 required=5 tests=[AWL=0.144, BAYES_00=-2.599] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R34VCVvgoTdP; Fri, 1 Feb 2008 10:12:40 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9219E3A693A; Fri, 1 Feb 2008 10:12:40 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 64D423A6972 for ; Fri, 1 Feb 2008 10:12:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fKzZx-WKhesl for ; Fri, 1 Feb 2008 10:12:38 -0800 (PST) Received: from dog.tcb.net (dog.tcb.net [64.78.150.133]) by core3.amsl.com (Postfix) with ESMTP id 99C4D3A68A6 for ; Fri, 1 Feb 2008 10:12:38 -0800 (PST) Received: by dog.tcb.net (Postfix, from userid 0) id 671FA268081; Fri, 1 Feb 2008 11:14:13 -0700 (MST) Received: from [192.168.1.7] (VDSL-151-118-148-143.DNVR.QWEST.NET [151.118.148.143]) (authenticated-user smtp) (TLSv1/SSLv3 AES128-SHA 128/128) by dog.tcb.net with SMTP; for opsec@ietf.org; Fri, 01 Feb 2008 11:14:13 -0700 (MST) (envelope-from danny@tcb.net) X-Avenger: version=0.7.8; receiver=dog.tcb.net; client-ip=151.118.148.143; client-port=62615; syn-fingerprint=65535:56:1:64:M1316,N,W0,N,N,T,S; data-bytes=0 Mime-Version: 1.0 (Apple Message framework v753) In-Reply-To: <47A343D0.3090108@bogus.com> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> <200802010427.m114R79n013321@venus.xmundo.net> <47A343D0.3090108@bogus.com> Message-Id: From: Danny McPherson Date: Fri, 1 Feb 2008 11:13:53 -0700 To: opsec wg mailing list X-Mailer: Apple Mail (2.753) Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 1, 2008, at 9:07 AM, Joel Jaeggli wrote: > > Which is why I think bcp is the proper place to address this for now: > > A. operational experience suggests deviation from original > requirements > is wise. > > B. making alterations to the base documents supporting ipv4 at this > late > date seems like a non-starter. The time to be hacking alterations > into ipv4 has long since passed. On the other hand, one might posit that because we've gained more experience in certain areas, network and infrastructure security in particular, that it is definitely the time to make such recommendations and provide the appropriate guidelines to implementers. Given that any open communications system is only going to be as secure as it has to be in order to operate, and the amount of dust on the referenced documents, this would seem to be a natural step in the evolutionary process. -danny _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 1 11:26:45 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C4F4B3A697E; Fri, 1 Feb 2008 11:26:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.67 X-Spam-Level: X-Spam-Status: No, score=-1.67 tagged_above=-999 required=5 tests=[AWL=0.930, BAYES_00=-2.599] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IYT9ZBMMasRv; Fri, 1 Feb 2008 11:26:44 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C56B23A6912; Fri, 1 Feb 2008 11:26:44 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 782213A6912 for ; Fri, 1 Feb 2008 11:26:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bD2aRK1CEr9d for ; Fri, 1 Feb 2008 11:26:42 -0800 (PST) Received: from sudnp799.qwest.com (sudnp799.qwest.com [155.70.32.99]) by core3.amsl.com (Postfix) with ESMTP id 3BCFC3A6875 for ; Fri, 1 Feb 2008 11:26:42 -0800 (PST) Received: from suomp60i.qintra.com (suomp60i.qintra.com [151.117.69.27]) by sudnp799.qwest.com (8.14.0/8.14.0) with ESMTP id m11JSGsS008400 for ; Fri, 1 Feb 2008 12:28:16 -0700 (MST) Received: from ITDENE2KSM02.AD.QINTRA.COM (localhost [127.0.0.1]) by suomp60i.qintra.com (8.14.0/8.14.0) with ESMTP id m11JS93k028836 for ; Fri, 1 Feb 2008 13:28:11 -0600 (CST) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM02.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Fri, 1 Feb 2008 12:28:09 -0700 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Date: Fri, 1 Feb 2008 12:27:27 -0700 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) Importance: normal thread-index: Achk/kUwjKTSXlnbQL6ixwJxHgkJ/QACRdBK Priority: normal References: <47855CF6.9060104@bogus.com><4785FE75.6040502@mitre.org> <47862F 0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo. net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo .net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@ aharp.ittns.northwestern.edu> <200802010427.m114R79n013321@venus.xmundo.net><47A343D0.3090108@bogus.com> From: "Smith, Donald" To: "opsec wg mailing list" , "opsec wg mailing list" X-OriginalArrivalTime: 01 Feb 2008 19:28:09.0942 (UTC) FILETIME=[94216760:01C86508] Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: opsec wg mailing list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org One issue with leaving those RFC's unmodified is most customers require their vendors to implement those rfc's AS IS. Most customers don't know enough to tell their vendor which RFC to violate. So how do you address some of the tcp reset vulnerabilities that have been discovered in the last few years? By requiring your vendors to accept a reset within the window, or permitting icmp packets to terminate sessions? Those are part of the RFCs. Some of us got lucky because some vendors failed to implement some elements of those RFCs. Next issue how do you know what your vendor did to fix those issues? There was more then one way to "fix" those issues. donald.smith@qwest.com giac ________________________________ From: opsec-bounces@ietf.org on behalf of Danny McPherson Sent: Fri 2/1/2008 11:13 AM To: opsec wg mailing list Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) On Feb 1, 2008, at 9:07 AM, Joel Jaeggli wrote: > > Which is why I think bcp is the proper place to address this for now: > > A. operational experience suggests deviation from original > requirements > is wise. > > B. making alterations to the base documents supporting ipv4 at this > late > date seems like a non-starter. The time to be hacking alterations > into ipv4 has long since passed. On the other hand, one might posit that because we've gained more experience in certain areas, network and infrastructure security in particular, that it is definitely the time to make such recommendations and provide the appropriate guidelines to implementers. Given that any open communications system is only going to be as secure as it has to be in order to operate, and the amount of dust on the referenced documents, this would seem to be a natural step in the evolutionary process. -danny _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 1 12:40:05 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D82828C24B; Fri, 1 Feb 2008 12:40:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.188 X-Spam-Level: X-Spam-Status: No, score=-1.188 tagged_above=-999 required=5 tests=[AWL=0.603, BAYES_00=-2.599, SARE_RECV_SPEEDY_AR=0.808] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fw9IWNsL-nlJ; Fri, 1 Feb 2008 12:40:04 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 044853A68D6; Fri, 1 Feb 2008 12:40:04 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 47CF83A69B3 for ; Fri, 1 Feb 2008 12:40:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NnT2PMhvRcba for ; Fri, 1 Feb 2008 12:40:01 -0800 (PST) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id A6A273A69B2 for ; Fri, 1 Feb 2008 12:39:59 -0800 (PST) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id A2F365A8ABD; Fri, 1 Feb 2008 18:41:37 -0200 (ARDT) Received: from notebook.gont.com.ar (201-254-63-131.speedy.com.ar [201.254.63.131] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m11KfPj3017055; Fri, 1 Feb 2008 18:41:26 -0200 Message-Id: <200802012041.m11KfPj3017055@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Fri, 01 Feb 2008 18:39:43 -0200 To: opsec wg mailing list From: Fernando Gont In-Reply-To: <47A343D0.3090108@bogus.com> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> <200802010427.m114R79n013321@venus.xmundo.net> <47A343D0.3090108@bogus.com> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Fri, 01 Feb 2008 18:41:31 -0200 (ARDT) Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 02:07 p.m. 01/02/2008, Joel Jaeggli wrote: >Which is why I think bcp is the proper place to address this for now: > >A. operational experience suggests deviation from original requirements > is wise. I think the argument we could make for a BCP (rather than Standards track) is that the internet-draft/RFC would be aimed at firewalls, rather than routers. Thus, neither RFC 1122 nor RFC 1812 would need to be updated (wrt firewalls). >B. making alterations to the base documents supporting ipv4 at this late > date seems like a non-starter. The time to be hacking alterations > into ipv4 has long since passed. The IETF is supposed to do engineering. And that includes the maintenance of the protocols that currently run the Internet. I don't think that the possibility that at some point in time IPv6 may replace IPv4 should make us comfortable with the fact that many of the specs of the protocols that currently run the Internet are more than 20 years outdated. Talk with any implementer that has (or has had) to build a TCP/IP stack from scratch, or that at least wants to maintain an existing implementation so that it is not vulnerable to trivial (and in many cases even "known") attacks. The current situation is at least messy. They have to google for vulnerability advisories, look at other implementations' source code, google for relevant papers on the subject, etc. Much of the security of current TCP/IP stacks depends on "undocumented wisdom". An example of this is NISCC's VU# 532967 (ICMP attacks against TCP). The ICMP reset attacks were used at the very least in the mid/late 90's as IRC nukes. Nobody documented them. Nobody proposed counter-measures. Ten years later, we had BGP routers & VoIP systems vulnerable to these attacks. Then, when this issues was discussed in some mailing-lists, guess what many of the comments were: "Filter all ICMP!" (talk about breaking PMTUD, at least). I don't think our response to these issues should be "We will not work on this issues because at some point in the future IPv4 may get replaced with IPv6". That said, considering that updating some RFCs may *politically* be a non-starter, IMHO it is a good thing that at least we document these issues and possible work-arounds in some Informational or BCP RFCs. Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat Feb 2 18:07:10 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C41863A6B59; Sat, 2 Feb 2008 18:07:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lWaGWFzC1hzu; Sat, 2 Feb 2008 18:07:09 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF6F83A6B22; Sat, 2 Feb 2008 18:07:09 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 215D13A6B22 for ; Sat, 2 Feb 2008 18:07:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iRCjIL7aQtxx for ; Sat, 2 Feb 2008 18:07:06 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id C27D93A6A87 for ; Sat, 2 Feb 2008 18:07:05 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,296,1199644200"; d="scan'208";a="96736024" Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 03 Feb 2008 07:38:28 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m1328QIW029041 for ; Sun, 3 Feb 2008 10:08:26 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-43.cisco.com [10.75.233.43]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1328NaJ017685 for ; Sun, 3 Feb 2008 02:08:25 GMT Message-Id: <43607BBB-4709-4819-82B2-767B63B79E73@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <200802012041.m11KfPj3017055@venus.xmundo.net> Mime-Version: 1.0 (Apple Message framework v915) Date: Sun, 3 Feb 2008 09:08:21 +0700 References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> <200802010427.m114R79n013321@venus.xmundo.net> <47A343D0.3090108@bogus.com> <200802012041.m11KfPj3017055@venus.xmundo.net> X-Mailer: Apple Mail (2.915) Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 2, 2008, at 3:39 AM, Fernando Gont wrote: > is that the internet-draft/RFC would be aimed at firewalls, rather > than routers. Why the artificial (and meaningless, IMHO) distinction? The desired behavior ought to be exhibited by any device which filters packets, including routers, ought it not? ----------------------------------------------------------------------- Roland Dobbins // 408.527.6376 voice Culture eats strategy for breakfast. -- Ford Motor Company _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat Feb 2 22:18:43 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A41453A6BA6; Sat, 2 Feb 2008 22:18:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.937 X-Spam-Level: X-Spam-Status: No, score=-0.937 tagged_above=-999 required=5 tests=[AWL=0.854, BAYES_00=-2.599, SARE_RECV_SPEEDY_AR=0.808] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AXkY5mWpFPA7; Sat, 2 Feb 2008 22:18:42 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B484B3A6B92; Sat, 2 Feb 2008 22:18:42 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 986103A684D for ; Sat, 2 Feb 2008 22:18:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sicr-0uEODAH for ; Sat, 2 Feb 2008 22:18:40 -0800 (PST) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 44BEA3A6B61 for ; Sat, 2 Feb 2008 22:17:54 -0800 (PST) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 4F8D15A8AB9; Sun, 3 Feb 2008 04:19:35 -0200 (ARDT) Received: from notebook.gont.com.ar (168-226-217-194.speedy.com.ar [168.226.217.194] (may be forged)) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id m136JPE3015448; Sun, 3 Feb 2008 04:19:26 -0200 Message-Id: <200802030619.m136JPE3015448@venus.xmundo.net> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 03 Feb 2008 04:14:44 -0200 To: Roland Dobbins , opsec wg mailing list From: Fernando Gont In-Reply-To: <43607BBB-4709-4819-82B2-767B63B79E73@cisco.com> References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> <200802010427.m114R79n013321@venus.xmundo.net> <47A343D0.3090108@bogus.com> <200802012041.m11KfPj3017055@venus.xmundo.net> <43607BBB-4709-4819-82B2-767B63B79E73@cisco.com> Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Sun, 03 Feb 2008 04:19:34 -0200 (ARDT) Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 12:08 a.m. 03/02/2008, Roland Dobbins wrote: > > is that the internet-draft/RFC would be aimed at firewalls, rather > > than routers. > >Why the artificial (and meaningless, IMHO) distinction? It's "conceptual", not "artificial". A router is a device that *forwards* packets. Here we are talking about *filtering* packets. For that same reason, we have RFC 1122 for hosts *and* RFC 1812 for routers, even when in most cases a router (as a "device") will also behave as a host for some functions. >The desired >behavior ought to be exhibited by any device which filters packets, >including routers, ought it not? No. We are not changing ICMP or IP. We are simply providing advice on ICMP filtering. The specs are left unchanged. But, if you have a packet filtering device, you may follow the advice we'd be providing. P.S.: For some reason, big vendors seem to be opposed to changes in the specs of core protocols, particularly when they have to do with security issues. I don't really know if the issue is that they would have to provide these upgrades for free (as they are supposed to be security fixes) or what. So, in this respect, a positive side effect of this direction (BCP or Informational) is that this would be advice on what to filter if you decide to actually do it. Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun Feb 3 03:33:43 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 795203A6C3E; Sun, 3 Feb 2008 03:33:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9OAm4UapIIBZ; Sun, 3 Feb 2008 03:33:42 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF50A3A6C37; Sun, 3 Feb 2008 03:33:38 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4FC593A6C34 for ; Sun, 3 Feb 2008 03:33:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z70ure2hYLr6 for ; Sun, 3 Feb 2008 03:33:37 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id C758F3A6C3E for ; Sun, 3 Feb 2008 03:31:02 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,297,1199644200"; d="scan'208";a="96744678" Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 03 Feb 2008 17:02:36 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m13BWZQ3030757 for ; Sun, 3 Feb 2008 19:32:35 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-234-11.cisco.com [10.75.234.11]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m13BWPaJ007808 for ; Sun, 3 Feb 2008 11:32:31 GMT Message-Id: <17162E2E-9EB5-45CD-BFF0-414932F540F7@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <200802030619.m136JPE3015448@venus.xmundo.net> Mime-Version: 1.0 (Apple Message framework v915) Date: Sun, 3 Feb 2008 18:32:23 +0700 References: <47855CF6.9060104@bogus.com> <4785FE75.6040502@mitre.org> <47862F0E.9060407@juniper.net> <478654EE.2080403@mitre.org> <200801160800.m0G807Zc002605@venus.xmundo.net> <478E0F38.9080904@mitre.org> <200801161648.m0GGjaLN000739@venus.xmundo.net> <138EE2A1-572E-4A11-91DC-57941C331FDB@tcb.net> <20080130193038.85740136C82@aharp.ittns.northwestern.edu> <200802010427.m114R79n013321@venus.xmundo.net> <47A343D0.3090108@bogus.com> <200802012041.m11KfPj3017055@venus.xmundo.net> <43607BBB-4709-4819-82B2-767B63B79E73@cisco.com> <200802030619.m136JPE3015448@venus.xmundo.net> X-Mailer: Apple Mail (2.915) Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] ICMP filtering (was Re: charter skeleton rev5) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org > It's "conceptual", not "artificial". A router is a device that > *forwards* packets. Here we are talking about *filtering* packets. Lots and lots of routers *filter* packets. In fact, there are probably more routers in the world *filtering* packets than there are firewalls doing the same. There are also may types of filtering, including functions such as rate-limiting, which in effect ends up filtering packets in many cases. ;> > For that same reason, we have RFC 1122 for hosts *and* RFC 1812 for > routers, even when in most cases a router (as a "device") will also > behave as a host for some functions. OK, are you saying that all filtering of packets should be considered a 'firewall' function? In the common parlance, 'firewall' typically implies state, while most filtering which takes place on routers is stateless. I don't believe that 'firewall' is suitable as a generic appellation for filtering packets. >> No. We are not changing ICMP or IP. We are simply providing advice >> on ICMP filtering. The specs are left unchanged. But, if you have a >> packet filtering device, you may follow the advice we'd be providing. I didn't mean to imply that ICMP or IP were being changed, but that indeed this was advice, i.e., BCP-type advice, about behavior that we would recommend that all devices exhibit when filtering packets. ----------------------------------------------------------------------- Roland Dobbins // 408.527.6376 voice Culture eats strategy for breakfast. -- Ford Motor Company _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat Feb 16 09:45:56 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9CD2528C279; Sat, 16 Feb 2008 09:45:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.978 X-Spam-Level: X-Spam-Status: No, score=-0.978 tagged_above=-999 required=5 tests=[AWL=-0.540, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0eJltXtpQ3WB; Sat, 16 Feb 2008 09:45:56 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 025D428C242; Sat, 16 Feb 2008 09:45:54 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2484F28C242 for ; Sat, 16 Feb 2008 09:45:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Do9sBt8rkd1G for ; Sat, 16 Feb 2008 09:45:51 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 07F3028C1F7 for ; Sat, 16 Feb 2008 09:45:50 -0800 (PST) Received: from [192.168.88.132] (adsl-75-36-136-234.dsl.pltn13.sbcglobal.net [75.36.136.234]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m1GHjllr030214 for ; Sat, 16 Feb 2008 17:45:48 GMT (envelope-from joelja@bogus.com) Message-ID: <47B72149.5090208@bogus.com> Date: Sat, 16 Feb 2008 09:45:45 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.91.1/5835/Sat Feb 16 15:09:58 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] Informal meeting in Philly... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org If there are opsec participants who wish to meet informally in Philadelphia, I'm planning around the idea of lunch on tuesday. If I can get a first order approximation of how many people might be able to make that I can locate a suitable venue. I expect it will be casual and that business will be a minor component of it. Thanks joel _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sat Feb 16 12:19:52 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D89C028C1BA; Sat, 16 Feb 2008 12:19:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.797 X-Spam-Level: X-Spam-Status: No, score=-0.797 tagged_above=-999 required=5 tests=[AWL=-0.360, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FlCTBbnTGyiX; Sat, 16 Feb 2008 12:19:52 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 228C828C120; Sat, 16 Feb 2008 12:19:52 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 016293A67E1 for ; Sat, 16 Feb 2008 12:19:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3z-uKavpYxoN for ; Sat, 16 Feb 2008 12:19:50 -0800 (PST) Received: from smtp-out.google.com (smtp-out.google.com [216.239.33.17]) by core3.amsl.com (Postfix) with ESMTP id 4224C28C0EF for ; Sat, 16 Feb 2008 12:19:25 -0800 (PST) Received: from zps78.corp.google.com (zps78.corp.google.com [172.25.146.78]) by smtp-out.google.com with ESMTP id m1GKJDRF028931; Sat, 16 Feb 2008 20:19:14 GMT Received: from [172.29.127.191] ([172.29.127.191]) (authenticated bits=0) by zps78.corp.google.com with ESMTP id m1GKIOZ9000646 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Sat, 16 Feb 2008 12:19:12 -0800 Message-Id: From: Warren Kumari To: Joel Jaeggli In-Reply-To: <47B72149.5090208@bogus.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Sat, 16 Feb 2008 15:19:12 -0500 References: <47B72149.5090208@bogus.com> X-Mailer: Apple Mail (2.915) Cc: opsec wg mailing list Subject: Re: [OPSEC] Informal meeting in Philly... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 16, 2008, at 12:45 PM, Joel Jaeggli wrote: > If there are opsec participants who wish to meet informally in > Philadelphia, I'm planning around the idea of lunch on tuesday. If I > can > get a first order approximation of how many people might be able to > make > that I can locate a suitable venue. > > I expect it will be casual and that business will be a minor component > of it. joel -- great idea-- count me in... W > > > Thanks > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > http://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Sun Feb 24 08:39:08 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6164628C14A; Sun, 24 Feb 2008 08:39:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.844 X-Spam-Level: X-Spam-Status: No, score=-0.844 tagged_above=-999 required=5 tests=[AWL=-0.407, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5UENxD8O+P9d; Sun, 24 Feb 2008 08:39:07 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 834043A6A08; Sun, 24 Feb 2008 08:39:07 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 25B023A6A08 for ; Sun, 24 Feb 2008 08:39:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S0kaBCeA34p2 for ; Sun, 24 Feb 2008 08:39:06 -0800 (PST) Received: from co300216-co-outbound.avaya.com (co300216-co-outbound.net.avaya.com [198.152.13.100]) by core3.amsl.com (Postfix) with ESMTP id 3E58E3A6827 for ; Sun, 24 Feb 2008 08:39:06 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,398,1199682000"; d="scan'208";a="107884897" Received: from unknown (HELO nj300815-nj-erheast.avaya.com) ([198.152.6.5]) by co300216-co-outbound.avaya.com with ESMTP; 24 Feb 2008 11:38:48 -0500 X-IronPort-AV: E=Sophos;i="4.25,398,1199682000"; d="scan'208";a="159367869" Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.13]) by nj300815-nj-erheast-out.avaya.com with ESMTP; 24 Feb 2008 11:38:48 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Sun, 24 Feb 2008 17:38:47 +0100 Message-ID: In-Reply-To: <47B72149.5090208@bogus.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] Informal meeting in Philly... Thread-Index: Achww8/7yMxESdUYQlCvLOsOqdRPrAGP8YGg References: <47B72149.5090208@bogus.com> From: "Romascanu, Dan (Dan)" To: "Joel Jaeggli" , "opsec wg mailing list" Subject: Re: [OPSEC] Informal meeting in Philly... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org I may join unless other things show up. Dan > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Joel Jaeggli > Sent: Saturday, February 16, 2008 7:46 PM > To: opsec wg mailing list > Subject: [OPSEC] Informal meeting in Philly... > > If there are opsec participants who wish to meet informally > in Philadelphia, I'm planning around the idea of lunch on > tuesday. If I can get a first order approximation of how many > people might be able to make that I can locate a suitable venue. > > I expect it will be casual and that business will be a minor > component of it. > > Thanks > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > http://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 20:14:24 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED90A3A6D66; Tue, 26 Feb 2008 20:14:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.155 X-Spam-Level: X-Spam-Status: No, score=-1.155 tagged_above=-999 required=5 tests=[AWL=-0.718, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iIQLw8sLZCOA; Tue, 26 Feb 2008 20:14:24 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 244CF3A6BD2; Tue, 26 Feb 2008 20:14:24 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51B253A6971 for ; Tue, 26 Feb 2008 20:14:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZMWhM+lqOcPE for ; Tue, 26 Feb 2008 20:14:22 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 324EE3A695D for ; Tue, 26 Feb 2008 20:14:21 -0800 (PST) Received: from [192.168.11.103] (c-67-164-68-173.hsd1.ca.comcast.net [67.164.68.173]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m1R4ECTS075412 for ; Wed, 27 Feb 2008 04:14:13 GMT (envelope-from joelja@bogus.com) Message-ID: <47C4E38E.1070105@bogus.com> Date: Tue, 26 Feb 2008 20:14:06 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/6006/Wed Feb 27 01:03:40 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Would be an otherwise unremarkable leak of some isp's internal policy except for the players. We have fairly well understood but not widely deployed tools that were the used could have precluded some networks from accepting the longer prefix... Are there simple lessons to be taken away from this event? On the originator side certainly there are safer ways to insert blackhole routes into your fib that what was likely done. joel _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 20:38:50 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5E01A3A6DB0; Tue, 26 Feb 2008 20:38:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.962 X-Spam-Level: X-Spam-Status: No, score=-0.962 tagged_above=-999 required=5 tests=[AWL=-0.525, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EdGoNrEI3MBX; Tue, 26 Feb 2008 20:38:49 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 09F9C3A6D84; Tue, 26 Feb 2008 20:38:49 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF3B128C433 for ; Tue, 26 Feb 2008 20:38:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L-7t5BOTsB2W for ; Tue, 26 Feb 2008 20:38:47 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id B339D3A6D8B for ; Tue, 26 Feb 2008 20:37:59 -0800 (PST) Received: from [192.168.11.103] (c-67-164-68-173.hsd1.ca.comcast.net [67.164.68.173]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m1R4bn9C076599 for ; Wed, 27 Feb 2008 04:37:51 GMT (envelope-from joelja@bogus.com) Message-ID: <47C4E917.3080401@bogus.com> Date: Tue, 26 Feb 2008 20:37:43 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: opsec wg mailing list References: <47B72149.5090208@bogus.com> In-Reply-To: <47B72149.5090208@bogus.com> X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/6006/Wed Feb 27 01:03:40 2008 on nagasaki.bogus.com X-Virus-Status: Clean Subject: Re: [OPSEC] Informal meeting in Philly... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org I believe that we have a quorum of sorts. I will scout locations when I arrive, and send mail by the morning of March 17. thanks joelja Joel Jaeggli wrote: > If there are opsec participants who wish to meet informally in > Philadelphia, I'm planning around the idea of lunch on tuesday. If I can > get a first order approximation of how many people might be able to make > that I can locate a suitable venue. > > I expect it will be casual and that business will be a minor component > of it. > > Thanks > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > http://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org http://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 21:34:57 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 961AC3A6D80; Tue, 26 Feb 2008 21:34:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.636 X-Spam-Level: X-Spam-Status: No, score=-0.636 tagged_above=-999 required=5 tests=[AWL=-0.199, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ju6gFWqbKzEf; Tue, 26 Feb 2008 21:34:52 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1B7743A67FB; Tue, 26 Feb 2008 21:34:52 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 371383A67AE for ; Tue, 26 Feb 2008 21:34:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 07qimXrfZ8g3 for ; Tue, 26 Feb 2008 21:34:50 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.175]) by core3.amsl.com (Postfix) with ESMTP id 80D513A67FB for ; Tue, 26 Feb 2008 21:34:50 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so1931609wfa.31 for ; Tue, 26 Feb 2008 21:34:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=pJR3L+CWMOOdUc1xeObvXOyIPmNmsnlb9Kyk6seYZwI=; b=QiKnrhL7v8Ejs/3hJDUMYerTOykIxEsoiTvWmpjIaqvuMFhpJaQVXmyWoKR447ka2EXwlNO6ZtNjBqJUSioPc8BkhTvtWFaX7WCRPLPlfJ8hNs1eGvBA02HVq5NHuzpaUPY5WfQ5ODpadGt9Qv8bVbPjet4SoK52GEHECRohWTc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=rNNmEGGGmjNrlh2lPO4mqVjIRumARex88o+pdoz0aTud5PNwQ4/MlWjS7FPfnyqBh/zSqLAy1AioiXLUCQteVbIW7CicfYdjg2SEC2xDD8Xq0gRWDfbx5Z8mZ52Jk0/wVfTtM7pphPbZQJsVzjGLEreU6t66VNq5x8k4lnmvKNk= Received: by 10.142.203.13 with SMTP id a13mr841136wfg.193.1204090484353; Tue, 26 Feb 2008 21:34:44 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 26 Feb 2008 21:34:44 -0800 (PST) Message-ID: <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> Date: Tue, 26 Feb 2008 21:34:44 -0800 From: "Vishwas Manral" To: "Joel Jaeggli" In-Reply-To: <47C4E38E.1070105@bogus.com> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Joel, This was certainly a very interesting case of how and why some basic security is required between consenting peers. I was eager to know what tools/ filters you thought could be used to prevent such an exploit. Thanks, Vishwas On Tue, Feb 26, 2008 at 8:14 PM, Joel Jaeggli wrote: > Would be an otherwise unremarkable leak of some isp's internal policy > except for the players. > > We have fairly well understood but not widely deployed tools that were > the used could have precluded some networks from accepting the longer > prefix... > > Are there simple lessons to be taken away from this event? > > On the originator side certainly there are safer ways to insert > blackhole routes into your fib that what was likely done. > > > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > http://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 21:48:05 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D240A28C333; Tue, 26 Feb 2008 21:48:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[AWL=-1.540, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zgvpQCfxo55B; Tue, 26 Feb 2008 21:48:04 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7FE2328C482; Tue, 26 Feb 2008 21:48:03 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D9DD43A68F4 for ; Tue, 26 Feb 2008 21:48:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3aKURSk+Dn7g for ; Tue, 26 Feb 2008 21:47:56 -0800 (PST) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) by core3.amsl.com (Postfix) with ESMTP id 4017D28C348 for ; Tue, 26 Feb 2008 21:47:18 -0800 (PST) Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-1.cisco.com with ESMTP; 26 Feb 2008 21:47:10 -0800 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id m1R5lAIf021188 for ; Tue, 26 Feb 2008 21:47:10 -0800 Received: from [192.168.1.100] ([10.21.74.156]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id m1R5l7CH020980 for ; Wed, 27 Feb 2008 05:47:09 GMT Message-Id: <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Wed, 27 Feb 2008 12:47:04 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=946; t=1204091231; x=1204955231; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=AA1b38FYbeGal5AR7yUg3tpOrPi0YGPE4kxoyUnbL1U=; b=pmb5AKtZuF6rFbLYp3T3W0oFoNHqIRgAdkuSmIiq1QE3Tp9XBFGbr0imme ZBQF4SQ5KNjrJ70WJrPv8taIEcxRqd9v1CEtjq6vmMQBo4MhQZLnfBU2ZqO7 Z5bsW95aC4; Authentication-Results: sj-dkim-4; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 27, 2008, at 12:34 PM, Vishwas Manral wrote: > I was eager to know what tools/ filters you thought could be used to > prevent such an exploit. This problem and the solutions for it are about 15 years old, FYI. It's ISP BGP 101 - filter the routing advertisements you accept for your customers/peers/transits, filter the routing announcements you pass to customers/peers/transits, make use of RIRs to build filters, et. al. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 22:30:05 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A33D23A6D84; Tue, 26 Feb 2008 22:30:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.82 X-Spam-Level: X-Spam-Status: No, score=-0.82 tagged_above=-999 required=5 tests=[AWL=-0.383, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8uiHw1wAzV8V; Tue, 26 Feb 2008 22:30:00 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F79F28C435; Tue, 26 Feb 2008 22:30:00 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9EA7228C478 for ; Tue, 26 Feb 2008 22:29:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZT3OwqYhH3LP for ; Tue, 26 Feb 2008 22:29:57 -0800 (PST) Received: from qb-out-0506.google.com (qb-out-0506.google.com [72.14.204.224]) by core3.amsl.com (Postfix) with ESMTP id 874B328C2CA for ; Tue, 26 Feb 2008 22:29:57 -0800 (PST) Received: by qb-out-0506.google.com with SMTP id o21so3659904qba.9 for ; Tue, 26 Feb 2008 22:29:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=WdfowzUhHWAASC6OgrjZyeRsX4E0zYkxYEfL7byheJI=; b=Qa9MTtJrDWjht1htn/aMi6PDEfauUGC+Cp+8sOSKVOvHZhTZXBqP/30jOF6LkHA0Olewt82Qbyl03DGoItpf1O2tXKC4DCWSmTYouo23rdk92LD+yuAmO2PKaRhd/+flv+fSu9gWJijkDDwO2pp+qVROBzkFZrbsm2P5Eq24smc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=V2OWnYNhQS+bSpjs6QlNiP++fIljR2ucrvxh1VlSSzPKsj0YdSqNJVoy4o2y9+D2XlfWbyqZzcl3cO69Adc97Xf6hI4syWahdbh8JrCmgv3PUIK/EbwtLzZJp0PR+jpUqMvmYqqYYfxGIQiqeJEII1HBcQO1GB5rt20WiYL7Nm4= Received: by 10.142.174.8 with SMTP id w8mr4800806wfe.5.1204093789932; Tue, 26 Feb 2008 22:29:49 -0800 (PST) Received: by 10.143.164.14 with HTTP; Tue, 26 Feb 2008 22:29:49 -0800 (PST) Message-ID: <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> Date: Tue, 26 Feb 2008 22:29:49 -0800 From: "Vishwas Manral" To: "Roland Dobbins" In-Reply-To: <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Roland, Thanks for the links. I looked at the document from Philip Smith as well as the last one. I did not find any way for a route to figure out a peer is actually advertising a bogus prefix, which it does not own, which is what the case was with the PCCW leak. Note the real problem is not that the peer advertised a wrong/ malicious prefix, but that we have no mechanism to decide the prefix originated is not right. Best practices for blackholing may help only in the non-malicious case. I think the ideal solution for that would require a certificate containing the AS Number and the prefix. Do let me know what is the exact method you are talking about? Thanks, Vishwas On Tue, Feb 26, 2008 at 9:47 PM, Roland Dobbins wrote: > > On Feb 27, 2008, at 12:34 PM, Vishwas Manral wrote: > > > I was eager to know what tools/ filters you thought could be used to > > prevent such an exploit. > > > This problem and the solutions for it are about 15 years old, FYI. > > It's ISP BGP 101 - filter the routing advertisements you accept for > your customers/peers/transits, filter the routing announcements you > pass to customers/peers/transits, make use of RIRs to build filters, > et. al. > > > > > > > > > > > ----------------------------------------------------------------------- > Roland Dobbins // +66.83.266.6344 mobile > > If you don't know what to do, it's harder to do it. > > -- Malcom Forbes > > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 22:44:28 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 133B43A6971; Tue, 26 Feb 2008 22:44:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[AWL=-1.540, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vZ7jtUjxE0IS; Tue, 26 Feb 2008 22:44:27 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E07528C156; Tue, 26 Feb 2008 22:44:27 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7540C28C2CA for ; Tue, 26 Feb 2008 22:44:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UXXBBvvujwkE for ; Tue, 26 Feb 2008 22:44:24 -0800 (PST) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 8B0B23A67AE for ; Tue, 26 Feb 2008 22:44:24 -0800 (PST) Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-6.cisco.com with ESMTP; 26 Feb 2008 22:44:18 -0800 Received: from sj-core-4.cisco.com (sj-core-4.cisco.com [171.68.223.138]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m1R6iGnK015300 for ; Tue, 26 Feb 2008 22:44:16 -0800 Received: from [192.168.1.100] ([10.21.74.156]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id m1R6iDkk007979 for ; Wed, 27 Feb 2008 06:44:15 GMT Message-Id: <0EE9065F-13C7-462F-B679-C0DDDBB58C60@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Wed, 27 Feb 2008 13:44:11 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1990; t=1204094656; x=1204958656; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=GqpRLp9/GhRbjYs6sqeAcCFdLGjlTLSenljpr/Xu5AM=; b=mAg9E+nfUIXDkRtPuWg0Dwy4aAtQvnjYPsLboyhi4BSr8V6PdYSJKMWtDA bCHBXIJoQG8KQkldlTPAgETPI8xc5X+OZ+YSxdU40EpDd8yTPcMO7WZIEvN5 kDpvzZnKhq; Authentication-Results: sj-dkim-2; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 27, 2008, at 1:29 PM, Vishwas Manral wrote: > Note the real problem is not that the > peer advertised a wrong/ malicious prefix, but that we have no > mechanism to decide the prefix originated is not right. You don't accept advertisements from your customers for networks they don't own, it's quite simple, in most cases. You don't advertise netblocks you don't own or that your customers don't own; if you set up a blackhole for any reason, you don't leak it. You build your filters based on RIR information (keeping in mind that it's incomplete). > Best practices for blackholing may help only in the non-malicious > case. Many years of experience indicate otherwise. This isn't theoretical, mind; operators who do these things don't end up causing problems of this type. Perusing the NANOG-l archives would probably prove educational in this regard. > I think the ideal solution for that would require a certificate > containing the AS Number and the prefix. sBGP, soBGP, the 'PKI problem', see the years of discussions surrounding them (lots of conceptual overlap with DNSSEC). Again, there's about 15 years of history, operational art, BCPs, proposals, counterproposals, et. al. surrounding this set of issues. It's probably a good idea for anyone evaluating approaches to this problem to read up on the history and considerable literature/ discussions on this subject prior to engaging in advocacy of a particular class of solution. > Do let me know what is the exact method you are talking about? There is no one 'exact' method, but, rather, a set of BCPs which, if implemented, drastically reduce the risks and impact of a miscue such as this one. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 22:54:12 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B79343A6954; Tue, 26 Feb 2008 22:54:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.457 X-Spam-Level: X-Spam-Status: No, score=-0.457 tagged_above=-999 required=5 tests=[AWL=-0.020, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9hN7ydQg3bpw; Tue, 26 Feb 2008 22:54:07 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4E6113A692C; Tue, 26 Feb 2008 22:54:07 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7EE583A6954 for ; Tue, 26 Feb 2008 22:54:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nsbuV18rQPfO for ; Tue, 26 Feb 2008 22:54:00 -0800 (PST) Received: from netcore.fi (eunet-gw.ipv6.netcore.fi [IPv6:2001:670:86:3001::1]) by core3.amsl.com (Postfix) with ESMTP id AF2573A67AE for ; Tue, 26 Feb 2008 22:53:57 -0800 (PST) Received: from netcore.fi (localhost [127.0.0.1]) by netcore.fi (8.13.8/8.13.8) with ESMTP id m1R6rRar012381; Wed, 27 Feb 2008 08:53:27 +0200 Received: from localhost (pekkas@localhost) by netcore.fi (8.13.8/8.13.8/Submit) with ESMTP id m1R6rRl4012378; Wed, 27 Feb 2008 08:53:27 +0200 Date: Wed, 27 Feb 2008 08:53:26 +0200 (EET) From: Pekka Savola To: Roland Dobbins In-Reply-To: <0EE9065F-13C7-462F-B679-C0DDDBB58C60@cisco.com> Message-ID: References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <0EE9065F-13C7-462F-B679-C0DDDBB58C60@cisco.com> User-Agent: Alpine 1.00 (LRH 882 2007-12-20) MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92.1/5997/Tue Feb 26 08:14:18 2008 on otso.netcore.fi X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Wed, 27 Feb 2008, Roland Dobbins wrote: > There is no one 'exact' method, but, rather, a set of BCPs which, if > implemented, drastically reduce the risks and impact of a miscue such > as this one. I think Vishwas is asking a valid question. The answer is.. a lot of manual work, or in some parts of Europe, IRR-built filters. This start of the thread and reference to Joe Abley's explanation on SIDR list is probably relevant here: http://www.gossamer-threads.com/lists/nanog/users/103419 -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 22:58:00 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D12EB28C435; Tue, 26 Feb 2008 22:58:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.129 X-Spam-Level: X-Spam-Status: No, score=-1.129 tagged_above=-999 required=5 tests=[AWL=-0.692, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tLFfNU7fg4Aq; Tue, 26 Feb 2008 22:57:55 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 08A9B3A6887; Tue, 26 Feb 2008 22:57:20 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 388D13A6887 for ; Tue, 26 Feb 2008 22:57:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 30sKkIH06B0t for ; Tue, 26 Feb 2008 22:57:13 -0800 (PST) Received: from dog.tcb.net (dog.tcb.net [64.78.150.133]) by core3.amsl.com (Postfix) with ESMTP id C520B3A67AE for ; Tue, 26 Feb 2008 22:57:13 -0800 (PST) Received: by dog.tcb.net (Postfix, from userid 0) id 9B83626803D; Tue, 26 Feb 2008 23:57:07 -0700 (MST) Received: from [192.168.1.7] (VDSL-151-118-144-8.DNVR.QWEST.NET [151.118.144.8]) (authenticated-user smtp) (TLSv1/SSLv3 AES128-SHA 128/128) by dog.tcb.net with SMTP; Tue, 26 Feb 2008 23:57:07 -0700 (MST) (envelope-from danny@tcb.net) X-Avenger: version=0.7.8; receiver=dog.tcb.net; client-ip=151.118.144.8; client-port=17500; syn-fingerprint=65535:56:1:64:M1316,N,W3,N,N,T,S; data-bytes=0 Message-Id: From: Danny McPherson To: Vishwas Manral In-Reply-To: <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Tue, 26 Feb 2008 23:56:52 -0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 26, 2008, at 11:29 PM, Vishwas Manral wrote: > Hi Roland, > > Thanks for the links. > > I looked at the document from Philip Smith as well as the last one. I > did not find any way for a route to figure out a peer is actually > advertising a bogus prefix, which it does not own, which is what the > case was with the PCCW leak. Note the real problem is not that the > peer advertised a wrong/ malicious prefix, but that we have no > mechanism to decide the prefix originated is not right. Best practices > for blackholing may help only in the non-malicious case. The question isn't about verifying if the peer is advertising a prefix which it doesn't own, it's about only accepting routes from a peer if that peer originates or provides transit services for those routes, implicitly denying all others. 15 years ago this worked like so (very abbreviated): - I peer with AS X. AS X announces prefixes a, b & c, which I discover by interrogating IRR data associated with AS X as an origin AS. - AS X's IRR data also includes an as-macro which provides a list of ASNs for which AS X provides transit services, e.g., AS Y & Z. - I look up all prefixes registered as originating from AS Y & Z and find d, e & f. - I define a prefix list for AS X that permits them to only announce a, b,c, d, e & f, and explicitly deny everything else. I also do this based explicitly on prefix length so that I don't have to accept a bunch of extraneous prefixes such as more specifics. > I think the ideal solution for that would require a certificate > containing the AS Number and the prefix. Do let me know what is the > exact method you are talking about? This didn't need to be in the routing system itself, nor does the initial [re]deployment today. It can all occur out of band. Subsequently, SIDR and somewhere WAY down the road, something akin to soBGP or SBGP could dynamically do this in the routing system itself, but that's quite a ways away. See: RIPE-181, RPSL, SIDR -danny _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 23:00:04 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 247BC3A6DBB; Tue, 26 Feb 2008 23:00:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.997 X-Spam-Level: X-Spam-Status: No, score=-0.997 tagged_above=-999 required=5 tests=[AWL=-0.560, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kZKNw1nNjQjT; Tue, 26 Feb 2008 22:59:58 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD60E3A6A06; Tue, 26 Feb 2008 22:59:58 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 123C13A6D80 for ; Tue, 26 Feb 2008 22:59:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j4MS4l8pS7xJ for ; Tue, 26 Feb 2008 22:59:56 -0800 (PST) Received: from sj-iport-4.cisco.com (sj-iport-4.cisco.com [171.68.10.86]) by core3.amsl.com (Postfix) with ESMTP id 3D23C3A6A06 for ; Tue, 26 Feb 2008 22:59:56 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,411,1199692800"; d="scan'208";a="7286797" Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-4.cisco.com with ESMTP; 26 Feb 2008 22:59:50 -0800 Received: from sj-core-3.cisco.com (sj-core-3.cisco.com [171.68.223.137]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id m1R6xnXA028505 for ; Tue, 26 Feb 2008 22:59:49 -0800 Received: from [192.168.1.100] ([10.21.74.156]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id m1R6xjqM024160 for ; Wed, 27 Feb 2008 06:59:47 GMT Message-Id: <13DAB294-D028-4C42-A150-05AD680B06D3@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: Mime-Version: 1.0 (Apple Message framework v915) Date: Wed, 27 Feb 2008 13:59:43 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <0EE9065F-13C7-462F-B679-C0DDDBB58C60@cisco.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=606; t=1204095589; x=1204959589; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=1mrxSiWIgBzLNcx+kjb245wlWVhuub1hPBH9UFo3rsg=; b=K9VRwNqsaiGO4VEuWnJ4/4OogtNeqKIjcfD95Czn+z3DxjeyZHpCKBU6ix 7yQQ+7sPvJHhGZXE4Z0uK5WwlZzYqL46q0npnMKjtgEmvE7rClbSD5DmHek5 aLiluCrPZe; Authentication-Results: sj-dkim-4; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 27, 2008, at 1:53 PM, Pekka Savola wrote: > I think Vishwas is asking a valid question. I agree, it's certainly a valid question. The answer is, right now, less than ideal and subject to operational inertia/entropy, as you indicate, but there *is* an answer. We need better answers, and that's the intention of proposals like soBGP, etc. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Tue Feb 26 23:00:55 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6FE253A6C6A; Tue, 26 Feb 2008 23:00:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.951 X-Spam-Level: X-Spam-Status: No, score=-0.951 tagged_above=-999 required=5 tests=[AWL=-0.513, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S-0baT20ZQEo; Tue, 26 Feb 2008 23:00:50 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 05E783A698F; Tue, 26 Feb 2008 23:00:50 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 163953A692D for ; Tue, 26 Feb 2008 23:00:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lgiiKyy4RXm5 for ; Tue, 26 Feb 2008 23:00:48 -0800 (PST) Received: from sj-iport-3.cisco.com (sj-iport-3.cisco.com [171.71.176.72]) by core3.amsl.com (Postfix) with ESMTP id 6C5B53A6887 for ; Tue, 26 Feb 2008 23:00:48 -0800 (PST) Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-3.cisco.com with ESMTP; 26 Feb 2008 23:00:42 -0800 Received: from sj-core-3.cisco.com (sj-core-3.cisco.com [171.68.223.137]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id m1R70gRs013392 for ; Tue, 26 Feb 2008 23:00:42 -0800 Received: from [192.168.1.100] ([10.21.74.156]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id m1R6xjqN024160 for ; Wed, 27 Feb 2008 07:00:41 GMT Message-Id: <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: Mime-Version: 1.0 (Apple Message framework v915) Date: Wed, 27 Feb 2008 14:00:39 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=376; t=1204095642; x=1204959642; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=Ul4TCnv//iva0XO6AvAoH7Lk/PJwRCHtDuvN9rhZhE0=; b=cXg4gbyKlpcBqudZXnLfo2UqZPZFRpY+ENGeOiqeE+pLnZamixTSJZ0ObA eDJffu3WJWXK5f7vNFNCT1lzJyeMM+p3KqMBJWqDeuE3fyDcsZ8Sbyo+26uU lddg67pKG5; Authentication-Results: sj-dkim-3; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 27, 2008, at 1:56 PM, Danny McPherson wrote: > See: RIPE-181, RPSL, SIDR Yes, I forgot SIDR - good point, Danny & Pekka. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 03:36:18 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F5F428C10A; Wed, 27 Feb 2008 03:36:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.797 X-Spam-Level: X-Spam-Status: No, score=-0.797 tagged_above=-999 required=5 tests=[AWL=-0.360, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dtgyGB7ad2gP; Wed, 27 Feb 2008 03:36:13 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F095E3A6DB6; Wed, 27 Feb 2008 03:36:12 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 002FA28C250 for ; Wed, 27 Feb 2008 03:36:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OMDiQB0fy+pR for ; Wed, 27 Feb 2008 03:36:11 -0800 (PST) Received: from co300216-co-outbound.avaya.com (co300216-co-outbound.net.avaya.com [198.152.13.100]) by core3.amsl.com (Postfix) with ESMTP id 2ADE23A689C for ; Wed, 27 Feb 2008 03:36:11 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,412,1199682000"; d="scan'208";a="108569784" Received: from unknown (HELO nj300815-nj-erheast.avaya.com) ([198.152.6.5]) by co300216-co-outbound.avaya.com with ESMTP; 27 Feb 2008 06:36:04 -0500 X-IronPort-AV: E=Sophos;i="4.25,412,1199682000"; d="scan'208";a="160917870" Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.13]) by nj300815-nj-erheast-out.avaya.com with ESMTP; 27 Feb 2008 06:36:03 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 27 Feb 2008 12:36:02 +0100 Message-ID: In-Reply-To: <47C4E917.3080401@bogus.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] Informal meeting in Philly... Thread-Index: Ach4+qX3f83flLKmQDCKzV1TOv0/kAAOh9Xw References: <47B72149.5090208@bogus.com> <47C4E917.3080401@bogus.com> From: "Romascanu, Dan (Dan)" To: "Joel Jaeggli" , "opsec wg mailing list" Subject: Re: [OPSEC] Informal meeting in Philly... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org You probably mean the morning of March 10 or 11 :-) The lunch is scheduled for March 11, right? Dan > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Joel Jaeggli > Sent: Wednesday, February 27, 2008 6:38 AM > To: opsec wg mailing list > Subject: Re: [OPSEC] Informal meeting in Philly... > > I believe that we have a quorum of sorts. > > I will scout locations when I arrive, and send mail by the > morning of March 17. > > thanks > joelja > > Joel Jaeggli wrote: > > If there are opsec participants who wish to meet informally in > > Philadelphia, I'm planning around the idea of lunch on > tuesday. If I > > can get a first order approximation of how many people > might be able > > to make that I can locate a suitable venue. > > > > I expect it will be casual and that business will be a > minor component > > of it. > > > > Thanks > > joel > > _______________________________________________ > > OPSEC mailing list > > OPSEC@ietf.org > > http://www.ietf.org/mailman/listinfo/opsec > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > http://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 03:39:15 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 72CA628C367; Wed, 27 Feb 2008 03:39:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.877 X-Spam-Level: X-Spam-Status: No, score=-0.877 tagged_above=-999 required=5 tests=[AWL=-0.440, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zp9bSpc5Wa5V; Wed, 27 Feb 2008 03:39:09 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DCBB83A6DF5; Wed, 27 Feb 2008 03:39:09 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 202363A67F9 for ; Wed, 27 Feb 2008 03:39:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TwK70HIW5KFK for ; Wed, 27 Feb 2008 03:39:03 -0800 (PST) Received: from linuxbox.org (linuxbox.org [24.155.83.21]) by core3.amsl.com (Postfix) with ESMTP id 979103A68AA for ; Wed, 27 Feb 2008 03:39:03 -0800 (PST) Received: from linuxbox.org (ge@localhost [127.0.0.1]) by linuxbox.org (8.13.8/8.13.8/Debian-3) with ESMTP id m1RBeeE8029086 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 27 Feb 2008 05:40:41 -0600 Received: from localhost (ge@localhost) by linuxbox.org (8.13.8/8.13.8/Submit) with ESMTP id m1RBeeaq029083; Wed, 27 Feb 2008 05:40:40 -0600 Date: Wed, 27 Feb 2008 05:40:40 -0600 (CST) From: Gadi Evron To: "Romascanu, Dan (Dan)" In-Reply-To: Message-ID: References: <47B72149.5090208@bogus.com> <47C4E917.3080401@bogus.com> MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-1.7.5 (linuxbox.org [127.0.0.1]); Wed, 27 Feb 2008 05:40:41 -0600 (CST) Cc: opsec wg mailing list Subject: Re: [OPSEC] Informal meeting in Philly... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Wed, 27 Feb 2008, Romascanu, Dan (Dan) wrote: > You probably mean the morning of March 10 or 11 :-) > > The lunch is scheduled for March 11, right? In that case I can make it, too. Gadi. > > Dan > > >> -----Original Message----- >> From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] >> On Behalf Of Joel Jaeggli >> Sent: Wednesday, February 27, 2008 6:38 AM >> To: opsec wg mailing list >> Subject: Re: [OPSEC] Informal meeting in Philly... >> >> I believe that we have a quorum of sorts. >> >> I will scout locations when I arrive, and send mail by the >> morning of March 17. >> >> thanks >> joelja >> >> Joel Jaeggli wrote: >>> If there are opsec participants who wish to meet informally in >>> Philadelphia, I'm planning around the idea of lunch on >> tuesday. If I >>> can get a first order approximation of how many people >> might be able >>> to make that I can locate a suitable venue. >>> >>> I expect it will be casual and that business will be a >> minor component >>> of it. >>> >>> Thanks >>> joel >>> _______________________________________________ >>> OPSEC mailing list >>> OPSEC@ietf.org >>> http://www.ietf.org/mailman/listinfo/opsec >>> >> >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> http://www.ietf.org/mailman/listinfo/opsec >> > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 07:40:54 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E1D9D28C3DB; Wed, 27 Feb 2008 07:40:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.781 X-Spam-Level: X-Spam-Status: No, score=-0.781 tagged_above=-999 required=5 tests=[AWL=-0.344, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yr5pCtNPLBj4; Wed, 27 Feb 2008 07:40:49 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 68FB93A6E1D; Wed, 27 Feb 2008 07:40:49 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5580A3A6E1D for ; Wed, 27 Feb 2008 07:40:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JaW4NYt+fo5f for ; Wed, 27 Feb 2008 07:40:47 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id 3919F3A6E2F for ; Wed, 27 Feb 2008 07:40:46 -0800 (PST) Received: from [192.168.11.103] (c-67-164-68-173.hsd1.ca.comcast.net [67.164.68.173]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m1RFeaWL005233; Wed, 27 Feb 2008 15:40:37 GMT (envelope-from joelja@bogus.com) Message-ID: <47C5846D.9080507@bogus.com> Date: Wed, 27 Feb 2008 07:40:29 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: "Romascanu, Dan (Dan)" References: <47B72149.5090208@bogus.com> <47C4E917.3080401@bogus.com> In-Reply-To: X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/6010/Wed Feb 27 12:54:14 2008 on nagasaki.bogus.com X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] Informal meeting in Philly... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Romascanu, Dan (Dan) wrote: > You probably mean the morning of March 10 or 11 :-) Yeah, the 10th. sorry. > The lunch is scheduled for March 11, right? > > Dan > > >> -----Original Message----- >> From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] >> On Behalf Of Joel Jaeggli >> Sent: Wednesday, February 27, 2008 6:38 AM >> To: opsec wg mailing list >> Subject: Re: [OPSEC] Informal meeting in Philly... >> >> I believe that we have a quorum of sorts. >> >> I will scout locations when I arrive, and send mail by the >> morning of March 17. >> >> thanks >> joelja >> >> Joel Jaeggli wrote: >>> If there are opsec participants who wish to meet informally in >>> Philadelphia, I'm planning around the idea of lunch on >> tuesday. If I >>> can get a first order approximation of how many people >> might be able >>> to make that I can locate a suitable venue. >>> >>> I expect it will be casual and that business will be a >> minor component >>> of it. >>> >>> Thanks >>> joel >>> _______________________________________________ >>> OPSEC mailing list >>> OPSEC@ietf.org >>> http://www.ietf.org/mailman/listinfo/opsec >>> >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> http://www.ietf.org/mailman/listinfo/opsec >> > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 07:46:28 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B57023A6E3D; Wed, 27 Feb 2008 07:46:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.751 X-Spam-Level: X-Spam-Status: No, score=-1.751 tagged_above=-999 required=5 tests=[AWL=-1.314, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YBJ0pYchGrmY; Wed, 27 Feb 2008 07:46:23 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4D1A53A692F; Wed, 27 Feb 2008 07:46:23 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6D1F03A692F for ; Wed, 27 Feb 2008 07:46:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5qJ1yrWP9-nr for ; Wed, 27 Feb 2008 07:46:18 -0800 (PST) Received: from exprod7og112.obsmtp.com (exprod7og112.obsmtp.com [64.18.2.177]) by core3.amsl.com (Postfix) with ESMTP id 85C993A68A6 for ; Wed, 27 Feb 2008 07:46:18 -0800 (PST) Received: from source ([66.129.224.36]) by exprod7ob112.postini.com ([64.18.6.12]) with SMTP; Wed, 27 Feb 2008 07:42:27 PST Received: from proton.jnpr.net ([10.10.2.37]) by emailsmtp55.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Wed, 27 Feb 2008 07:42:34 -0800 Received: from [172.23.1.226] ([172.23.1.226] RDNS failed) by proton.jnpr.net with Microsoft SMTPSVC(6.0.3790.1830); Wed, 27 Feb 2008 10:39:22 -0500 Message-ID: <47C58479.5050600@juniper.net> Date: Wed, 27 Feb 2008 10:40:41 -0500 From: Ron Bonica User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Joel Jaeggli References: <47C4E38E.1070105@bogus.com> In-Reply-To: <47C4E38E.1070105@bogus.com> X-Enigmail-Version: 0.93.0.0 X-OriginalArrivalTime: 27 Feb 2008 15:39:22.0683 (UTC) FILETIME=[ECC968B0:01C87956] Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Folks, I think that it would helpful if this working group were to produce a document (or two) recommending BGP policy for ISP. Ron Joel Jaeggli wrote: > Would be an otherwise unremarkable leak of some isp's internal policy > except for the players. > > We have fairly well understood but not widely deployed tools that were > the used could have precluded some networks from accepting the longer > prefix... > > Are there simple lessons to be taken away from this event? > > On the originator side certainly there are safer ways to insert > blackhole routes into your fib that what was likely done. > > > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > http://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 07:49:32 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 00E2528C6B9; Wed, 27 Feb 2008 07:49:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.102 X-Spam-Level: X-Spam-Status: No, score=-1.102 tagged_above=-999 required=5 tests=[AWL=-0.665, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id llFjU6ap-z5Q; Wed, 27 Feb 2008 07:49:26 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 878163A6E0A; Wed, 27 Feb 2008 07:49:26 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9B0ED3A6E0F for ; Wed, 27 Feb 2008 07:49:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id id9COR0DxJKs for ; Wed, 27 Feb 2008 07:49:21 -0800 (PST) Received: from dog.tcb.net (dog.tcb.net [64.78.150.133]) by core3.amsl.com (Postfix) with ESMTP id DC0033A6B33 for ; Wed, 27 Feb 2008 07:49:21 -0800 (PST) Received: by dog.tcb.net (Postfix, from userid 0) id 948BB2680D7; Wed, 27 Feb 2008 08:49:15 -0700 (MST) Received: from [192.168.1.7] (VDSL-151-118-152-122.DNVR.QWEST.NET [151.118.152.122]) (authenticated-user smtp) (TLSv1/SSLv3 AES128-SHA 128/128) by dog.tcb.net with SMTP; Wed, 27 Feb 2008 08:49:15 -0700 (MST) (envelope-from danny@tcb.net) X-Avenger: version=0.7.8; receiver=dog.tcb.net; client-ip=151.118.152.122; client-port=18238; syn-fingerprint=65535:56:1:64:M1316,N,W3,N,N,T,S; data-bytes=0 Message-Id: <9F3CB712-B504-47CE-8B98-3069CD5DC4E3@tcb.net> From: Danny McPherson To: Ron Bonica In-Reply-To: <47C58479.5050600@juniper.net> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Wed, 27 Feb 2008 08:49:00 -0700 References: <47C4E38E.1070105@bogus.com> <47C58479.5050600@juniper.net> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 27, 2008, at 8:40 AM, Ron Bonica wrote: > Folks, > > I think that it would helpful if this working group were to produce a > document (or two) recommending BGP policy for ISP. I mentioned to Joel off list, and the GROW chairs, I'm hacking up a boiler for this now. -danny _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 07:55:48 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8B25228C3DD; Wed, 27 Feb 2008 07:55:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[AWL=-1.540, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rW89JQJ2PFj6; Wed, 27 Feb 2008 07:55:47 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A9B003A6A67; Wed, 27 Feb 2008 07:55:47 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BEED428C376 for ; Wed, 27 Feb 2008 07:55:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MXRfEj-jLptX for ; Wed, 27 Feb 2008 07:55:40 -0800 (PST) Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by core3.amsl.com (Postfix) with ESMTP id 5FB083A6A78 for ; Wed, 27 Feb 2008 07:55:40 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.25,413,1199692800"; d="scan'208";a="14987172" Received: from sj-dkim-1.cisco.com ([171.71.179.21]) by sj-iport-5.cisco.com with ESMTP; 27 Feb 2008 07:55:34 -0800 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m1RFtYJh028475; Wed, 27 Feb 2008 07:55:34 -0800 Received: from xbh-sjc-231.amer.cisco.com (xbh-sjc-231.cisco.com [128.107.191.100]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id m1RFtXCJ008235; Wed, 27 Feb 2008 15:55:33 GMT Received: from xmb-sjc-227.amer.cisco.com ([128.107.191.43]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 27 Feb 2008 07:55:33 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 27 Feb 2008 07:55:28 -0800 Message-ID: In-Reply-To: <9F3CB712-B504-47CE-8B98-3069CD5DC4E3@tcb.net> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] pccw as17557 leak... Thread-Index: Ach5WGFGeJesI9uTRem/e9ElNNweJwAAFYyQ References: <47C4E38E.1070105@bogus.com> <47C58479.5050600@juniper.net> <9F3CB712-B504-47CE-8B98-3069CD5DC4E3@tcb.net> From: "Barry Greene (bgreene)" To: "Danny McPherson" , "Ron Bonica" X-OriginalArrivalTime: 27 Feb 2008 15:55:33.0826 (UTC) FILETIME=[2FA21220:01C87959] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1618; t=1204127734; x=1204991734; c=relaxed/simple; s=sjdkim1004; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=bgreene@cisco.com; z=From:=20=22Barry=20Greene=20(bgreene)=22=20 |Subject:=20RE=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=3IjhDHuUlCvj9BfQ0/3qMhys60vgt7tvWTNdu3uQ4SU=; b=Vc20m1DFXMKqCM5Vjl7gNIlYNwGLk0jM36OFbW9Rzzqp6/YA6UYrGdLEUK 1msdTcndaWvpceNlkmK9EIJFEZrE1a0lFeJ24n/zE2Qqb6utdskxts7/cR2e 6cr4LIsxuHij7L9bOLsMxOsEg7IIBbLbb9zoPC+5yyErLFb/Kpr6U=; Authentication-Results: sj-dkim-1; header.From=bgreene@cisco.com; dkim=pass ( sig from cisco.com/sjdkim1004 verified; ); Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Recommending policy is not the core problem. If you look at the way we train people at our operations meetings (mainly Phillip Smith's materials) you will see that we - the community - has been pounding on prefix filter BCPs over and over again. So IMHO - being one of the people who has been doing the pounding and producing the materials - I do see how yet another document will make a difference. "IETF BCPs" don't mean anything - cause the IETF BCP process is broken. What we need is to rethink how we are doing the training at the operations meetings and how we - as a community - are investing ($$$) in our open source tools. > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Danny McPherson > Sent: Wednesday, February 27, 2008 7:49 AM > To: Ron Bonica > Cc: opsec wg mailing list > Subject: Re: [OPSEC] pccw as17557 leak... > > > On Feb 27, 2008, at 8:40 AM, Ron Bonica wrote: > > > Folks, > > > > I think that it would helpful if this working group were to > produce a > > document (or two) recommending BGP policy for ISP. > > I mentioned to Joel off list, and the GROW chairs, I'm > hacking up a boiler for this now. > > -danny > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBR8WH8L/UEA/xivvmEQIsHQCg5VVvPPAwwk2xtD+JVHHu45WFHKIAoMrO 1hAkOc4hrH9Zd4LivWO+RR56 =eBLC -----END PGP SIGNATURE----- _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 08:04:26 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA5E128C7BA; Wed, 27 Feb 2008 08:04:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.098 X-Spam-Level: X-Spam-Status: No, score=-1.098 tagged_above=-999 required=5 tests=[AWL=-0.661, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8t8FSFmfQiDV; Wed, 27 Feb 2008 08:04:26 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 900803A6B0A; Wed, 27 Feb 2008 08:04:16 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7F9243A69D6 for ; Wed, 27 Feb 2008 08:04:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ses3ywMjQBRe for ; Wed, 27 Feb 2008 08:04:14 -0800 (PST) Received: from dog.tcb.net (dog.tcb.net [64.78.150.133]) by core3.amsl.com (Postfix) with ESMTP id 86B2128C191 for ; Wed, 27 Feb 2008 08:04:06 -0800 (PST) Received: by dog.tcb.net (Postfix, from userid 0) id 31B58268495; Wed, 27 Feb 2008 09:04:00 -0700 (MST) Received: from [192.168.1.7] (VDSL-151-118-152-122.DNVR.QWEST.NET [151.118.152.122]) (authenticated-user smtp) (TLSv1/SSLv3 AES128-SHA 128/128) by dog.tcb.net with SMTP; Wed, 27 Feb 2008 09:03:59 -0700 (MST) (envelope-from danny@tcb.net) X-Avenger: version=0.7.8; receiver=dog.tcb.net; client-ip=151.118.152.122; client-port=55977; syn-fingerprint=65535:56:1:64:M1316,N,W3,N,N,T,S; data-bytes=0 Message-Id: <0EEC5D84-9E40-48EB-9126-07BB0DBA76D8@tcb.net> From: Danny McPherson To: Barry Greene (bgreene) In-Reply-To: Mime-Version: 1.0 (Apple Message framework v919.2) Date: Wed, 27 Feb 2008 09:03:43 -0700 References: <47C4E38E.1070105@bogus.com> <47C58479.5050600@juniper.net> <9F3CB712-B504-47CE-8B98-3069CD5DC4E3@tcb.net> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 27, 2008, at 8:55 AM, Barry Greene (bgreene) wrote: > > Recommending policy is not the core problem. If you look at the way we > train people at our operations meetings (mainly Phillip Smith's > materials) you will see that we - the community - has been pounding on > prefix filter BCPs over and over again. > > So IMHO - being one of the people who has been doing the pounding and > producing the materials - I do see how yet another document will > make a > difference. "IETF BCPs" don't mean anything - cause the IETF BCP > process > is broken. I've done a bit of pounding and ISP policy specification at several ISPs over the years myself, and I believe that the IETF BCP process sucks less than pretty much any other available option. -danny _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 08:16:43 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CA7383A6E20; Wed, 27 Feb 2008 08:16:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.053 X-Spam-Level: X-Spam-Status: No, score=-1.053 tagged_above=-999 required=5 tests=[AWL=-0.616, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uur7cLjvPKnr; Wed, 27 Feb 2008 08:16:43 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7CF8828C7F6; Wed, 27 Feb 2008 08:16:38 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F24B128C3C1 for ; Wed, 27 Feb 2008 08:16:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aAqJSd8RxN+3 for ; Wed, 27 Feb 2008 08:16:31 -0800 (PST) Received: from linuxbox.org (linuxbox.org [24.155.83.21]) by core3.amsl.com (Postfix) with ESMTP id 1CFD528C7D2 for ; Wed, 27 Feb 2008 08:16:31 -0800 (PST) Received: from linuxbox.org (ge@localhost [127.0.0.1]) by linuxbox.org (8.13.8/8.13.8/Debian-3) with ESMTP id m1RGIJIi014016 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 27 Feb 2008 10:18:19 -0600 Received: from localhost (ge@localhost) by linuxbox.org (8.13.8/8.13.8/Submit) with ESMTP id m1RGIJ02014013; Wed, 27 Feb 2008 10:18:19 -0600 Date: Wed, 27 Feb 2008 10:18:18 -0600 (CST) From: Gadi Evron To: Danny McPherson In-Reply-To: <0EEC5D84-9E40-48EB-9126-07BB0DBA76D8@tcb.net> Message-ID: References: <47C4E38E.1070105@bogus.com> <47C58479.5050600@juniper.net> <9F3CB712-B504-47CE-8B98-3069CD5DC4E3@tcb.net> <0EEC5D84-9E40-48EB-9126-07BB0DBA76D8@tcb.net> MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-1.7.5 (linuxbox.org [127.0.0.1]); Wed, 27 Feb 2008 10:18:19 -0600 (CST) Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Wed, 27 Feb 2008, Danny McPherson wrote: > > On Feb 27, 2008, at 8:55 AM, Barry Greene (bgreene) wrote: >> >> Recommending policy is not the core problem. If you look at the way we >> train people at our operations meetings (mainly Phillip Smith's >> materials) you will see that we - the community - has been pounding on >> prefix filter BCPs over and over again. >> >> So IMHO - being one of the people who has been doing the pounding and >> producing the materials - I do see how yet another document will >> make a >> difference. "IETF BCPs" don't mean anything - cause the IETF BCP >> process >> is broken. > > I've done a bit of pounding and ISP policy specification at several > ISPs over the years myself, and I believe that the IETF BCP process > sucks less than pretty much any other available option. As long as Danny is willing to spend the time, I don't see why the effort should be discourages. Whatever the result of this being written, I see no bad coming of this. I await the initial fruits of his work. Gadi. > > -danny > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 11:21:05 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 008A128C1AA; Wed, 27 Feb 2008 11:21:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.517 X-Spam-Level: X-Spam-Status: No, score=-1.517 tagged_above=-999 required=5 tests=[AWL=-1.081, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pYGGzZtn5kXs; Wed, 27 Feb 2008 11:21:04 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 260B23A6C6B; Wed, 27 Feb 2008 11:21:04 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8F3F428C40E for ; Wed, 27 Feb 2008 11:21:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XIs7bkZLtU89 for ; Wed, 27 Feb 2008 11:21:01 -0800 (PST) Received: from outbound-mail.vgs.untd.com (outbound-mail.vgs.untd.com [64.136.55.15]) by core3.amsl.com (Postfix) with SMTP id CAD9928C3A0 for ; Wed, 27 Feb 2008 11:21:01 -0800 (PST) Received: from outbound-bu1.vgs.untd.com (webmail06.vgs.untd.com [10.181.12.146]) by smtpout04.vgs.untd.com with SMTP id AABD6MP97ACG4DWA for (sender ); Wed, 27 Feb 2008 11:20:29 -0800 (PST) X-UNTD-OriginStamp: AcganUYbgVGZ0C6nm/9IPTVLjxkSbAuF4xT60oc+d2XDC/MdmZY9UQ== Received: (from fergdawg@netzero.net) by webmail06.vgs.untd.com (jqueuemail) id NCYUF5KF; Wed, 27 Feb 2008 11:20:07 PST Received: from [168.61.10.142] by webmail06.vgs.untd.com with HTTP: Wed, 27 Feb 2008 19:18:47 GMT X-Originating-IP: [168.61.10.142] Mime-Version: 1.0 From: "Paul Ferguson" Date: Wed, 27 Feb 2008 19:18:47 GMT To: rbonica@juniper.net X-Mailer: Webmail Version 4.0 Message-Id: <20080227.111847.6641.1@webmail06.vgs.untd.com> Content-Disposition: inline X-ContentStamp: 10:5:835840970 X-MAIL-INFO: 26659d7d64859d85659065c92951540909d11d9109c4502924d5f414b984849dbdd4cd7d X-UNTD-Peer-Info: 10.181.12.146|webmail06.vgs.untd.com|outbound-bu1.vgs.untd.com|fergdawg@netzero.net Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Ron Bonica wrote: >I think that it would helpful if this working group were to produce a >document (or two) recommending BGP policy for ISP. If you do decide to do this, please engage people in the operational community. Please. Over on the NANOG list, as many of you are probably already aware, this issue is one that has been highlighted on several ocassions -- the fact that appropriate RFCs and BCPs exist to address specific operational issues, yet many ISPs choose to ignore them or are simply ignorant of them. Separate problems, but certainly there is a lesson to be learned here: the operational community has long known that filtering downstream/customer ASs for prefix announcements is a Good Thing, yet the majority of ISPs on the planet simply do not do it... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHxbeVq1pz9mNUZTMRAnsRAJ4ugSnmh8m/9W6s6nVFrITMP55ziACgxmb8 YdUCHYvWrodg4D/xOOW7V0M= =A4Ox -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 13:46:25 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C507428C3A3; Wed, 27 Feb 2008 13:46:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.274 X-Spam-Level: X-Spam-Status: No, score=-1.274 tagged_above=-999 required=5 tests=[AWL=-0.837, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Be1zkgg9KUAn; Wed, 27 Feb 2008 13:46:20 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2E1C528C2B7; Wed, 27 Feb 2008 13:46:20 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0F3CE28C2B7 for ; Wed, 27 Feb 2008 13:46:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WscG5RC+lEQO for ; Wed, 27 Feb 2008 13:46:13 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by core3.amsl.com (Postfix) with ESMTP id C1BF03A6938 for ; Wed, 27 Feb 2008 13:46:08 -0800 (PST) Received: from [192.103.16.246] ([192.103.16.246]) (authenticated bits=0) by nagasaki.bogus.com (8.14.1/8.13.8) with ESMTP id m1RLjx1V021862; Wed, 27 Feb 2008 21:45:59 GMT (envelope-from joelja@bogus.com) Message-ID: <47C5DA07.5060005@bogus.com> Date: Wed, 27 Feb 2008 13:45:43 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: "Barry Greene (bgreene)" References: <47C4E38E.1070105@bogus.com> <47C58479.5050600@juniper.net> <9F3CB712-B504-47CE-8B98-3069CD5DC4E3@tcb.net> In-Reply-To: X-Enigmail-Version: 0.95.6 X-Virus-Scanned: ClamAV 0.92.1/6013/Wed Feb 27 20:07:32 2008 on nagasaki.bogus.com X-Virus-Status: Clean Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Barry Greene (bgreene) wrote: > > > Recommending policy is not the core problem. If you look at the way we > train people at our operations meetings (mainly Phillip Smith's > materials) you will see that we - the community - has been pounding on > prefix filter BCPs over and over again. > > So IMHO - being one of the people who has been doing the pounding and > producing the materials - I do see how yet another document will make a > difference. "IETF BCPs" don't mean anything - cause the IETF BCP process > is broken. > > What we need is to rethink how we are doing the training at the > operations meetings and how we - as a community - are investing ($$$) in > our open source tools. So, I do some training, in workshops, sometimes with Phil and sometimes with other crews and I think in that context that bcp's are a useful framework to hang instructional material on. They aren't a panacea by any means. We might consider re-exporting the sort of training we do in nogs in emerging markets back to north america and europe, but frankly there's a lot more people to train here and I think the market needs to drive that otherwise we won't come close to reaching enough operators... I think collectively we're in a rather unique position to: A. produce documents which are cogent and useful B. drive that into instructional materials that get used in network operator trainings. > > >> -----Original Message----- >> From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] >> On Behalf Of Danny McPherson >> Sent: Wednesday, February 27, 2008 7:49 AM >> To: Ron Bonica >> Cc: opsec wg mailing list >> Subject: Re: [OPSEC] pccw as17557 leak... > > >> On Feb 27, 2008, at 8:40 AM, Ron Bonica wrote: > >>> Folks, >>> >>> I think that it would helpful if this working group were to >> produce a >>> document (or two) recommending BGP policy for ISP. >> I mentioned to Joel off list, and the GROW chairs, I'm >> hacking up a boiler for this now. > >> -danny >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 17:13:11 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4424A3A6E49; Wed, 27 Feb 2008 17:13:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.638 X-Spam-Level: X-Spam-Status: No, score=-0.638 tagged_above=-999 required=5 tests=[AWL=-0.201, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sh+B+x+vIFVU; Wed, 27 Feb 2008 17:13:05 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D8E0228C8BE; Wed, 27 Feb 2008 17:13:03 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B4A583A6C4A for ; Wed, 27 Feb 2008 17:13:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IvCWGADVI2km for ; Wed, 27 Feb 2008 17:12:56 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.173]) by core3.amsl.com (Postfix) with ESMTP id 407D33A6E40 for ; Wed, 27 Feb 2008 17:12:55 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so2651114wfa.31 for ; Wed, 27 Feb 2008 17:12:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=OvBdXznEMPmQihVDyU7dtu2tMuIEhDMbZqo1PQE5IHc=; b=MwyEcwmE0zaFmDVfhKiXtsHTkZz4f+V2jqtZDFAOLXxgtHo8Qa38IEaeGWVw+s4l7sKwh2QABcmdwgtTMjtpXMpVNsfwJCS4E3FrO4QP4fxrd6Emyxf4JP2S27MSYMapxzC53h7gr/fBRvbTTZe05RJh9B0NI5fjs+do/UpmFcY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=wF65KmqsjkLaNIx9pNK2edKP6eMjmand0maJ/gc4C3dQYeiR79jrJsY/gi/vXTexGyzAwFFWlHkdZnD50xuF0wHjv+d6FHnMhJ6ciN8HByZmFZ1sDMDuFvytzJ2P+l+++O8B5C2/crRZluyslPFmBzbOI2sxkw+lYtV8XZRNyF4= Received: by 10.142.188.4 with SMTP id l4mr5957720wff.183.1204161169298; Wed, 27 Feb 2008 17:12:49 -0800 (PST) Received: by 10.143.164.14 with HTTP; Wed, 27 Feb 2008 17:12:49 -0800 (PST) Message-ID: <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> Date: Wed, 27 Feb 2008 17:12:49 -0800 From: "Vishwas Manral" To: "Roland Dobbins" In-Reply-To: <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> Cc: opsec wg mailing list , Stephen Kent Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi folks, I looked at the SIDR documents in brief. It can probably be used to help prevent any attacks caused due to non-malicious intent. I found easy ways to get over the SIDR security when done with a malicious intent. SIDR just tells the mapping between AFI, AF and AS number which can originate the same. However the choosing of a route by BGP does not depend on these fields alone. So if a malicious router changed the attributes attached to an NLRI update so that it becomes the chosen AS to the prefix (of course without changing the originating AS field). It can still redirect all the traffic to itself for the prefix and then do whatever malicious it wants to do, including just drop the packet. In this way still achieving the attack, but this time for sure with malicious intent. Thanks, Vishwas On Tue, Feb 26, 2008 at 11:00 PM, Roland Dobbins wrote: > > On Feb 27, 2008, at 1:56 PM, Danny McPherson wrote: > > > See: RIPE-181, RPSL, SIDR > > Yes, I forgot SIDR - good point, Danny & Pekka. > > > > ----------------------------------------------------------------------- > Roland Dobbins // +66.83.266.6344 mobile > > If you don't know what to do, it's harder to do it. > > -- Malcom Forbes > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 19:13:41 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AEA9A3A6E59; Wed, 27 Feb 2008 19:13:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.281 X-Spam-Level: X-Spam-Status: No, score=-3.281 tagged_above=-999 required=5 tests=[AWL=-2.844, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 81e-ZsS4zQYg; Wed, 27 Feb 2008 19:13:36 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8CB3A3A6E68; Wed, 27 Feb 2008 19:13:34 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EBE9C3A6E68 for ; Wed, 27 Feb 2008 19:13:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jXZFPNsQHNjP for ; Wed, 27 Feb 2008 19:13:33 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id 3FFAF3A6E4B for ; Wed, 27 Feb 2008 19:12:19 -0800 (PST) Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 08:42:11 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m1S3CAT8030453 for ; Thu, 28 Feb 2008 11:12:10 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1S3C63j006254 for ; Thu, 28 Feb 2008 03:12:10 GMT Message-Id: <5474B131-D6A2-4F78-958E-1B45DC07DEBC@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 10:12:05 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=366; t=1204168330; x=1205032330; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=wDFEmRLCY4w8kvlNyBsZHjkSEC+iCZFazX6+PPIFzi4=; b=GFwIV7GrVU/QTixgl6V+VinH8y6iKJIffugWcXSjcCvC5Hyi36FgFI0X7e g/OKpUjVFMxKFKUY/aR0H36apGjpCcP/oHyL3yKAwuBPLLSrHw+9nJjUnxqn Axs4UsCeF6WLcPHuwPBHSVISE/fzfFBE9kBsF3nPar2VMzuRLv9j8=; Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 28, 2008, at 10:07 AM, Stephen Kent wrote: > I think the SIDR WG participants understand that. Yes, they do. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 19:14:07 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A50713A6E5D; Wed, 27 Feb 2008 19:14:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.635 X-Spam-Level: X-Spam-Status: No, score=-0.635 tagged_above=-999 required=5 tests=[AWL=-0.198, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K3LEwy-cywn6; Wed, 27 Feb 2008 19:14:02 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 19C9E3A6E5E; Wed, 27 Feb 2008 19:14:02 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 771373A6E67 for ; Wed, 27 Feb 2008 19:14:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4zqSKO5ec3cy for ; Wed, 27 Feb 2008 19:13:59 -0800 (PST) Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.176]) by core3.amsl.com (Postfix) with ESMTP id C24073A6E59 for ; Wed, 27 Feb 2008 19:13:59 -0800 (PST) Received: by wa-out-1112.google.com with SMTP id k40so4829625wah.25 for ; Wed, 27 Feb 2008 19:13:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=XmHSrIowFy4iQ+ksOb/Xsn+DxKXfiXfiakhxIjz3JPk=; b=YUBi9CvZ1SmNk1Ui/W0xRan2LekpyRrF923Z4f2fBBUEICa2aYWvrae6Rla76Oj7r/DCOleoo7QlLxjgiFlopmUXjWPJ6KnsWH93WzrRldsfNq7zw39Fe4VXjarK8pyPLe9Jng9GwQqvcBDnpoN5GcvhqXUlcGIU4FlDkDRGuD4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=PTUxv4Zshpo1TWAKSsTMQ29WQGT3h6qn94VV0etrRAO83X07HmQWDuI2Y88O4WFS0aR4pORe4fi9Ri0JkxcPgrYODsR8TL8OMzlkrb/EyC9fZGZuz79ZFdFcLr063lFQyrdIUXWk64kC1rryHmpYdYFwYb4dt1hQPxoUVmkCQpc= Received: by 10.115.47.1 with SMTP id z1mr8508213waj.117.1204168433040; Wed, 27 Feb 2008 19:13:53 -0800 (PST) Received: by 10.114.241.4 with HTTP; Wed, 27 Feb 2008 19:13:52 -0800 (PST) Message-ID: <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> Date: Wed, 27 Feb 2008 19:13:52 -0800 From: "Vishwas Manral" To: "Stephen Kent" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Steve, Thanks a lot for the comments. I agree it can be a good first step but not sure what the future holds. I am not sure if a heavy solution like this is required which only gives reasonable security. What about the CPU DoS attacks that can be result when new random routes are injected into a domain. Thanks again, Vishwas On Wed, Feb 27, 2008 at 7:07 PM, Stephen Kent wrote: > At 5:12 PM -0800 2/27/08, Vishwas Manral wrote: > >Hi folks, > > > >I looked at the SIDR documents in brief. It can probably be used to > >help prevent any attacks caused due to non-malicious intent. > > > >I found easy ways to get over the SIDR security when done with a > >malicious intent. SIDR just tells the mapping between AFI, AF and AS > >number which can originate the same. However the choosing of a route > >by BGP does not depend on these fields alone. So if a malicious router > >changed the attributes attached to an NLRI update so that it becomes > >the chosen AS to the prefix (of course without changing the > >originating AS field). It can still redirect all the traffic to itself > >for the prefix and then do whatever malicious it wants to do, > >including just drop the packet. > > > >In this way still achieving the attack, but this time for sure with > >malicious intent. > > > >Thanks, > >Vishwas > > > Your example of how an AS can tamper with a route, without changing > the origin AS assertion is correct. I think the SIDR WG participants > understand that. > The work so far i SIDR focuses on establishing an infrastructure that > will enable more comprehensive routing security capabilities in the > future. Both the soBGP and SBGP proposal need this sort of > infrastructure, so it is viewed as a reasonable initial effort. > > I also agree with your observation that the infrastructure makes it > potentially easier to distinguish between some forms of attacks vs. > accidental routing errors, and that, in itself, seems valuable too. > > Steve > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 19:18:51 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4631728C535; Wed, 27 Feb 2008 19:18:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.793 X-Spam-Level: X-Spam-Status: No, score=-2.793 tagged_above=-999 required=5 tests=[AWL=-2.356, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xWDjwOWo7E36; Wed, 27 Feb 2008 19:18:50 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 608AE3A6E59; Wed, 27 Feb 2008 19:18:50 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F339B3A68CB for ; Wed, 27 Feb 2008 19:18:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xSyZmvvwGHUC for ; Wed, 27 Feb 2008 19:18:43 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id 3AC283A6E4B for ; Wed, 27 Feb 2008 19:18:42 -0800 (PST) Received: from hkg-dkim-2.cisco.com ([10.75.231.163]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 08:48:35 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m1S3IYJU031774 for ; Thu, 28 Feb 2008 11:18:34 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1S3IQ3j007571 for ; Thu, 28 Feb 2008 03:18:31 GMT Message-Id: <292F61FC-6897-4C67-A225-975C97C02087@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 10:18:25 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=652; t=1204168714; x=1205032714; c=relaxed/simple; s=hkgdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=Iz7TNR5xtIr0F3OgnlLJ3gPlv/m6mzH2VrjzmZ9AjQc=; b=TfYLxQdHWKKKH+vI5Jm3ToDsjy7n7tk3sWbftJH2aglyh2NA9aW/VaP+uc fjx02X+gwyZfi3dJc8QNeJsu64iAnCoYdpFCe8LVMPYBzmEsobTzn4FkRbKx MBwxAgFa91dMWw9a0tGdDJmXXQDfygWnIffQQgCT7vC2M5qWiNm5Y=; Authentication-Results: hkg-dkim-2; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim2001 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 28, 2008, at 10:13 AM, Vishwas Manral wrote: > What about the CPU DoS attacks that can be result when new random > routes are injected into a domain. This is a different set of issues handled via different mechanisms, some of which exist today in routers from various vendors, and which are implemented by operators. We have to limit the scope, or we'll never get anything done, heh. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 20:05:48 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6898E3A6AE8; Wed, 27 Feb 2008 20:05:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.633 X-Spam-Level: X-Spam-Status: No, score=-0.633 tagged_above=-999 required=5 tests=[AWL=-0.196, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nhhT-tZJ9GvR; Wed, 27 Feb 2008 20:05:47 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8AA5E3A6E6B; Wed, 27 Feb 2008 20:05:47 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0274B3A6E65 for ; Wed, 27 Feb 2008 20:05:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MV59ko4Xls-1 for ; Wed, 27 Feb 2008 20:05:45 -0800 (PST) Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.180]) by core3.amsl.com (Postfix) with ESMTP id 33DF13A6E5F for ; Wed, 27 Feb 2008 20:05:44 -0800 (PST) Received: by wa-out-1112.google.com with SMTP id k40so4857008wah.25 for ; Wed, 27 Feb 2008 20:05:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=WsYsUp4Lc7q4guRKD8UHBC8crHEs3/6POYB1v6C9KuE=; b=PHog3iFzCucJ01NNIDXYgTar3jn3cLSmRf7nQS8NFs6nCbgarVVL+Lye8vR32fHbAkMCCfBdDhzVzMr+TYUDxN/G37ntyiz+XQo0wBWJ9RRzRBIMdRs/JYgCL2TCH35+NAFtPhz6KxvXnirnBCeHEIbl2FBndvonvmEfeT1E5MM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=XyBkS6hfOJFjhHbQG67UV3QDFj4knSszjxViMgxCnBPcK0C6Wcz4ZBblK7biBuud0fibNJjZEZ9yKQqzOok1m+DcEji5ff1705/2AiIATuhM34yNHaB8bi3NK/ItkXxATc+qQHIy4YVivFqkgCGY1BYItiZUQBxPhcfqRnIZ3GA= Received: by 10.114.191.1 with SMTP id o1mr8564296waf.66.1204171538238; Wed, 27 Feb 2008 20:05:38 -0800 (PST) Received: by 10.114.241.4 with HTTP; Wed, 27 Feb 2008 20:05:38 -0800 (PST) Message-ID: <77ead0ec0802272005w40c90bb0x7820c203114bf92d@mail.gmail.com> Date: Wed, 27 Feb 2008 20:05:38 -0800 From: "Vishwas Manral" To: "Roland Dobbins" In-Reply-To: <292F61FC-6897-4C67-A225-975C97C02087@cisco.com> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <292F61FC-6897-4C67-A225-975C97C02087@cisco.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Roland, I looked at soBGP and it is also just checking the origin. The origin is not of much use in a malicious router case at all. I have another similar solution, but may help in more than just non malicious case. Thanks, Vishwas On Wed, Feb 27, 2008 at 7:18 PM, Roland Dobbins wrote: > > On Feb 28, 2008, at 10:13 AM, Vishwas Manral wrote: > > > What about the CPU DoS attacks that can be result when new random > > routes are injected into a domain. > > This is a different set of issues handled via different mechanisms, > some of which exist today in routers from various vendors, and which > are implemented by operators. We have to limit the scope, or we'll > never get anything done, heh. > > > > ----------------------------------------------------------------------- > Roland Dobbins // +66.83.266.6344 mobile > > If you don't know what to do, it's harder to do it. > > -- Malcom Forbes > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 20:15:17 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A35E628C7E9; Wed, 27 Feb 2008 20:15:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.398 X-Spam-Level: X-Spam-Status: No, score=-2.398 tagged_above=-999 required=5 tests=[AWL=-1.961, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2tcJkYVRWrUq; Wed, 27 Feb 2008 20:15:17 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C4AF428C8F2; Wed, 27 Feb 2008 20:14:51 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C2C5A28C8E1 for ; Wed, 27 Feb 2008 20:14:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tNvtJ7WO42Qd for ; Wed, 27 Feb 2008 20:14:45 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id D35BC28C881 for ; Wed, 27 Feb 2008 20:14:33 -0800 (PST) Received: from hkg-dkim-2.cisco.com ([10.75.231.163]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 09:44:23 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m1S4EN07009429 for ; Thu, 28 Feb 2008 12:14:23 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1S4EH3j019631 for ; Thu, 28 Feb 2008 04:14:21 GMT Message-Id: <86D47389-20CF-4573-809A-426474E23B40@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0802272005w40c90bb0x7820c203114bf92d@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 11:14:15 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <292F61FC-6897-4C67-A225-975C97C02087@cisco.com> <77ead0ec0802272005w40c90bb0x7820c203114bf92d@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=930; t=1204172063; x=1205036063; c=relaxed/simple; s=hkgdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=Z3DZVytuDRBe/oPHmu0/LFhotSRY8RQNlclUlt8Sa60=; b=rEp02NwpqRheN3zusMmIU389+0+v3CVZG31zya0OkLhye5qfrFQ0pqmpN2 FRV635gA5vfYda2sXphQzs2evhJbAWnN8KAzk3zteHChLIA/D/vKYrJgn0aP 7wrothkWXySGHeHkTTlbbJtv5wcxBGWhteUQfClVnovpkOpP8wnYA=; Authentication-Results: hkg-dkim-2; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim2001 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 28, 2008, at 11:05 AM, Vishwas Manral wrote: > I looked at soBGP and it is also just checking the origin. The origin > is not of much use in a malicious router case at all. I'm aware of that, Vishwas. And as I indicated, that's a different problem. There is a lot of history and operational art in this arena - we aren't all just sitting around waiting for security clue to fall from the sky, heh. I strongly recommend acquainting oneself with the full scope of the issues as well as the history of discussions and initiatives, so as to avoid re-discussing the invention of the wheel. ;> A good place to start is the latest ref of the opsec draft. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 20:33:51 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C452528C62B; Wed, 27 Feb 2008 20:33:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.633 X-Spam-Level: X-Spam-Status: No, score=-0.633 tagged_above=-999 required=5 tests=[AWL=-0.196, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3baeiogLazqY; Wed, 27 Feb 2008 20:33:50 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0EE5F28C866; Wed, 27 Feb 2008 20:32:48 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AEA0328C771 for ; Wed, 27 Feb 2008 20:32:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ou-hoUriaQwk for ; Wed, 27 Feb 2008 20:32:46 -0800 (PST) Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.178]) by core3.amsl.com (Postfix) with ESMTP id C63FB28C9B0 for ; Wed, 27 Feb 2008 20:31:22 -0800 (PST) Received: by wa-out-1112.google.com with SMTP id k40so4870606wah.25 for ; Wed, 27 Feb 2008 20:31:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=XGdUHQRKILfbiBdB7u8fyPLzBHAHGPBrxWwhX7oXq+s=; b=lVMdUAJd2sI7dSeBTrylcMhgjQf5YYEJ6ZG0evM7fD7m33/uRXIRK2x2W+71hfxbtkPnA7sNPeU9biE1F4q4dv2sjKECCQ+NLifZ5DZ6Ffc2LOn7iAIfrJWel+ZqeVLdxc5H+XMCEjwrwjo1eVCK1a2YzlH0FAjLN4uiHUOTnxw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=H6h09xxJyMo0QaUN5n4Yv9eFZBvwEcKUEINpI5OTdM4aYRnYQXZe4LEzo56F7chlMYOS9JVMrNAldq7C5dvJMplVEpauweZkU77ooZu3bwvQLlXmhCkCBwc47/K04dvcjnnFvye5vUeteBSCYAQKoK956gGftQ6LNJpKmLjw3QU= Received: by 10.115.94.1 with SMTP id w1mr64997wal.85.1204173076192; Wed, 27 Feb 2008 20:31:16 -0800 (PST) Received: by 10.114.241.4 with HTTP; Wed, 27 Feb 2008 20:31:16 -0800 (PST) Message-ID: <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> Date: Wed, 27 Feb 2008 20:31:16 -0800 From: "Vishwas Manral" To: "Stephen Kent" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Stephen, The point I raise is that there is a cost associated with this, using certificates has a CPU cost associated with it. I may be missing the point but even if you leave aside the cost of an off line server to do this check but if the checks are done on each new prefix we can still overload the off line server. If we do things like rate limiting we can still have an attacks, or cause delays in the convergence times. Thanks, Vishwas On Wed, Feb 27, 2008 at 8:13 PM, Stephen Kent wrote: > At 7:13 PM -0800 2/27/08, Vishwas Manral wrote: > >Hi Steve, > > > >Thanks a lot for the comments. I agree it can be a good first step but > >not sure what the future holds. > > > >I am not sure if a heavy solution like this is required which only > >gives reasonable security. What about the CPU DoS attacks that can be > >result when new random routes are injected into a domain. > > > >Thanks again, > >Vishwas > > > > Vishwas, > > The current SIDR plans for use of this infrastructure calls for ISPs > to download the certs, CRLs, ROAs, etc. on a daily basis, to process > them offline, and to use the results in constructing route filters. > Even the more comprehensive models offered by SBGP and soBGP did not > require routers to process certs, CRLs, etc., i.e., they assume > offline processing to verify signed objects and pass the results to > routers to use in route verification. > > Give this background, I don't know what sort of CPU DoS attacks you > are worried about. Could you provide some additional context? > > Steve > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 20:34:08 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A95013A6E5B; Wed, 27 Feb 2008 20:34:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.286 X-Spam-Level: X-Spam-Status: No, score=-2.286 tagged_above=-999 required=5 tests=[AWL=-1.849, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nMflAtvS6PlK; Wed, 27 Feb 2008 20:34:07 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 25AED28C535; Wed, 27 Feb 2008 20:34:06 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 335A028C288 for ; Wed, 27 Feb 2008 20:34:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GfX+RVLqYld7 for ; Wed, 27 Feb 2008 20:34:04 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id 5AD4828C838 for ; Wed, 27 Feb 2008 20:33:57 -0800 (PST) Received: from hkg-dkim-2.cisco.com ([10.75.231.163]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 10:03:50 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m1S4Xm2A012916 for ; Thu, 28 Feb 2008 12:33:48 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1S4Xl3j023624 for ; Thu, 28 Feb 2008 04:33:47 GMT Message-Id: <843CE291-5786-4D32-BBCF-070B43E8274F@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 11:33:46 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=638; t=1204173228; x=1205037228; c=relaxed/simple; s=hkgdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=rHGnu2Vrjhf1xvxGi96/hixre2E75mY+a2eCdLpakvk=; b=sr6qGHuhAWlkIJj6lpVuogk4VZKPgVU9B8bosaLVB7wqtlq0pO1o330SZU +czgSwnKA7UrMWXt6tTZgcOc5FRLwmIMO2IP46NcIvGF44lBypBejYB3F82F 9cG13KD8gZPMn6gQ63pQbCJbUJVDt9T33mflMAvd8KC8ugyIXmheA=; Authentication-Results: hkg-dkim-2; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim2001 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 28, 2008, at 11:31 AM, Vishwas Manral wrote: > If we do things > like rate limiting we can still have an attacks, or cause delays in > the convergence times. You are correct - certs and sigs and PSKs and PKI and encryption and so forth aren't free, and the numerous people who have been looking at this problem-set for a long time are very aware of these issues, FYI. ;> ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 20:38:30 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6FEF63A69EA; Wed, 27 Feb 2008 20:38:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.628 X-Spam-Level: X-Spam-Status: No, score=-0.628 tagged_above=-999 required=5 tests=[AWL=-0.191, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ndHoRS2ufN8M; Wed, 27 Feb 2008 20:38:28 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B170C3A68D1; Wed, 27 Feb 2008 20:38:28 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 396333A68D1 for ; Wed, 27 Feb 2008 20:38:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nptt0wqzF9Ql for ; Wed, 27 Feb 2008 20:38:26 -0800 (PST) Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.179]) by core3.amsl.com (Postfix) with ESMTP id 4F88C28C50F for ; Wed, 27 Feb 2008 20:37:55 -0800 (PST) Received: by wa-out-1112.google.com with SMTP id k40so4873923wah.25 for ; Wed, 27 Feb 2008 20:37:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=gkCnOjnZsDoQw2lpf+RiyUTNSmVMPYI3RpvYHCcXhDE=; b=E6Vd0nDfsR5FOz4lE9vtYgKatBO0BPijJsIkqYAdTfOSEh1fgDzJj4G4AFCHmhq9egTYZY5kTbCPYMhncKbCF5W/uKhhHu2R+HsFhAoL2uUN9NKhF60X8448V7XXHAqdh6xvB2hBBvoVC0DARORy3eVt2SqRvXXr8zIlYtKX1Fc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=cqpqMlXwtQ6gmOHc8IZPdJFWweOXLUhCDNaejc/zYFdT4YNt1e9vknf55cPQcrKPP1LW1Z7RGqwl9M8sxPnIJAJBBALJTOPZbq8nOrfrBrMeH2nSw3dL5plVvxtR52xD92HkIzEeEa/xRb8FAeO7mjOyG66GvuSwxj988ecPCpY= Received: by 10.114.201.1 with SMTP id y1mr8597849waf.121.1204173468677; Wed, 27 Feb 2008 20:37:48 -0800 (PST) Received: by 10.114.241.4 with HTTP; Wed, 27 Feb 2008 20:37:48 -0800 (PST) Message-ID: <77ead0ec0802272037o45e89831r3f957fc0e0cc9872@mail.gmail.com> Date: Wed, 27 Feb 2008 20:37:48 -0800 From: "Vishwas Manral" To: "Roland Dobbins" In-Reply-To: <86D47389-20CF-4573-809A-426474E23B40@cisco.com> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <292F61FC-6897-4C67-A225-975C97C02087@cisco.com> <77ead0ec0802272005w40c90bb0x7820c203114bf92d@mail.gmail.com> <86D47389-20CF-4573-809A-426474E23B40@cisco.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Roland, I looked at the 3 drafts in the OPSEC group (for one of which I am the coauthor). I could not find any draft referring to BGP. Could you let me know which draft you refer to? Thanks, Vishwas On Wed, Feb 27, 2008 at 8:14 PM, Roland Dobbins wrote: > > On Feb 28, 2008, at 11:05 AM, Vishwas Manral wrote: > > > I looked at soBGP and it is also just checking the origin. The origin > > is not of much use in a malicious router case at all. > > I'm aware of that, Vishwas. And as I indicated, that's a different > problem. > > There is a lot of history and operational art in this arena - we > aren't all just sitting around waiting for security clue to fall from > the sky, heh. I strongly recommend acquainting oneself with the full > scope of the issues as well as the history of discussions and > initiatives, so as to avoid re-discussing the invention of the wheel. > > ;> > > A good place to start is the latest ref of the opsec draft. > > > > ----------------------------------------------------------------------- > Roland Dobbins // +66.83.266.6344 mobile > > If you don't know what to do, it's harder to do it. > > -- Malcom Forbes > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 20:51:24 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D94AB3A6E7C; Wed, 27 Feb 2008 20:51:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.845 X-Spam-Level: X-Spam-Status: No, score=-1.845 tagged_above=-999 required=5 tests=[AWL=-1.408, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HQfhtcrTIM+d; Wed, 27 Feb 2008 20:51:19 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 681D03A6E72; Wed, 27 Feb 2008 20:51:19 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8EE313A67EB for ; Wed, 27 Feb 2008 20:51:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UNwKbbS1AbWK for ; Wed, 27 Feb 2008 20:51:12 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id C1E9A3A6C5D for ; Wed, 27 Feb 2008 20:51:11 -0800 (PST) Received: from hkg-dkim-2.cisco.com ([10.75.231.163]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 10:21:02 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m1S4p19r016032 for ; Thu, 28 Feb 2008 12:51:01 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1S4or3j027129 for ; Thu, 28 Feb 2008 04:50:59 GMT Message-Id: From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0802272037o45e89831r3f957fc0e0cc9872@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 11:50:52 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <292F61FC-6897-4C67-A225-975C97C02087@cisco.com> <77ead0ec0802272005w40c90bb0x7820c203114bf92d@mail.gmail.com> <86D47389-20CF-4573-809A-426474E23B40@cisco.com> <77ead0ec0802272037o45e89831r3f957fc0e0cc9872@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1046; t=1204174261; x=1205038261; c=relaxed/simple; s=hkgdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=qlN1C3iVjH02acH8Sim2HhkYhIlUz5lBC/h3TVK8//E=; b=WSek+mYPIn0z51gvhJJULJLB08KzPvSg06End2qxkQ09B/K45ZB5r+9Tq2 q+o6XnYKFTaEgMhI0Nd/NigbFQXVv0nrGk1vRZi2JBecG7Too98Hbl0AngEI ASVEFcT/g1xe1NdO/+GgTVeHvfw6MrcbUZIvk0p+fwlBK0AfSs1U4=; Authentication-Results: hkg-dkim-2; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim2001 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 28, 2008, at 11:37 AM, Vishwas Manral wrote: > Could you let me know which draft you refer to? I'm not just referring to BGP specifically, but rather to the classes of problems you seem to think that nobody else is aware of or understands, but which in fact are well-understood by the operational community and have been for some time, heh. Here are some examples: draft-ietf-opsec-filter-caps, of which you're a co-author, is yet another example. As Paul Ferguson indicated, these issues have been discussed on nanog- l and on various vendor-focused operational lists, as well. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 20:58:32 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7248B3A6E84; Wed, 27 Feb 2008 20:58:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.627 X-Spam-Level: X-Spam-Status: No, score=-0.627 tagged_above=-999 required=5 tests=[AWL=-0.190, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fk3sCENXc46x; Wed, 27 Feb 2008 20:58:26 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EC9CC3A6955; Wed, 27 Feb 2008 20:58:26 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5AB493A6955 for ; Wed, 27 Feb 2008 20:58:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TDvAoQVWDVK5 for ; Wed, 27 Feb 2008 20:58:24 -0800 (PST) Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.178]) by core3.amsl.com (Postfix) with ESMTP id F21723A6C5D for ; Wed, 27 Feb 2008 20:57:39 -0800 (PST) Received: by wa-out-1112.google.com with SMTP id k40so4884561wah.25 for ; Wed, 27 Feb 2008 20:57:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=m6FZSCLu1Jj87YtVMTSWm86/I24vODMK7mPUczDhJyU=; b=QlFFJtgfYtI6bO9YOLjXXzJB4lg+EhdKQRODae9u2EKHNdc8AHklFek70FP24nT42iCxS4RFu4fSz97ayWo1bca9AXzG9yZK0dBF35XAjNTeUqz0vTj/w2lO21S4H3rv0w1KMUMwVbH6Vd5ZOUPXyOu9reOgH0NRLYUxqy234gw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=qw8o1Rebihyb4wpTF0/Y8nqRrp6Dn4dI2VGf2qmY5+eySQeQNNelcuLiyYgisyo4WnoadWMsO2GpSWXzeI3b4uXYxaOHKslHZKnqPVXxng/SZSN5ZIiiUyAhFhsW9taDD714zme/WHG2A+u2J/53XnMxAtHGZM60+ZocvoVpGEA= Received: by 10.114.149.2 with SMTP id w2mr8625439wad.29.1204174653316; Wed, 27 Feb 2008 20:57:33 -0800 (PST) Received: by 10.114.241.4 with HTTP; Wed, 27 Feb 2008 20:57:33 -0800 (PST) Message-ID: <77ead0ec0802272057g5854ef17k9ce7561fa03fd43@mail.gmail.com> Date: Wed, 27 Feb 2008 20:57:33 -0800 From: "Vishwas Manral" To: "Roland Dobbins" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <292F61FC-6897-4C67-A225-975C97C02087@cisco.com> <77ead0ec0802272005w40c90bb0x7820c203114bf92d@mail.gmail.com> <86D47389-20CF-4573-809A-426474E23B40@cisco.com> <77ead0ec0802272037o45e89831r3f957fc0e0cc9872@mail.gmail.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Roland, I may be wrong but I think you may have missed the context. The point I raise is that with the SIDR infrastructure we get a way to catch some attacks, but a malicious attack still cannot be prevent, while having an overhead. The point I raise is is the trade-off between what we achieve versus the CPU overload a good one. You seem to refer to some generic documents. Thanks, Vishwas On Wed, Feb 27, 2008 at 8:50 PM, Roland Dobbins wrote: > > On Feb 28, 2008, at 11:37 AM, Vishwas Manral wrote: > > > Could you let me know which draft you refer to? > > I'm not just referring to BGP specifically, but rather to the classes > of problems you seem to think that nobody else is aware of or > understands, but which in fact are well-understood by the operational > community and have been for some time, heh. > > Here are some examples: > > > > > > > > draft-ietf-opsec-filter-caps, of which you're a co-author, is yet > another example. > > As Paul Ferguson indicated, these issues have been discussed on nanog- > l and on various vendor-focused operational lists, as well. > > > > ----------------------------------------------------------------------- > Roland Dobbins // +66.83.266.6344 mobile > > If you don't know what to do, it's harder to do it. > > -- Malcom Forbes > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 21:09:39 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E00F43A6EA0; Wed, 27 Feb 2008 21:09:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.714 X-Spam-Level: X-Spam-Status: No, score=-1.714 tagged_above=-999 required=5 tests=[AWL=-1.277, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dALjHbeAzIAQ; Wed, 27 Feb 2008 21:09:34 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 52D033A6BC1; Wed, 27 Feb 2008 21:09:34 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5409328C561 for ; Wed, 27 Feb 2008 21:09:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p0NmNFQFZ5Mn for ; Wed, 27 Feb 2008 21:09:32 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id D7E2F3A6E8E for ; Wed, 27 Feb 2008 21:09:29 -0800 (PST) Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 10:39:22 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m1S59Koa014571 for ; Thu, 28 Feb 2008 13:09:20 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1S59I3j000746 for ; Thu, 28 Feb 2008 05:09:19 GMT Message-Id: <5A02BC44-D7F5-4FA7-ABF8-295BE49C3952@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0802272057g5854ef17k9ce7561fa03fd43@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 12:09:17 +0700 References: <47C4E38E.1070105@bogus.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <292F61FC-6897-4C67-A225-975C97C02087@cisco.com> <77ead0ec0802272005w40c90bb0x7820c203114bf92d@mail.gmail.com> <86D47389-20CF-4573-809A-426474E23B40@cisco.com> <77ead0ec0802272037o45e89831r3f957fc0e0cc9872@mail.gmail.com> <77ead0ec0802272057g5854ef17k9ce7561fa03fd43@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1706; t=1204175360; x=1205039360; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=hvJNKBxbhlZl+2aXMIzuBDw2Z0LZVjProZjNmzUF2cc=; b=AFrKwzVaWAPID12gw/MPmoP6PiShvh0DzAS2mhwaeb4KDNb5zkyFstqpxw 8G0dkwSryTDLQT2UYtaOxEdBpMBhDcj+bexsOEYF09ZmeonncgLHSNkTvzc3 aLb+8eaxrPIr5W3W3UH5rnWypUqm+sxRnejT+RAByrjDf5TfZ15UE=; Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 28, 2008, at 11:57 AM, Vishwas Manral wrote: > The point I raise is that with the SIDR infrastructure we get a way to > catch some attacks, but a malicious attack still cannot be prevent, > while having an overhead. The point I raise is that everyone here understands that already. > The point I raise is is the trade-off between what we achieve versus > the CPU overload a good one. Again, I raise the point that everyone here understands that already, and, furthermore, that the point you raise regarding CPU spikes due to a flood of routing advertisements, etc., are well-understood by the operational community and are in fact addressed at least in part by existing features implemented in existing devices manufactured by various vendors and installed on operational networks. Whether or not operators make use of these features and techniques is another question, of course. > You seem to refer to some generic documents. Yes, in order to demonstrate that there is a long history of discourse in this arena, and that it isn't necessarily very productive to make the assumption that the participants in this WG are ignorant of the various classes of problems which must be addressed,. Also, advocating particular solutions or classes of solutions in absence of familiarity with the long history and current BCPs surrounding a given problem-set isn't necessarily very productive, either. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 21:16:30 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5B1053A6E62; Wed, 27 Feb 2008 21:16:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.59 X-Spam-Level: X-Spam-Status: No, score=-0.59 tagged_above=-999 required=5 tests=[AWL=-0.154, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k9DaBGFVJ72g; Wed, 27 Feb 2008 21:16:24 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CD4363A6A5F; Wed, 27 Feb 2008 21:16:24 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8D1C23A6A5F for ; Wed, 27 Feb 2008 21:16:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4xD9ACNAm8Pq for ; Wed, 27 Feb 2008 21:16:19 -0800 (PST) Received: from outbound-mail.vgs.untd.com (outbound-mail.vgs.untd.com [64.136.55.15]) by core3.amsl.com (Postfix) with SMTP id 35D223A68C8 for ; Wed, 27 Feb 2008 21:16:19 -0800 (PST) Received: from outbound-bu1.vgs.untd.com (webmail05.vgs.untd.com [10.181.12.145]) by smtpout04.vgs.untd.com with SMTP id AABD6NS6FAQRMB4J for (sender ); Wed, 27 Feb 2008 21:15:49 -0800 (PST) X-UNTD-OriginStamp: AcganUYbgVGZ0C6nm/9IPTVLjxkSbAuFFKt1RqDiFIcUvwVIvVMT5A== Received: (from fergdawg@netzero.net) by webmail05.vgs.untd.com (jqueuemail) id NCZWJUK7; Wed, 27 Feb 2008 21:15:48 PST Received: from [76.103.55.43] by webmail05.vgs.untd.com with HTTP: Thu, 28 Feb 2008 05:14:51 GMT X-Originating-IP: [76.103.55.43] Mime-Version: 1.0 From: "Paul Ferguson" Date: Thu, 28 Feb 2008 05:14:51 GMT To: rdobbins@cisco.com X-Mailer: Webmail Version 4.0 Message-Id: <20080227.211451.26168.2@webmail05.vgs.untd.com> Content-Disposition: inline X-ContentStamp: 11:5:152063504 X-MAIL-INFO: 13e09164ade191e1e0f0e0a0f9593804040d149d0429b9f9d90944f5cd1010912dd59064 X-UNTD-Peer-Info: 10.181.12.145|webmail05.vgs.untd.com|outbound-bu1.vgs.untd.com|fergdawg@netzero.net Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Roland Dobbins wrote: >Yes, in order to demonstrate that there is a long history of discourse in this arena, and that it isn't necessarily very productive to make the assumption that the participants in this WG are ignorant of the various classes of problems which must be addressed,. Also, advocating particular solutions or classes of solutions in absence of familiarity with the long history and current BCPs surrounding a given problem-set isn't necessarily very productive, either. > I didn't really want to jump in on this exchange, but I feel compelled to at least mention this: Just because there has been "lengthy discourse" on various related issues, I certainly think that much more dialog is needed, simply due to the fact that serious operational insecurities continue to resurface. This proves -- to me at least -- that "lengthy dialog" in the past (historicallly speaking) has been completely and utterly insufficient. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHxkNIq1pz9mNUZTMRAhA2AKDgc3TuRfhsVIhvRyucu2PTNd0jeACgn8jT bZsi2+f3NtcCmsWEaNPHQ5s= =CtH6 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 21:28:28 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EBCC93A6E62; Wed, 27 Feb 2008 21:28:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.643 X-Spam-Level: X-Spam-Status: No, score=-1.643 tagged_above=-999 required=5 tests=[AWL=-1.206, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KezcGm6HrPDL; Wed, 27 Feb 2008 21:28:23 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EAC5028C106; Wed, 27 Feb 2008 21:28:22 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 400C428C32A for ; Wed, 27 Feb 2008 21:28:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YVI1BH1TwLgM for ; Wed, 27 Feb 2008 21:28:20 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id 65C5F28C106 for ; Wed, 27 Feb 2008 21:27:34 -0800 (PST) Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 10:57:26 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m1S5ROYX017356 for ; Thu, 28 Feb 2008 13:27:24 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1S5RL3j004582 for ; Thu, 28 Feb 2008 05:27:23 GMT Message-Id: From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <20080227.211451.26168.2@webmail05.vgs.untd.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 12:27:20 +0700 References: <20080227.211451.26168.2@webmail05.vgs.untd.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=916; t=1204176444; x=1205040444; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=eMmlgmJvWeOtm4xrxpXx25ZLZWMTfUMlLYNSnrKc5iY=; b=i0ExkShGOgrPw2Ni55kr5IwHdzhYqHYMGnNy6jgJmmjLGI1mFJwyw9niVt dRE0ZMdso2T/sI+6BbGVOh+tgLyj+/v681mxVHtdTl9rkkNudql8fqQ59HGG 1C0teTbwgsjinjh+8rYMps5XhsMM2gYv0AI3KqqgKZvr+tykEQVLA=; Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 28, 2008, at 12:14 PM, Paul Ferguson wrote: > Just because there has been "lengthy discourse" on various related > issues, I certainly think that much more dialog is needed, simply > due to the fact that serious operational insecurities continue to > resurface. Concur. However, in order to have a productive discussion, it's probably a good idea to a) understand the history to date, b) understand the current state of the art, such as as it is, from both a technological and an operational standpoint, and c) to assume that other participants in the discussion have invested time in both a) and b), unless they demonstrate otherwise. ;> ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 21:34:37 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BA16F3A6E9A; Wed, 27 Feb 2008 21:34:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.627 X-Spam-Level: X-Spam-Status: No, score=-0.627 tagged_above=-999 required=5 tests=[AWL=-0.190, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OLhG4DHr0LZG; Wed, 27 Feb 2008 21:34:36 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D51C13A6E89; Wed, 27 Feb 2008 21:34:36 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 668A628C106 for ; Wed, 27 Feb 2008 21:34:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IdKkU1TXXjCL for ; Wed, 27 Feb 2008 21:34:34 -0800 (PST) Received: from el-out-1112.google.com (el-out-1112.google.com [209.85.162.181]) by core3.amsl.com (Postfix) with ESMTP id 706CF3A6E82 for ; Wed, 27 Feb 2008 21:34:34 -0800 (PST) Received: by el-out-1112.google.com with SMTP id j27so4282182elf.25 for ; Wed, 27 Feb 2008 21:34:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=6SwPVxSdQRX/F8WQrlMhoQGo/xpl4W9hMmMLoeaVTIw=; b=imk/gYEsxOldOzvfPoLtM+ao7tFHILHJaoZhoOll9X+g3zXA/KpCi128O5vrN3yGVIsJpiviApVL8ck9xU9AzPbbVuAHGMg7Ak1XBOTIPJP+//LaEek2GnkhL4mC+uQG5ZEiOV5MwC7rK+BJX0cXw2USh2OzzHQm2zL6PmFXIl4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=nL/I03iYYXsWk5kOa14XLB/npbIz1zc3s/k33tbmU+9gGwiBfvPY4p0/VCFI0nBSCJB22zv/VgqrOnILn77vsCVsQR3j3NP9Xw1IC5h9wyogUBfSdR+nK/lxpv3oNjeqLIkEAe6Z95TshiHq7QZXX0AGlA048hBG+nEMwTDv+MM= Received: by 10.142.109.16 with SMTP id h16mr6081041wfc.117.1204176866696; Wed, 27 Feb 2008 21:34:26 -0800 (PST) Received: by 10.143.164.14 with HTTP; Wed, 27 Feb 2008 21:34:26 -0800 (PST) Message-ID: <77ead0ec0802272134q3ae38d99l710c778e3d1906ec@mail.gmail.com> Date: Wed, 27 Feb 2008 21:34:26 -0800 From: "Vishwas Manral" To: "Paul Ferguson" In-Reply-To: <20080227.211451.26168.2@webmail05.vgs.untd.com> MIME-Version: 1.0 Content-Disposition: inline References: <20080227.211451.26168.2@webmail05.vgs.untd.com> Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Paul, Thanks for the mail. One of the reasons I have started bringing up issues, is if you see the IPv6 Routing Header http://www.ietf.org/rfc/rfc5095.txt I brought up the issue in January 2006 and very few people payed attention then (The RFC by Joe actually acknowledges the fact I brought up the issue first). When the issue was finally brought out by some researchers it actually became a big issue to be in the news on (CNN/ Forbes etc) and also caused the Routing header(RH0) to be deprecated . Thanks, Vishwas On Wed, Feb 27, 2008 at 9:14 PM, Paul Ferguson wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > - -- Roland Dobbins wrote: > > >Yes, in order to demonstrate that there is a long history of discourse > in this arena, and that it isn't necessarily very productive to make > the assumption that the participants in this WG are ignorant of the > various classes of problems which must be addressed,. Also, > advocating particular solutions or classes of solutions in absence of > familiarity with the long history and current BCPs surrounding a given > problem-set isn't necessarily very productive, either. > > > > I didn't really want to jump in on this exchange, but I feel > compelled to at least mention this: > > Just because there has been "lengthy discourse" on various related > issues, I certainly think that much more dialog is needed, simply > due to the fact that serious operational insecurities continue to > resurface. This proves -- to me at least -- that "lengthy dialog" > in the past (historicallly speaking) has been completely and utterly > insufficient. > > > - - ferg > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.6.3 (Build 3017) > > wj8DBQFHxkNIq1pz9mNUZTMRAhA2AKDgc3TuRfhsVIhvRyucu2PTNd0jeACgn8jT > bZsi2+f3NtcCmsWEaNPHQ5s= > =CtH6 > > -----END PGP SIGNATURE----- > > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(at)netzero.net > ferg's tech blog: http://fergdawg.blogspot.com/ > > _______________________________________________ > > > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 21:36:37 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 13C4928C66C; Wed, 27 Feb 2008 21:36:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.633 X-Spam-Level: X-Spam-Status: No, score=-0.633 tagged_above=-999 required=5 tests=[AWL=-0.197, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K9E8AWkyvM8o; Wed, 27 Feb 2008 21:36:31 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8866A28C719; Wed, 27 Feb 2008 21:36:31 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3D90128C561 for ; Wed, 27 Feb 2008 21:36:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C6gLmgndf72w for ; Wed, 27 Feb 2008 21:36:24 -0800 (PST) Received: from outbound-mail.vgs.untd.com (outbound-mail.vgs.untd.com [64.136.55.15]) by core3.amsl.com (Postfix) with SMTP id BE29528C32A for ; Wed, 27 Feb 2008 21:36:24 -0800 (PST) Received: from outbound-bu1.vgs.untd.com (webmail05.vgs.untd.com [10.181.12.145]) by smtpout06.vgs.untd.com with SMTP id AABD6NUCLAL6RM2A for (sender ); Wed, 27 Feb 2008 21:36:10 -0800 (PST) X-UNTD-OriginStamp: AcganUYbgVGZ0C6nm/9IPTVLjxkSbAuFJ94S0k8rwyILFm14uPAk6w== Received: (from fergdawg@netzero.net) by webmail05.vgs.untd.com (jqueuemail) id NCZXPXU5; Wed, 27 Feb 2008 21:36:04 PST Received: from [76.103.55.43] by webmail05.vgs.untd.com with HTTP: Thu, 28 Feb 2008 05:35:35 GMT X-Originating-IP: [76.103.55.43] Mime-Version: 1.0 From: "Paul Ferguson" Date: Thu, 28 Feb 2008 05:35:35 GMT To: rdobbins@cisco.com X-Mailer: Webmail Version 4.0 Message-Id: <20080227.213535.26168.3@webmail05.vgs.untd.com> Content-Disposition: inline X-ContentStamp: 16:8:1038941060 X-MAIL-INFO: 3bddf454d189f489dd5ddd453930ad5959b1f1f059b461398d2d31511d9494f471d0d454 X-UNTD-Peer-Info: 10.181.12.145|webmail05.vgs.untd.com|outbound-bu1.vgs.untd.com|fergdawg@netzero.net Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Roland Dobbins wrote: >On Feb 28, 2008, at 12:14 PM, Paul Ferguson wrote: > >> Just because there has been "lengthy discourse" on various related >> issues, I certainly think that much more dialog is needed, simply >> due to the fact that serious operational insecurities continue to >> resurface. > >Concur. However, in order to have a productive discussion, it's probably a good idea to a) understand the history to date, b) understand the current state of the art, such as as it is, from both a technological and an operational standpoint, and c) to assume that other participants in the discussion have invested time in both a) and b), unless they demonstrate otherwise. > Okay. So, with regards to the AS17557 leakage: [a] History has shown, to date, that it is childishly simple to inject prefixes into the global routing system. [1] [b] The state of the art? I'm not even sure what that means. This is undeniably a state-of-the-art operational issue, and personally, I'm not banking on any technological solutions to this problem. [c] This is most certainly a desired goal. - - ferg [1] On a related note, last week at NANOG, some beer-drinking ISP engineering folks got together one evening for a "Bogon Injection BoF" to see how many networks on the planet accepted (and also propagated) various bogons which they injected at various places in the global Internet. It is appalling how much fun that had (meaning: it is appalling how many networks don't do even the most basic bogon filtering). -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj4DBQFHxkgiq1pz9mNUZTMRAhfHAJUbVG+ipUXqDoELcvgyf01jNnN5AKD1dTw+ qZWQVjkuOIzVX/mOJ0lZqw== =9iM7 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 21:39:35 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B4FF28C76D; Wed, 27 Feb 2008 21:39:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.59 X-Spam-Level: X-Spam-Status: No, score=-0.59 tagged_above=-999 required=5 tests=[AWL=-0.154, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zWxyOMrmV9L7; Wed, 27 Feb 2008 21:39:30 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3732528C7B0; Wed, 27 Feb 2008 21:39:29 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2FFFB28C76D for ; Wed, 27 Feb 2008 21:39:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F0xmF4Hw-XtB for ; Wed, 27 Feb 2008 21:39:27 -0800 (PST) Received: from outbound-mail.vgs.untd.com (outbound-mail.vgs.untd.com [64.136.55.15]) by core3.amsl.com (Postfix) with SMTP id 64B7928C3F2 for ; Wed, 27 Feb 2008 21:39:27 -0800 (PST) Received: from outbound-bu1.vgs.untd.com (webmail05.vgs.untd.com [10.181.12.145]) by smtpout04.vgs.untd.com with SMTP id AABD6NUJAAWQKQBS for (sender ); Wed, 27 Feb 2008 21:39:12 -0800 (PST) X-UNTD-OriginStamp: AcganUYbgVGZ0C6nm/9IPTVLjxkSbAuFXhhHc6M+kQc6Do9C6WSFDw== Received: (from fergdawg@netzero.net) by webmail05.vgs.untd.com (jqueuemail) id NCZXVK6K; Wed, 27 Feb 2008 21:39:08 PST Received: from [76.103.55.43] by webmail05.vgs.untd.com with HTTP: Thu, 28 Feb 2008 05:38:20 GMT X-Originating-IP: [76.103.55.43] Mime-Version: 1.0 From: "Paul Ferguson" Date: Thu, 28 Feb 2008 05:38:20 GMT To: vishwas.ietf@gmail.com X-Mailer: Webmail Version 4.0 Message-Id: <20080227.213820.26168.4@webmail05.vgs.untd.com> Content-Disposition: inline X-ContentStamp: 8:4:508299245 X-MAIL-INFO: 0a241db5b0dd1db0d4d4a19999f0b48d951440b15440348d31a9c4e120a97d098d351941ad5165ddd4996d608005a0e080e060bd60e504d924d1d1cd34d5d1194404949d657d51c9c980b1559005 X-UNTD-Peer-Info: 10.181.12.145|webmail05.vgs.untd.com|outbound-bu1.vgs.untd.com|fergdawg@netzero.net Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Vishwas Manral" wrote: >One of the reasons I have started bringing up issues, is if you see the IPv6 Routing Header http://www.ietf.org/rfc/rfc5095.txt I brought up the issue in January 2006 and very few people payed attention then (The RFC by Joe actually acknowledges the fact I brought up the issue first). > I'm less concerned about v6 specifically -- but more concerned with operational security issues in general in the global routing system. But thanks for the heads-up. ;-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHxkjIq1pz9mNUZTMRAkL9AJ9GuSlCslv+OyeVGOOlRX//S5QPJgCcDAFp NJ9jVg/wXOOsTGiF0R+2ZZE= =R6k1 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 22:15:48 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 180D53A6874; Wed, 27 Feb 2008 22:15:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.585 X-Spam-Level: X-Spam-Status: No, score=-1.585 tagged_above=-999 required=5 tests=[AWL=-1.148, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zln1YSA6qyGD; Wed, 27 Feb 2008 22:15:45 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DE90A3A6E96; Wed, 27 Feb 2008 22:15:45 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 95F3E3A6AE2 for ; Wed, 27 Feb 2008 22:15:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OHOIH0+s0zwu for ; Wed, 27 Feb 2008 22:15:39 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id 521C43A6874 for ; Wed, 27 Feb 2008 22:15:39 -0800 (PST) Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 11:45:31 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m1S6FUxO023884 for ; Thu, 28 Feb 2008 14:15:30 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1S6FN3j014577 for ; Thu, 28 Feb 2008 06:15:27 GMT Message-Id: <7ECFDE5E-B022-4790-8BCB-B95878A5D694@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <20080227.213535.26168.3@webmail05.vgs.untd.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 13:15:22 +0700 References: <20080227.213535.26168.3@webmail05.vgs.untd.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1889; t=1204179330; x=1205043330; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=oHuTmWvWKQOEuf3ygQshxwWwukCtwAcjgKduXa0gtds=; b=OpDRP8wWtxPopvrzgI3cAKzOwPvQmiRY+sY2uytJFaghBR5Ch13gA9rUKE z1ftLPSYfD2WWrl9vPmK1eSTHixzaaVknYCOdEM1UBLaPqg3jBXD2J1QIHKq Z84UaOV3Ffu7/dyl+0oM0zdwH4jKTgDWtPLXvEMo9uVfp4rhCWTlY=; Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Feb 28, 2008, at 12:35 PM, Paul Ferguson wrote: > [a] History has shown, to date, that it is childishly simple to > inject prefixes into the global routing system. [1] Yes, and there are also BCPs and features and techniques intended to mitigate the ill effects of same, techniques that folks like you and many other folks have promulgated for many years, of which we're all aware. > [b] The state of the art? I'm not even sure what that means. This > is undeniably a state-of-the-art operational issue In other words, there are various features and techniques which exist today intended to address various aspects of this problem set; as you and others rightly point out, these features and techniques are not universally deployed, or anything close to it, which leaves us in our current sad state of affairs. > I'm not banking on any technological solutions to this problem. Does this mean that these classical problems (route hijacking, source spoofing, et. al.) are essentially insoluble in practice, given the inertia, entropy, and general failure of the operational community to solve them after 15 years (30+ years, if one takes into consideration equivalent issues in X.25 networks)? I'm not asking rhetorically, it's a serious question. > (meaning: it is appalling how many networks don't do even the > most basic bogon filtering) Right. So if there's no technological solution, then in what domain does the solution, if any, lie? And if there is no technological solution, then how can this WG make a contribution to said solution, assuming one is possible? ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 22:36:36 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 15EA73A6983; Wed, 27 Feb 2008 22:36:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.602 X-Spam-Level: X-Spam-Status: No, score=-0.602 tagged_above=-999 required=5 tests=[AWL=-0.166, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id erucGJqXHTRV; Wed, 27 Feb 2008 22:36:30 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 882243A6867; Wed, 27 Feb 2008 22:36:30 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 227B83A6867 for ; Wed, 27 Feb 2008 22:36:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vGj8zNrALltp for ; Wed, 27 Feb 2008 22:36:26 -0800 (PST) Received: from outbound-mail.vgs.untd.com (outbound-mail.vgs.untd.com [64.136.55.15]) by core3.amsl.com (Postfix) with SMTP id 3D0093A6850 for ; Wed, 27 Feb 2008 22:36:26 -0800 (PST) Received: from outbound-bu1.vgs.untd.com (webmail05.vgs.untd.com [10.181.12.145]) by smtpout05.vgs.untd.com with SMTP id AABD6NXU2AZG8QHJ for (sender ); Wed, 27 Feb 2008 22:36:08 -0800 (PST) X-UNTD-OriginStamp: AcganUYbgVGZ0C6nm/9IPTVLjxkSbAuFCcnFN4hKG57bu+Wtdi8+Ng== Received: (from fergdawg@netzero.net) by webmail05.vgs.untd.com (jqueuemail) id NCZ24Q6L; Wed, 27 Feb 2008 22:35:29 PST Received: from [76.103.55.43] by webmail05.vgs.untd.com with HTTP: Thu, 28 Feb 2008 06:34:45 GMT X-Originating-IP: [76.103.55.43] Mime-Version: 1.0 From: "Paul Ferguson" Date: Thu, 28 Feb 2008 06:34:45 GMT To: rdobbins@cisco.com X-Mailer: Webmail Version 4.0 Message-Id: <20080227.223445.26168.6@webmail05.vgs.untd.com> Content-Disposition: inline X-ContentStamp: 17:8:812149954 X-MAIL-INFO: 1bf0a0e1c0b0a0b0f050f049d06179b9b9840560b9ad09d0f51090a5e02020a09429e4e1 X-UNTD-Peer-Info: 10.181.12.145|webmail05.vgs.untd.com|outbound-bu1.vgs.untd.com|fergdawg@netzero.net Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Roland Dobbins wrote: >> (meaning: it is appalling how many networks don't do even the >> most basic bogon filtering) > >Right. So if there's no technological solution, then in what domain does the solution, if any, lie? And if there is no technological solution, then how can this WG make a contribution to said solution, assuming one is possible? > I'm really not sure. Really. That is the point I'm trying to make, since ISPs have historically been resistive to IETF "Best Current Practices" (e.g. BCP38 is a prime example). Coming at this from a security perspective, the ISP landscape is a very challenging one -- every ISP is a "one-off" wanting to do things there own way, in their own time, and in their own interests. My primary concern here is that if ISP don't get a grip on these sorts of issues as a community, some other entity may force their hand on it regionally/nationally (read: unwise government meddling). It is in their interests, and ours, and the Internet community at-large, to figure something out -- but again, I don't harbor a lot of faith in some technological solution to this problem. It just doesn't lend itself to that avenue, for various reasons. Just to highlight a couple of issues with technological approaches, there are: - - CA for BGP-authenticated prefix announcements; - - Lack of x.509 of other trusted CA; - - Wide-spread adoption; - - Vendor implementation; - - Computational and real-time processor overhead ...among others, which may take years to sort out. So, realistically we need operational & procedural priorities here. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHxlYBq1pz9mNUZTMRAtJnAJ9XN/u3ijkxqzLe71Us3DeShGjpgACgp17U XtE41f9gXwtuC4v7IKMMXD8= =rTIL -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 22:58:38 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BB9D63A6996; Wed, 27 Feb 2008 22:58:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.707 X-Spam-Level: X-Spam-Status: No, score=-0.707 tagged_above=-999 required=5 tests=[AWL=-0.270, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zGpL2kgClIH4; Wed, 27 Feb 2008 22:58:33 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51E783A67E4; Wed, 27 Feb 2008 22:58:33 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B4E993A67F1 for ; Wed, 27 Feb 2008 22:58:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QHiDZS08fm7m for ; Wed, 27 Feb 2008 22:58:26 -0800 (PST) Received: from web31807.mail.mud.yahoo.com (web31807.mail.mud.yahoo.com [68.142.207.70]) by core3.amsl.com (Postfix) with SMTP id 1D7CA3A6780 for ; Wed, 27 Feb 2008 22:58:26 -0800 (PST) Received: (qmail 54844 invoked by uid 60001); 28 Feb 2008 06:58:18 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Message-ID; b=zNpFyqaTuUhDpLV5aveLZnrIwpJImd+WM6WD7+mpZPCN/BQTo5f4yD1bYaXsOSKChdaVGnjJ9weLUMJRevFWwxFijosHh3BFExK9abS+wSxToxR8bYG4uEYKWc1KQtKvj3BMPCI+LtnPl2bCeOELngtFEu09LBOD2+kHxpBkwd8=; X-YMail-OSG: TMHAy90VM1l2RrgbrG2rFbI6I_BYGFPLyXxANoz0G5LCovEKp7hj.1Y_KboRMGTBLCQpNizTXPYsbpBscsjHVmJfvsA9fwDpmiEgAz.AF5bpIouUedds2YVFTDRmcw-- Received: from [72.254.59.155] by web31807.mail.mud.yahoo.com via HTTP; Wed, 27 Feb 2008 22:58:18 PST X-Mailer: YahooMailWebService/0.7.182 Date: Wed, 27 Feb 2008 22:58:18 -0800 (PST) From: David Barak To: opsec@ietf.org In-Reply-To: <20080227.223445.26168.6@webmail05.vgs.untd.com> MIME-Version: 1.0 Message-ID: <633799.53861.qm@web31807.mail.mud.yahoo.com> Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: thegameiam@yahoo.com List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org --- On Thu, 2/28/08, Paul Ferguson wrote: > So, realistically we need operational & procedural > priorities here. From my perspective, I'd like to make it harder to make a mistake. Preventing an attack requires an order of magnitude more effort, but if we can get a little bit of incremental progress, I'd see that as a success. Would you agree that improving the resilience to mistakes is on the right side of the 80/20 rule? David Barak Need Geek Rock? Try The Franchise: http://www.listentothefranchise.com ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 23:13:30 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 440AB3A69EA; Wed, 27 Feb 2008 23:13:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.586 X-Spam-Level: X-Spam-Status: No, score=-0.586 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SSMRLtHwqHzl; Wed, 27 Feb 2008 23:13:24 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 28ABB3A6902; Wed, 27 Feb 2008 23:13:21 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6DB6C3A6A20 for ; Wed, 27 Feb 2008 23:13:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jBAudonr5e8u for ; Wed, 27 Feb 2008 23:13:18 -0800 (PST) Received: from outbound-mail.vgs.untd.com (outbound-mail.vgs.untd.com [64.136.55.15]) by core3.amsl.com (Postfix) with SMTP id 9D58D3A680C for ; Wed, 27 Feb 2008 23:12:27 -0800 (PST) Received: from outbound-bu1.vgs.untd.com (webmail05.vgs.untd.com [10.181.12.145]) by smtpout02.vgs.untd.com with SMTP id AABD6NZXRAY94872 for (sender ); Wed, 27 Feb 2008 23:11:43 -0800 (PST) X-UNTD-OriginStamp: AcganUYbgVGZ0C6nm/9IPTVLjxkSbAuFJyb0ZIDSIfGxO2zwPj5b1w== Received: (from fergdawg@netzero.net) by webmail05.vgs.untd.com (jqueuemail) id NCZ46JV9; Wed, 27 Feb 2008 23:11:25 PST Received: from [76.103.55.43] by webmail05.vgs.untd.com with HTTP: Thu, 28 Feb 2008 07:10:47 GMT X-Originating-IP: [76.103.55.43] Mime-Version: 1.0 From: "Paul Ferguson" Date: Thu, 28 Feb 2008 07:10:47 GMT To: thegameiam@yahoo.com X-Mailer: Webmail Version 4.0 Message-Id: <20080227.231047.26168.8@webmail05.vgs.untd.com> Content-Disposition: inline X-ContentStamp: 10:5:2953078030 X-MAIL-INFO: 45230a1b472f0a2f234e232ba78f4a6a6aae8b4f6ad71ea7ea27ce8efee7e70a870f7f1b X-UNTD-Peer-Info: 10.181.12.145|webmail05.vgs.untd.com|outbound-bu1.vgs.untd.com|fergdawg@netzero.net Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- David Barak wrote: >From my perspective, I'd like to make it harder to make a mistake. >Preventing an attack requires an order of magnitude more effort, but if we >can get a little bit of incremental progress, I'd see that as a success. > >Would you agree that improving the resilience to mistakes is on the right >side of the 80/20 rule? > Yes, I would most certainly agree. However, in light of the lack of operational adherence, where does that leave us? I'm trying to solicit suggestions from the operational security community here. What you you suggest? Please don't misunderstand -- I'm not declaring defeat, I'm just trying to properly frame the situation. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHxl5yq1pz9mNUZTMRAv+tAJ43sTzP0dnz334domPiGnIOH5upHQCfVZiD NnrizkZ+386BVuszwswpuRE= =wp+c -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Wed Feb 27 23:54:33 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8270C3A6A2C; Wed, 27 Feb 2008 23:54:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.403 X-Spam-Level: X-Spam-Status: No, score=-0.403 tagged_above=-999 required=5 tests=[AWL=-0.566, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, J_CHICKENPOX_48=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fs1oFlRBkkJ4; Wed, 27 Feb 2008 23:54:31 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 92EFD3A6850; Wed, 27 Feb 2008 23:54:31 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CB2503A69AB for ; Wed, 27 Feb 2008 23:54:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9AB7ByJ1mT9a for ; Wed, 27 Feb 2008 23:54:28 -0800 (PST) Received: from web31804.mail.mud.yahoo.com (web31804.mail.mud.yahoo.com [68.142.207.67]) by core3.amsl.com (Postfix) with SMTP id C6D3A3A6850 for ; Wed, 27 Feb 2008 23:54:28 -0800 (PST) Received: (qmail 381 invoked by uid 60001); 28 Feb 2008 07:54:21 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Message-ID; b=FGvzbx43CGUYQHthCGYyo3+pHTTFkEMnqRmBRAQv5RyEN5jKf6m+ohNL/wtieLQ3Ln/z3/njXLJUKrwK6H7FvYQsQ6VeTTIsfZhbnD7RAu6jBDmkKyU7ohu6OmkQ445aINBZtseq4HDnvxe4uW1kKmiArJyfSL2h0bF9lmm+A4Y=; X-YMail-OSG: 8CrKy58VM1krMrKr5w.6zwC51YFHbc5PzlcTRMecsw9JEV0ULGBMYYtAZ9XEOzKzeY9uGl3w0tBqzvCdThuMD34N1fI8MDFMUIpn0ClcZeG3Rr5LQnQ- Received: from [72.254.59.155] by web31804.mail.mud.yahoo.com via HTTP; Wed, 27 Feb 2008 23:54:21 PST X-Mailer: YahooMailWebService/0.7.182 Date: Wed, 27 Feb 2008 23:54:21 -0800 (PST) From: David Barak To: opsec@ietf.org In-Reply-To: <20080227.231047.26168.8@webmail05.vgs.untd.com> MIME-Version: 1.0 Message-ID: <258604.99751.qm@web31804.mail.mud.yahoo.com> Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: thegameiam@yahoo.com List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org --- On Thu, 2/28/08, Paul Ferguson wrote: > >From my perspective, I'd like to make it harder to > make a mistake. > >Preventing an attack requires an order of magnitude > more effort, but if we > >can get a little bit of incremental progress, I'd > see that as a success. > > > >Would you agree that improving the resilience to > mistakes is on the right > >side of the 80/20 rule? > > > > Yes, I would most certainly agree. > > However, in light of the lack of operational adherence, > where does > that leave us? I'm trying to solicit suggestions from > the operational > security community here. > > What you you suggest? > > Please don't misunderstand -- I'm not declaring > defeat, I'm just > trying to properly frame the situation. Agreed - I just think we need more meat+potatoes instruction for various folks who are new at this: c.f. the recent discussion over on cisco-nsp about how to run both OSPF and BGP by ISPs who are new to dynamic routing (!) And then, from there, we need some ways to help them scale up, while still being good netizens. A lot of things are sufficiently obvious to old hands that are completely opaque to folks who are new at it. As the circle of BGP speakers grows wider, the number of people involved increases exponentially. We have a lot of clue-distribution to do. David Barak Need Geek Rock? Try The Franchise: http://www.listentothefranchise.com ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 06:49:24 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3CC943A6ED1; Thu, 28 Feb 2008 06:49:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.616 X-Spam-Level: X-Spam-Status: No, score=-0.616 tagged_above=-999 required=5 tests=[AWL=-0.179, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gm8qfs2vnjtd; Thu, 28 Feb 2008 06:49:18 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A26763A6ED4; Thu, 28 Feb 2008 06:49:18 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4AADB3A6ED4 for ; Thu, 28 Feb 2008 06:49:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ofWTU1z1i0f6 for ; Thu, 28 Feb 2008 06:49:11 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.174]) by core3.amsl.com (Postfix) with ESMTP id D947A3A6EA0 for ; Thu, 28 Feb 2008 06:49:11 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so3097720wfa.31 for ; Thu, 28 Feb 2008 06:49:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=2LMqDnRhvtGFCnWRT3C5RJ7jv08T5vrohuF7JpwZQNw=; b=dsjhhhrY6s0R9B2S4UzL9RrqWlu+b/yswNsPKbw9YLW1e5IgjsVsYGXHv5um9rJYwpyLLaxrTDEv3kq5kDFJBV7HC+OrWMcwu8uXkFQbgdeXnGIJ6N3Wg9+Sof578B6czCsv0S3+R2cE9BOmhM16qw99ETG4sNSOOHQrMKr9aEc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=XJfK7ZaRJZr2ICoc9qzEHuZUa5b7aa91lNYeRTBMgKnEwiV9c5PPjiseO5cthYxd0OGamHvd4zKLkXuDQJO4iXPm8fiYrvGEcJWqWuov9RVexuFVPp28ratVppFnWFlPBzkqa/+QmQqexyEl8/49R2DqR4ShmWOls3ToUA3f0ew= Received: by 10.142.114.15 with SMTP id m15mr6337766wfc.235.1204210144900; Thu, 28 Feb 2008 06:49:04 -0800 (PST) Received: by 10.143.164.14 with HTTP; Thu, 28 Feb 2008 06:49:04 -0800 (PST) Message-ID: <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> Date: Thu, 28 Feb 2008 06:49:04 -0800 From: "Vishwas Manral" To: "Stephen Kent" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> Cc: opsec wg mailing list , sidr@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Stephen, Ok, I understand the model you talk about now. Yes the CPU may not be the biggest concern as the server is verifying the Cert's offline. I guess this would also lead to models like CRL's for revocation. Like I said earlier as SIDR does not stop malicious attacks, but only ones caused unintentionally, is it not possible to actually use a simpler mechanism to get over such errors? Thanks, Vishwas On Thu, Feb 28, 2008 at 3:35 AM, Stephen Kent wrote: > > > At 8:31 PM -0800 2/27/08, Vishwas Manral wrote: > Hi Stephen, > > The point I raise is that there is a cost associated with this, using > certificates has a CPU cost associated with it. > > I may be missing the point but even if you leave aside the cost of an > off line server to do this check but if the checks are done on each > new prefix we can still overload the off line server. If we do things > like rate limiting we can still have an attacks, or cause delays in > the convergence times. > > Thanks, > Vishwas > > > I think you are missing the point. So long as the processing is done as an > offline operation, not as a gating item in routing, it does not strike me as > a DoS concern. The initial use of the infrastructure is analogous to > downloading IRR databases and processing the RPSL assertions, an operation > many ISPs perform today on a daily basis. > > > More to the point, folks have implemented the necessary software and tested > it with about 20K certs and CRLs and 10K ROAs, a reasonable starting point. > I don't have the precise figures in front of me now, but I believe their > results show that the time to do all the processing (on a laptop) is about > 20-30 minutes, and the time is dominated by the retrieval of the data from > online repositories, not by the crypto operations per se. For a once daily, > offline operations, this seems quite reasonable. > > > Steve _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 06:52:07 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B1F3528C641; Thu, 28 Feb 2008 06:52:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.499 X-Spam-Level: X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[AWL=-1.062, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PxnZ4SzWk6zn; Thu, 28 Feb 2008 06:52:02 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3B6AE28C644; Thu, 28 Feb 2008 06:52:02 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2E34328C107 for ; Thu, 28 Feb 2008 06:52:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1DyGyMGA5oCq for ; Thu, 28 Feb 2008 06:51:55 -0800 (PST) Received: from ind-iport-1.cisco.com (ind-iport-1.cisco.com [64.104.129.195]) by core3.amsl.com (Postfix) with ESMTP id E83F428C661 for ; Thu, 28 Feb 2008 06:51:50 -0800 (PST) Received: from hkg-dkim-1.cisco.com ([10.75.231.161]) by ind-iport-1.cisco.com with ESMTP; 28 Feb 2008 20:21:43 +0530 Received: from hkg-core-1.cisco.com (hkg-core-1.cisco.com [64.104.123.94]) by hkg-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id m1SEpfSl020035 for ; Thu, 28 Feb 2008 22:51:41 +0800 Received: from [192.168.1.100] (hkidc-vpn-client-233-117.cisco.com [10.75.233.117]) by hkg-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id m1SEpa3j019731 for ; Thu, 28 Feb 2008 14:51:40 GMT Message-Id: <6C621F03-27FF-41F1-814E-3F4D458BD2FA@cisco.com> From: Roland Dobbins To: opsec wg mailing list In-Reply-To: <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v915) Date: Thu, 28 Feb 2008 21:51:35 +0700 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> X-Mailer: Apple Mail (2.915) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=543; t=1204210301; x=1205074301; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdobbins@cisco.com; z=From:=20Roland=20Dobbins=20 |Subject:=20Re=3A=20[OPSEC]=20pccw=20as17557=20leak... |Sender:=20; bh=PuvXECq6VF5inu+Mypbr0+JqPwsrwkcHyV3mTvdhnk8=; b=fZdDucX29WSKDvg5phBmdTFQxLQzYcMx2iLeXIIoXxb2BANrBUj2SlhxhG 3A7hQt7jiitqKubSu8wpRHSQXBKVk1uX5FVj15/ZD+wDZHT3qxLK5ZGpbkKM 9e9xVcOb/oR792dH116kFDGp6V8X3XvXIuANe3EXfHF0HzbMX46eY=; Authentication-Results: hkg-dkim-1; header.From=rdobbins@cisco.com; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; ); Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org [removing cross-post to sidr@ietf.org; cross-posting is considered poor form, FYI] On Feb 28, 2008, at 9:49 PM, Vishwas Manral wrote: > is it not possible to actually use a > simpler mechanism to get over such errors? So far, the empirical evidence seems to suggest, "No", unfortunately. ----------------------------------------------------------------------- Roland Dobbins // +66.83.266.6344 mobile If you don't know what to do, it's harder to do it. -- Malcom Forbes _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 07:12:07 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 394683A69CF; Thu, 28 Feb 2008 07:12:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.949 X-Spam-Level: X-Spam-Status: No, score=-1.949 tagged_above=-999 required=5 tests=[AWL=0.488, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hfjnPg3xRSeF; Thu, 28 Feb 2008 07:12:01 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A56BE28C3FF; Thu, 28 Feb 2008 07:12:01 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DC94628C24E for ; Thu, 28 Feb 2008 07:12:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ng+lnCnTMs0 for ; Thu, 28 Feb 2008 07:11:55 -0800 (PST) Received: from monster.hopcount.ca (monster.hopcount.ca [199.212.90.4]) by core3.amsl.com (Postfix) with ESMTP id 5329128C3FF for ; Thu, 28 Feb 2008 07:11:55 -0800 (PST) Received: from wcplondo3030wonderlan.grokspots.com ([64.235.108.57] helo=[192.168.182.3]) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JUkQC-000N80-T6; Thu, 28 Feb 2008 15:11:46 +0000 Message-Id: From: Joe Abley To: "Vishwas Manral" In-Reply-To: <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Thu, 28 Feb 2008 10:11:43 -0500 References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list , Stephen Kent Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org [I've dropped the cross-post to sidr, since people there know what their work is about. I seem to think there's some lack of familiarity in some corners of opsec, though.] On 28-Feb-2008, at 09:49, Vishwas Manral wrote: > Like I said earlier as SIDR does not stop malicious attacks, but only > ones caused unintentionally, is it not possible to actually use a > simpler mechanism to get over such errors? Right now, if I am a new customer of an ISP and I want to announce a route, I send a bunch of supporting documentation such as: - pasted text from whois servers - faxed declarations on letterheads - PGP signatures for which no trusted key can easily be found - personal requests for favours from people I have drunk beer with at NANOG Sooner or later, I hope that the ISP will update their prefix filters and accept the filter. You can think of the SIDR work as an attempt to make the process outlined above more accurate and automatable (and hence quicker and better). It would be a mistake to think that the SIDR work aims to solve routing security; the actual problem space it seeks to address is much smaller. If we could be certain that every route origination was made through an up-to-date filter built through the kind of accurate framework that SIDR proposes we might consider it to be some kind of panacea, but I think we're all aware that this is not the kind of Internet we live in. Geoff described the use cases together with details of the certification chain in a NANOG presentation some time ago. See . Joe _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 08:01:43 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4B64A28C89E; Thu, 28 Feb 2008 08:01:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.786 X-Spam-Level: X-Spam-Status: No, score=-1.786 tagged_above=-999 required=5 tests=[AWL=0.651, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, GB_I_LETTER=-2, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hLx-QyrUXvy3; Thu, 28 Feb 2008 08:01:42 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BC81928C853; Thu, 28 Feb 2008 08:01:37 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D436A28C885 for ; Thu, 28 Feb 2008 08:01:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cZle+YjCjEjS for ; Thu, 28 Feb 2008 08:01:30 -0800 (PST) Received: from ag-out-0708.google.com (ag-out-0708.google.com [72.14.246.247]) by core3.amsl.com (Postfix) with ESMTP id 84ECE3A6E2F for ; Thu, 28 Feb 2008 08:01:22 -0800 (PST) Received: by ag-out-0708.google.com with SMTP id 33so9011127agc.1 for ; Thu, 28 Feb 2008 08:01:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=lxW27K+mbgAumI1ONsAQcCAHTth0RSG51hs+YOdF9qE=; b=iO28Bz1pqe9cA92Aeaj2oWGPwdtkzrFsTvtgMC9ysRAkWTcQqWyR29kpS99g9zdkIg40ZTUvHxsa8Xnj+n+DZf1MMHLTC90Vznkeemy6vSpQI/5b9NoSvRQBmGq8dpbD3771T2XKFmH741ZAm76McWSEAJhCAN9YuzBl3fJCZ5g= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=ZQurI49jHIQvGEYS1D1m6AbKlJgvgziQY3I4wi1fl/X2nCkRkGy49N6m0oyscsa/HPH1bhyBxNV4mLWwJh8N6tJtizlhp5lHRmEQ7qicsVgGrwzeXAoqIOjsw0H8E8scDt8l6FfNIFtiAnoxEGLXe5Jp/tMEDmdxfkismGSGb+Q= Received: by 10.142.217.17 with SMTP id p17mr6384645wfg.99.1204214473455; Thu, 28 Feb 2008 08:01:13 -0800 (PST) Received: by 10.143.164.14 with HTTP; Thu, 28 Feb 2008 08:01:13 -0800 (PST) Message-ID: <77ead0ec0802280801o2c4f22c9p182c5fbcb1df3657@mail.gmail.com> Date: Thu, 28 Feb 2008 08:01:13 -0800 From: "Vishwas Manral" To: "Joe Abley" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Joe, Note: I think Stephen cross posted because he thought it was of interest to the SIDR list too. May be it is well known in the SIDR community, but I do not see the same in the charter. Then again I do not visit NANOG or drink beer. :)) The charter seems to talk of it in the security architecture and not just an automation mechanism of adding filters, which is what you seem to say it is. Have a look at below: Also if it is only between the first EBGP peer, the model can be considerably simplified by doing the verification of the origination at the EBGP peer and not the entire Internet. So a mechanism of actually verifying a prefix/ AS mapping with a central authority will be a better mechanism. Thanks, Vishwas On Thu, Feb 28, 2008 at 7:11 AM, Joe Abley wrote: > [I've dropped the cross-post to sidr, since people there know what > their work is about. I seem to think there's some lack of familiarity > in some corners of opsec, though.] > > > On 28-Feb-2008, at 09:49, Vishwas Manral wrote: > > > Like I said earlier as SIDR does not stop malicious attacks, but only > > ones caused unintentionally, is it not possible to actually use a > > simpler mechanism to get over such errors? > > Right now, if I am a new customer of an ISP and I want to announce a > route, I send a bunch of supporting documentation such as: > > - pasted text from whois servers > - faxed declarations on letterheads > - PGP signatures for which no trusted key can easily be found > - personal requests for favours from people I have drunk beer with > at NANOG > > Sooner or later, I hope that the ISP will update their prefix filters > and accept the filter. > > You can think of the SIDR work as an attempt to make the process > outlined above more accurate and automatable (and hence quicker and > better). > > It would be a mistake to think that the SIDR work aims to solve > routing security; the actual problem space it seeks to address is much > smaller. If we could be certain that every route origination was made > through an up-to-date filter built through the kind of accurate > framework that SIDR proposes we might consider it to be some kind of > panacea, but I think we're all aware that this is not the kind of > Internet we live in. > > Geoff described the use cases together with details of the > certification chain in a NANOG presentation some time ago. See >. > > > Joe > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 08:04:28 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 317923A6ECC; Thu, 28 Feb 2008 08:04:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.942 X-Spam-Level: X-Spam-Status: No, score=-0.942 tagged_above=-999 required=5 tests=[AWL=-0.505, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BXWUOLGdwcef; Thu, 28 Feb 2008 08:04:22 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EF7BE3A6EE6; Thu, 28 Feb 2008 08:04:12 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 82FEF3A6EDC for ; Thu, 28 Feb 2008 08:04:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PJzO41LpHiVr for ; Thu, 28 Feb 2008 08:04:10 -0800 (PST) Received: from monster.hopcount.ca (monster.hopcount.ca [199.212.90.4]) by core3.amsl.com (Postfix) with ESMTP id 5AC7928C170 for ; Thu, 28 Feb 2008 08:03:39 -0800 (PST) Received: from yxu1a16.hopcount.ca ([199.212.90.16]) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68 (FreeBSD)) (envelope-from ) id 1JUlEI-000Ne7-8J; Thu, 28 Feb 2008 16:03:30 +0000 Message-Id: From: Joe Abley To: "Vishwas Manral" In-Reply-To: <77ead0ec0802280801o2c4f22c9p182c5fbcb1df3657@mail.gmail.com> Mime-Version: 1.0 (Apple Message framework v919.2) Date: Thu, 28 Feb 2008 11:03:28 -0500 References: <47C4E38E.1070105@bogus.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280801o2c4f22c9p182c5fbcb1df3657@mail.gmail.com> X-Mailer: Apple Mail (2.919.2) Cc: opsec wg mailing list Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On 28-Feb-2008, at 11:01, Vishwas Manral wrote: > The charter seems to talk of it in the security architecture and not > just an automation mechanism of adding filters, which is what you seem > to say it is. Have a look at below: It's quite possible I'm speaking about just one element of the SIDR work (that of resource certification) and that I should not generalise about the efforts of the wg as a whole. > Also if it is only between the first EBGP peer, the model can be > considerably simplified by doing the verification of the origination > at the EBGP peer and not the entire Internet. So a mechanism of > actually verifying a prefix/ AS mapping with a central authority will > be a better mechanism. Verifying a prefix/AS mapping with a central authority (via chained certificates) is what the work I was talking about is intended to facilitate. Joe _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 09:56:37 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 57EC728C892; Thu, 28 Feb 2008 09:56:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.618 X-Spam-Level: X-Spam-Status: No, score=-0.618 tagged_above=-999 required=5 tests=[AWL=-0.181, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2xpLoJEVOsYV; Thu, 28 Feb 2008 09:56:32 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A4D5828C77F; Thu, 28 Feb 2008 09:56:32 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 57E883A6B8D for ; Thu, 28 Feb 2008 09:56:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5U4Fn0XghzLo for ; Thu, 28 Feb 2008 09:56:30 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.174]) by core3.amsl.com (Postfix) with ESMTP id 794583A69D9 for ; Thu, 28 Feb 2008 09:56:30 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so3232651wfa.31 for ; Thu, 28 Feb 2008 09:56:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=e5qlXvwcpsaWBQEAKyqzbIRI8x3fMOA1tM+Q9pxW3uE=; b=gLEZ9TsCIPM0RytDz9+0XndFriEiwfPiVhSlKsOgInCxo1IijF4urDx1Bys3x8LpPORuVe3KnkdcyzwOWtaHgici58d5P7gDlAmpIMJ4A1l956w9BRC8JThrExbJZYSCydDc7/Q1R95z7qidBvN96Uhlg2exyrAczxFWKsMRp08= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=e68fTfVLzH+TafDJAFzTHxClhqcFGX4sbS3XBTZ9HVhQcsxkA+qqh0JUvTu6JO4Sy1ZqKSBJr0MEKZr5AOyf+C14ssbE50qeEDlV3uG5kTKFOrbFQUBlh54RWqZhoT/+r+wmkUxtCsNJrui5EqFgekwdyX/YqnQXeWJcyUiFUf8= Received: by 10.143.40.18 with SMTP id s18mr2624271wfj.156.1204221383592; Thu, 28 Feb 2008 09:56:23 -0800 (PST) Received: by 10.143.164.14 with HTTP; Thu, 28 Feb 2008 09:56:23 -0800 (PST) Message-ID: <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> Date: Thu, 28 Feb 2008 09:56:23 -0800 From: "Vishwas Manral" To: "Sandra Murphy" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Sandra, Thanks for the reply. You put forward the all the points correctly and precisely. My concern is that, unlike the normal PKI model where the final output is to authenticate the user using the just the certificate, the Routing based model we are now talking about verifying just a small bit of information which is used for the BGP Best Path selection - the sanity of which we are trying to protect, and protecting just the Origin does not make sense in a malicious case at all. Though you may say that it protects in case the malicious person plays with the Origin attribute, it however does not protect much as with the same amount of effort a malicious person can still cause the same attacks. What increases is the over head in each of the domains to maintain the new PKI information. After reading a bit through what Pekka/ Danny/ Joe Abely said away in which we could update the filters between peers automatically(only relating to routes originated by the peer), from the RIR, we may achieve the very same functionality. Thanks, Vishwas On Thu, Feb 28, 2008 at 8:34 AM, Sandra Murphy wrote: > > > On Thu, 28 Feb 2008, Vishwas Manral wrote: > > > Hi Stephen, > > > > > Ok, I understand the model you talk about now. Yes the CPU may not be > > the biggest concern as the server is verifying the Cert's offline. I > > guess this would also lead to models like CRL's for revocation. > > > > Like I said earlier as SIDR does not stop malicious attacks, but only > > ones caused unintentionally, is it not possible to actually use a > > simpler mechanism to get over such errors? > > > > Thanks, > > Vishwas > > > > Vishwas, the current SIDR work is focused on preventing attacks > (faulty/misconfigured/subverted/malicious/whatever) against the > origination of routing advertisements, by providing strong assurance of > who holds what prefixes, and therefore who can authorize origination of > a prefix. > > (And in the leak that is the subject of this email chain, the fully > deployed system would indeed have detected the mis-origination, in any AS > that had received the mis-origination, not just the direct link up from > the customer.) > > The concerns you raise are recognized subjects for further work. > > But all of the very many proposals for securing BGP (see: S-BGP, soBGP, > psBGP, SPV, etc., etc.) rely on protecting this initial bit of routing > information: originating a route to a prefix. So defining this work is a > basis for defining future fuller protection techniques as well. > > All simpler mechanisms I have ever heard of for protecting origination of > routing advertisements are either much lower assurance, or based on data > with similar strong protections but not more assurance, or not extensible > to protecting more features of BGP exchanges. > > > --Sandy > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 10:00:22 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CA55C3A6E6D; Thu, 28 Feb 2008 10:00:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.978 X-Spam-Level: X-Spam-Status: No, score=-0.978 tagged_above=-999 required=5 tests=[AWL=-0.540, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tzS-Z8J7xw9z; Thu, 28 Feb 2008 10:00:22 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3415E28C1AB; Thu, 28 Feb 2008 10:00:13 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 634183A68E1 for ; Thu, 28 Feb 2008 10:00:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j6SjgRPUKNlO for ; Thu, 28 Feb 2008 10:00:07 -0800 (PST) Received: from sudnp799.qwest.com (sudnp799.qwest.com [155.70.32.99]) by core3.amsl.com (Postfix) with ESMTP id 2629D3A6A85 for ; Thu, 28 Feb 2008 10:00:02 -0800 (PST) Received: from sudnp796.qintra.com (sudnp796.qintra.com [151.116.2.212]) by sudnp799.qwest.com (8.14.0/8.14.0) with ESMTP id m1SHxoEd002356; Thu, 28 Feb 2008 10:59:50 -0700 (MST) Received: from ITDENE2KSM02.AD.QINTRA.COM (localhost [127.0.0.1]) by sudnp796.qintra.com (8.14.0/8.14.0) with ESMTP id m1SHxjfi006516; Thu, 28 Feb 2008 10:59:45 -0700 (MST) Received: from ITDENE2KM02.AD.QINTRA.COM ([10.1.4.66]) by ITDENE2KSM02.AD.QINTRA.COM with Microsoft SMTPSVC(6.0.3790.1830); Thu, 28 Feb 2008 10:59:45 -0700 X-MessageTextProcessor: DisclaimIt (2.70.270) [Qwest Communications International Inc.] X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 Content-Class: urn:content-classes:message MIME-Version: 1.0 Date: Thu, 28 Feb 2008 10:59:43 -0700 Message-ID: In-Reply-To: <20080227.111847.6641.1@webmail06.vgs.untd.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [OPSEC] pccw as17557 leak... thread-index: Ach5deSHGRn4lAPLT3+8TgI96dsx4gABZwAw References: <20080227.111847.6641.1@webmail06.vgs.untd.com> Importance: normal From: "Smith, Donald" Priority: normal To: "Paul Ferguson" , X-OriginalArrivalTime: 28 Feb 2008 17:59:45.0620 (UTC) FILETIME=[B3A95940:01C87A33] Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org A lot of us do filter customer BGP announcements. Most of us only allow our customers to announce their own AS and netblocks. Most won't advertise anything smaller then a /24 for their customers. In peering especially with other large peers filtering announcements to the set of blocks "owned" by the peer is a bad idea. If a partial network outage causes your peer to be the best path to you from some portion of the internet you WANT the packets to use the best path not the path that is now broken:) RM=for(1) {manage_risk(identify_risk(product[i++]) && (identify_threat[product[i++]))} Donald.Smith@qwest.com giac > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Paul Ferguson > Sent: Wednesday, February 27, 2008 12:19 PM > To: rbonica@juniper.net > Cc: opsec@ietf.org > Subject: Re: [OPSEC] pccw as17557 leak... > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > - -- Ron Bonica wrote: > > >I think that it would helpful if this working group were to produce a > >document (or two) recommending BGP policy for ISP. > > If you do decide to do this, please engage people in the operational > community. Please. > > Over on the NANOG list, as many of you are probably already aware, > this issue is one that has been highlighted on several ocassions -- > the fact that appropriate RFCs and BCPs exist to address specific > operational issues, yet many ISPs choose to ignore them or are > simply ignorant of them. > > Separate problems, but certainly there is a lesson to be > learned here: the operational community has long known that > filtering downstream/customer ASs for prefix announcements is > a Good Thing, yet the majority of ISPs on the planet simply do > not do it... > > - - ferg > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.6.3 (Build 3017) > > wj8DBQFHxbeVq1pz9mNUZTMRAnsRAJ4ugSnmh8m/9W6s6nVFrITMP55ziACgxmb8 > YdUCHYvWrodg4D/xOOW7V0M= > =A4Ox > -----END PGP SIGNATURE----- > > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(at)netzero.net > ferg's tech blog: http://fergdawg.blogspot.com/ > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments. _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 10:57:14 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0D42728C881; Thu, 28 Feb 2008 10:57:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.292 X-Spam-Level: X-Spam-Status: No, score=-0.292 tagged_above=-999 required=5 tests=[AWL=-0.474, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_SORBS_WEB=0.619, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 45x-E0ORSd-v; Thu, 28 Feb 2008 10:57:08 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B02C3A6EE1; Thu, 28 Feb 2008 10:57:08 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A79E73A6827 for ; Thu, 28 Feb 2008 10:57:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QBvVB-ajDdAx for ; Thu, 28 Feb 2008 10:57:05 -0800 (PST) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.171]) by core3.amsl.com (Postfix) with ESMTP id CC9AE3A6E92 for ; Thu, 28 Feb 2008 10:57:05 -0800 (PST) Received: by wf-out-1314.google.com with SMTP id 25so3279001wfa.31 for ; Thu, 28 Feb 2008 10:56:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=HsFtt+h6/44TEdl/CDk4g4uSdlnKISnTJpgBSfZjjp0=; b=khmex5Y6BCLWkkSsd6R3tIJDjDdWVQoFEe8x1MOvIgfniWqww/yqtYQldcLgxGfgxQ5OrZXB0MzJxAqIg1Mn54ud9zlQ4GvNGgpAPZIxeWkd+96PUIJLAG75Dx+WtOaXwbULVzRsfy6H86a6a1swMIwj87Ih0Abg1DYlFjpC/1E= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=S5ER9s9/nFXDiCJ3RprIYF6ALdO/kuvxYdNPqdyOiSGbgU7yG+hnjxxGailK9J6Nr9ZsBpKuWRb0qT+5pZT+Sj4Xk4JBfMSuerO3Sqjq9n8FkMfz8fS5nNLA04j5+JcXURHEER1IWeEqjZwO9BFUnG6tNrvjZ04ndM/+ea0f6oY= Received: by 10.143.37.20 with SMTP id p20mr6509032wfj.236.1204225018500; Thu, 28 Feb 2008 10:56:58 -0800 (PST) Received: by 10.143.164.14 with HTTP; Thu, 28 Feb 2008 10:56:58 -0800 (PST) Message-ID: <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> Date: Thu, 28 Feb 2008 10:56:58 -0800 From: "Vishwas Manral" To: "Sandra Murphy" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Sandra, Thanks again for the information in both the mails. I got to read the differences between the RIR and the IRR. I also agree to the fact that in case we have some mechanism which can verify all the attributes of a route, then such a certificate which does this would be helpful, and then the infrastructure you talk about would be helpful too. I understand the fact that we are talking about a NLRI and the AS element in the AS_PATH. I still look very interestingly at differences we have between AS_SEQUENCE and AS_SET (if we are to verify an update more than one hop away which element in the AS-SET to verify it against - not much difference though if we have only one AS number in the AS_PATH). The only point I want to add to the discussion is because we have to verify the Origin only in the first hop peer, we do not need a global database (as I mentioned we are not saving against malicious attacks in any case). Thanks, Vishwas On Thu, Feb 28, 2008 at 10:13 AM, Sandra Murphy wrote: > > On Thu, 28 Feb 2008, Vishwas Manral wrote: > > > Hi Sandra, > > > > > After reading a bit through what Pekka/ Danny/ Joe Abely said away in > > which we could update the filters between peers automatically(only > > relating to routes originated by the peer), from the RIR, we may > > achieve the very same functionality. > > > > Generating filters from IRR (not RIR, a point it took me a while to learn) > data is indeed similar, with the following differences: > > (a) Security (authenticity, integrity and authorization) of IRR data > varies widely among IRR's. And there are quite a few IRRs. > > (b) Even those IRRs associated with RIRs can protect authn/int/authr of > only that data that comes from their own members. > > (c) RIPE uses the strongest security model among the many IRRs, but their > system relies on protection of the communication with the user (and the > protection varies from user to user) and the protection of communication > to the person accessing the data. The protection is not stored with the > data, so the reader must rely on the IRR to get it right. I don't think > the reader can tell what protection was used to put the data in there, so > there's no way for the reader to judge the assurance in the data. > > (d) This is not a mechanism that could extent to protection of the other > BGP features that you have mentioned. So if/when we decide to work on > those features, we'd have to start over with the system we are building > now anyway. > > --Sandy > > > > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Thu Feb 28 11:03:32 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 81D653A6F28; Thu, 28 Feb 2008 11:03:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.518 X-Spam-Level: X-Spam-Status: No, score=-1.518 tagged_above=-999 required=5 tests=[AWL=-1.081, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jJk6mpyy6R6y; Thu, 28 Feb 2008 11:03:32 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF3B03A6EEF; Thu, 28 Feb 2008 11:03:29 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DEB6B3A6F12 for ; Thu, 28 Feb 2008 11:03:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sB5ClYazGoJY for ; Thu, 28 Feb 2008 11:03:21 -0800 (PST) Received: from gv-out-0910.google.com (gv-out-0910.google.com [216.239.58.187]) by core3.amsl.com (Postfix) with ESMTP id C508E3A6F17 for ; Thu, 28 Feb 2008 11:02:41 -0800 (PST) Received: by gv-out-0910.google.com with SMTP id i36so1204835gve.15 for ; Thu, 28 Feb 2008 11:02:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=rz+9/Z6n3hdvng+CQR5MTZAPcxfRZxD9OgWwfWN1ZaM=; b=prG8C/X6PY6oO+qM5k+CGT/O1s0XtisBw7+d6y6yKXgu3y6at9swNeqjRYYqipzMOGbH0wmAHOQIVMkLFvuSC2yZluFxRuyqQ8gPhvTs5Y6kjAL61833LsK8l0NDE6ov7Yp+8RAyakSa9CAVaCWcZZMBZNJXpdqQ2I2GugXVy/w= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=aeGL6qwPYtPhW9TJgqNP1YFQDxgur/xrq+AS/MopP9S+wuh0DEEJfMaYa8OPQ42JbLJ0dR6UAkjihf/qY14idvDYyXaal+1ODvXoOhax7yMNa2yfGWncR+eBtAHQmGoEKTcQEZXk44H+2CnqBo6NMkUCv+Ve2IztlfbLM8N3kSY= Received: by 10.142.133.15 with SMTP id g15mr6528061wfd.9.1204225352404; Thu, 28 Feb 2008 11:02:32 -0800 (PST) Received: by 10.143.164.14 with HTTP; Thu, 28 Feb 2008 11:02:31 -0800 (PST) Message-ID: <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> Date: Thu, 28 Feb 2008 11:02:31 -0800 From: "Vishwas Manral" To: "Sandra Murphy" In-Reply-To: <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> MIME-Version: 1.0 Content-Disposition: inline References: <47C4E38E.1070105@bogus.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi Sandra, To further clarify, > The only point I want to add to the discussion is because we have to > verify the Origin only in the first hop peer, we do not need a global > database (as I mentioned we are not saving against malicious attacks > in any case). This would mean for someone who gets the information from RIPE does not need to necessarily use the mechanism the way it currently stands. Thanks, Vishwas On Thu, Feb 28, 2008 at 10:56 AM, Vishwas Manral wrote: > Hi Sandra, > > Thanks again for the information in both the mails. I got to read the > differences between the RIR and the IRR. I also agree to the fact that > in case we have some mechanism which can verify all the attributes of > a route, then such a certificate which does this would be helpful, and > then the infrastructure you talk about would be helpful too. > > I understand the fact that we are talking about a NLRI and the AS > element in the AS_PATH. I still look very interestingly at differences > we have between AS_SEQUENCE and AS_SET (if we are to verify an update > more than one hop away which element in the AS-SET to verify it > against - not much difference though if we have only one AS number in > the AS_PATH). > > The only point I want to add to the discussion is because we have to > verify the Origin only in the first hop peer, we do not need a global > database (as I mentioned we are not saving against malicious attacks > in any case). > > Thanks, > Vishwas > > > > On Thu, Feb 28, 2008 at 10:13 AM, Sandra Murphy wrote: > > > > On Thu, 28 Feb 2008, Vishwas Manral wrote: > > > > > Hi Sandra, > > > > > > > > After reading a bit through what Pekka/ Danny/ Joe Abely said away in > > > which we could update the filters between peers automatically(only > > > relating to routes originated by the peer), from the RIR, we may > > > achieve the very same functionality. > > > > > > > Generating filters from IRR (not RIR, a point it took me a while to learn) > > data is indeed similar, with the following differences: > > > > (a) Security (authenticity, integrity and authorization) of IRR data > > varies widely among IRR's. And there are quite a few IRRs. > > > > (b) Even those IRRs associated with RIRs can protect authn/int/authr of > > only that data that comes from their own members. > > > > (c) RIPE uses the strongest security model among the many IRRs, but their > > system relies on protection of the communication with the user (and the > > protection varies from user to user) and the protection of communication > > to the person accessing the data. The protection is not stored with the > > data, so the reader must rely on the IRR to get it right. I don't think > > the reader can tell what protection was used to put the data in there, so > > there's no way for the reader to judge the assurance in the data. > > > > (d) This is not a mechanism that could extent to protection of the other > > BGP features that you have mentioned. So if/when we decide to work on > > those features, we'd have to start over with the system we are building > > now anyway. > > > > --Sandy > > > > > > > > > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:27 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 985B928C40C; Fri, 29 Feb 2008 08:13:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.737 X-Spam-Level: X-Spam-Status: No, score=-0.737 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4E+UZYRriTG2; Fri, 29 Feb 2008 08:13:26 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 472F328C609; Fri, 29 Feb 2008 08:13:12 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5C54B28C29D; Thu, 28 Feb 2008 08:35:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yBe3yFjoImCS; Thu, 28 Feb 2008 08:35:30 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id CAEA828C1CC; Thu, 28 Feb 2008 08:35:30 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id m1SGYviS029835; Thu, 28 Feb 2008 10:34:57 -0600 Received: from nemo.columbia.ads.sparta.com (nemo.columbia.sparta.com [157.185.80.75]) by Beta5.sparta.com (8.12.11/8.13.1) with ESMTP id m1SGYZmi013181; Thu, 28 Feb 2008 10:34:56 -0600 Received: from SANDYM-LT.columbia.ads.sparta.com ([157.185.81.104]) by nemo.columbia.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Thu, 28 Feb 2008 11:34:52 -0500 Date: Thu, 28 Feb 2008 11:34:48 -0500 (Eastern Standard Time) From: Sandra Murphy To: Vishwas Manral In-Reply-To: <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> Message-ID: References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> X-X-Sender: sandy@nemo.columbia.sparta.com MIME-Version: 1.0 X-OriginalArrivalTime: 28 Feb 2008 16:34:52.0240 (UTC) FILETIME=[D7C53D00:01C87A27] X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (M4.sparta.com [157.185.61.2]); Thu, 28 Feb 2008 10:34:57 -0600 (CST) X-Mailman-Approved-At: Fri, 29 Feb 2008 08:13:11 -0800 Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Thu, 28 Feb 2008, Vishwas Manral wrote: > Hi Stephen, > > Ok, I understand the model you talk about now. Yes the CPU may not be > the biggest concern as the server is verifying the Cert's offline. I > guess this would also lead to models like CRL's for revocation. > > Like I said earlier as SIDR does not stop malicious attacks, but only > ones caused unintentionally, is it not possible to actually use a > simpler mechanism to get over such errors? > > Thanks, > Vishwas > Vishwas, the current SIDR work is focused on preventing attacks (faulty/misconfigured/subverted/malicious/whatever) against the origination of routing advertisements, by providing strong assurance of who holds what prefixes, and therefore who can authorize origination of a prefix. (And in the leak that is the subject of this email chain, the fully deployed system would indeed have detected the mis-origination, in any AS that had received the mis-origination, not just the direct link up from the customer.) The concerns you raise are recognized subjects for further work. But all of the very many proposals for securing BGP (see: S-BGP, soBGP, psBGP, SPV, etc., etc.) rely on protecting this initial bit of routing information: originating a route to a prefix. So defining this work is a basis for defining future fuller protection techniques as well. All simpler mechanisms I have ever heard of for protecting origination of routing advertisements are either much lower assurance, or based on data with similar strong protections but not more assurance, or not extensible to protecting more features of BGP exchanges. --Sandy _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:28 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 198E928C5B3; Fri, 29 Feb 2008 08:13:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.483 X-Spam-Level: X-Spam-Status: No, score=-0.483 tagged_above=-999 required=5 tests=[AWL=-0.046, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l+UBqOvRz-bz; Fri, 29 Feb 2008 08:13:22 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 270F028C5C8; Fri, 29 Feb 2008 08:12:42 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1623B3A6920 for ; Wed, 27 Feb 2008 12:37:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xb9yL17ltgL4 for ; Wed, 27 Feb 2008 12:37:48 -0800 (PST) Received: from smtp2.mail.adnap.net.au (smtp2.mail.adnap.net.au [203.6.132.66]) by core3.amsl.com (Postfix) with ESMTP id 640563A69A8 for ; Wed, 27 Feb 2008 12:37:21 -0800 (PST) Received: from 219-90-226-210.ip.adam.com.au ([219.90.226.210] helo=mail.nosense.org) by smtp2.mail.adnap.net.au with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1JUSzb-000DgS-C9; Thu, 28 Feb 2008 07:05:07 +1030 Received: from ubu.nosense.org (localhost.localdomain [127.0.0.1]) by mail.nosense.org (Postfix) with SMTP id 02CA14571; Thu, 28 Feb 2008 07:07:35 +1030 (CST) Date: Thu, 28 Feb 2008 07:07:35 +1030 From: Mark Smith To: "Paul Ferguson" Message-Id: <20080228070735.e2b7bcb0.nanog@85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org> In-Reply-To: <20080227.111847.6641.1@webmail06.vgs.untd.com> References: <20080227.111847.6641.1@webmail06.vgs.untd.com> X-Mailer: Sylpheed 2.4.8 (GTK+ 2.12.7; i686-pc-linux-gnu) X-Location: Adelaide, Australia Mime-Version: 1.0 X-Mailman-Approved-At: Fri, 29 Feb 2008 08:12:41 -0800 Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Wed, 27 Feb 2008 19:18:47 GMT "Paul Ferguson" wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > - -- Ron Bonica wrote: > > >I think that it would helpful if this working group were to produce a > >document (or two) recommending BGP policy for ISP. > > If you do decide to do this, please engage people in the operational > community. Please. > (Am an operator ...) It seems to me that they're the ones not engaging. They seem to be the ones not signing up to IETF mailing lists, or spending time reading drafts and providing feedback. If they choose not to be involved in a process they can be, I don't think they can blame the other party for their own lack of involvement. > Over on the NANOG list, as many of you are probably already aware, > this issue is one that has been highlighted on several ocassions -- > the fact that appropriate RFCs and BCPs exist to address specific > operational issues, yet many ISPs choose to ignore them or are > simply ignorant of them. > It seems to me that remaining ignorant is a choice they've decided to make, and one that the IETF can't really force them to make differently. "For the good of the Internet" doesn't seem to hold much sway ... > Separate problems, but certainly there is a lesson to be > learned here: the operational community has long known that > filtering downstream/customer ASs for prefix announcements is > a Good Thing, yet the majority of ISPs on the planet simply do > not do it... > > - - ferg > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.6.3 (Build 3017) > > wj8DBQFHxbeVq1pz9mNUZTMRAnsRAJ4ugSnmh8m/9W6s6nVFrITMP55ziACgxmb8 > YdUCHYvWrodg4D/xOOW7V0M= > =A4Ox > -----END PGP SIGNATURE----- > > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(at)netzero.net > ferg's tech blog: http://fergdawg.blogspot.com/ > > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec -- "Sheep are slow and tasty, and therefore must remain constantly alert." - Bruce Schneier, "Beyond Fear" _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:30 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A9CE428C5CA; Fri, 29 Feb 2008 08:13:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.718 X-Spam-Level: X-Spam-Status: No, score=-0.718 tagged_above=-999 required=5 tests=[AWL=-0.281, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id thQS5L5NidnN; Fri, 29 Feb 2008 08:13:29 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A5B3C28C672; Fri, 29 Feb 2008 08:13:12 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9BD6728C12C; Thu, 28 Feb 2008 12:06:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oNQ30Wu4Y-SL; Thu, 28 Feb 2008 12:06:33 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id E0C6828C9B8; Thu, 28 Feb 2008 12:03:32 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id m1SK3FbM009828; Thu, 28 Feb 2008 14:03:16 -0600 Received: from nemo.columbia.ads.sparta.com (nemo.columbia.sparta.com [157.185.80.75]) by Beta5.sparta.com (8.12.11/8.13.1) with ESMTP id m1SK3Do8027336; Thu, 28 Feb 2008 14:03:13 -0600 Received: from SANDYM-LT.columbia.ads.sparta.com ([157.185.81.104]) by nemo.columbia.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Thu, 28 Feb 2008 15:03:13 -0500 Date: Thu, 28 Feb 2008 15:03:12 -0500 (Eastern Standard Time) From: Sandra Murphy To: Vishwas Manral In-Reply-To: <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> Message-ID: References: <47C4E38E.1070105@bogus.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> X-X-Sender: sandy@nemo.columbia.sparta.com MIME-Version: 1.0 X-OriginalArrivalTime: 28 Feb 2008 20:03:13.0697 (UTC) FILETIME=[F3383110:01C87A44] X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (M4.sparta.com [157.185.61.2]); Thu, 28 Feb 2008 14:03:16 -0600 (CST) X-Mailman-Approved-At: Fri, 29 Feb 2008 08:13:11 -0800 Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Thu, 28 Feb 2008, Vishwas Manral wrote: > Hi Sandra, > > Thanks again for the information in both the mails. I got to read the > differences between the RIR and the IRR. I also agree to the fact that > in case we have some mechanism which can verify all the attributes of > a route, then such a certificate which does this would be helpful, and > then the infrastructure you talk about would be helpful too. > > I understand the fact that we are talking about a NLRI and the AS > element in the AS_PATH. I still look very interestingly at differences > we have between AS_SEQUENCE and AS_SET (if we are to verify an update > more than one hop away which element in the AS-SET to verify it > against - not much difference though if we have only one AS number in > the AS_PATH). You are right that we have not considered how you validate an AS_PATH where the origination is an AS_SET. That has been looked at before, and it is complicated and the possibilities of providing some protection aren't good, even on the theoretical level. Keep in mind that the number of BGP Updates that contain AS_SET anywhere in the AS_PATH are a tiny, tiny, percentage (one figure I saw recently was 10K out of a base of 91M updates - .01%). As a wg, we decided not to work on this right now. > > The only point I want to add to the discussion is because we have to > verify the Origin only in the first hop peer, we do not need a global > database (as I mentioned we are not saving against malicious attacks > in any case). As long as *every* first hop peer does the appropriate strong verification, you would be good. But this system allows ASs beyond the first hop to verify the origination of the route. So, for example, UUNET could have verified the announcements it saw from PCCW even if PCCW did no check and propogated the bogus announcement. (As "Origin" is a BGP attribute with a different semantics, perhaps we should avoid using that term in this context to avoid confusion.) And, finally, yes we *are* protecting against malicious attacks (as well as accidental attacks) on those features we *are* intending to protect. No, we are not protecting against malicious attacks (or accidental attacks) on features we are *not* intending to protect. The difference is not malicious vs accidental, the difference is scope of protection. You think we haven't gone far enough, I'm saying what we're building is the basis for any further protection. --Sandy _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:33 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2618628C64F; Fri, 29 Feb 2008 08:13:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.671 X-Spam-Level: X-Spam-Status: No, score=-0.671 tagged_above=-999 required=5 tests=[AWL=-0.234, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 94-gzP7glS8h; Fri, 29 Feb 2008 08:13:27 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6A21B28C651; Fri, 29 Feb 2008 08:13:12 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 26EAC28C9AB; Thu, 28 Feb 2008 10:17:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qed2Kx3ALFbU; Thu, 28 Feb 2008 10:17:10 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 6A0AE28C9D9; Thu, 28 Feb 2008 10:13:53 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id m1SIDSkG003371; Thu, 28 Feb 2008 12:13:28 -0600 Received: from nemo.columbia.ads.sparta.com (nemo.columbia.sparta.com [157.185.80.75]) by Beta5.sparta.com (8.12.11/8.13.1) with ESMTP id m1SIDScQ019850; Thu, 28 Feb 2008 12:13:28 -0600 Received: from SANDYM-LT.columbia.ads.sparta.com ([157.185.81.104]) by nemo.columbia.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Thu, 28 Feb 2008 13:13:28 -0500 Date: Thu, 28 Feb 2008 13:13:27 -0500 (Eastern Standard Time) From: Sandra Murphy To: Vishwas Manral In-Reply-To: <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> Message-ID: References: <47C4E38E.1070105@bogus.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> X-X-Sender: sandy@nemo.columbia.sparta.com MIME-Version: 1.0 X-OriginalArrivalTime: 28 Feb 2008 18:13:28.0256 (UTC) FILETIME=[9DFDA400:01C87A35] X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (M4.sparta.com [157.185.61.2]); Thu, 28 Feb 2008 12:13:28 -0600 (CST) X-Mailman-Approved-At: Fri, 29 Feb 2008 08:13:11 -0800 Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Thu, 28 Feb 2008, Vishwas Manral wrote: > Hi Sandra, > > After reading a bit through what Pekka/ Danny/ Joe Abely said away in > which we could update the filters between peers automatically(only > relating to routes originated by the peer), from the RIR, we may > achieve the very same functionality. > Generating filters from IRR (not RIR, a point it took me a while to learn) data is indeed similar, with the following differences: (a) Security (authenticity, integrity and authorization) of IRR data varies widely among IRR's. And there are quite a few IRRs. (b) Even those IRRs associated with RIRs can protect authn/int/authr of only that data that comes from their own members. (c) RIPE uses the strongest security model among the many IRRs, but their system relies on protection of the communication with the user (and the protection varies from user to user) and the protection of communication to the person accessing the data. The protection is not stored with the data, so the reader must rely on the IRR to get it right. I don't think the reader can tell what protection was used to put the data in there, so there's no way for the reader to judge the assurance in the data. (d) This is not a mechanism that could extent to protection of the other BGP features that you have mentioned. So if/when we decide to work on those features, we'd have to start over with the system we are building now anyway. --Sandy _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:34 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F400028C722; Fri, 29 Feb 2008 08:13:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.652 X-Spam-Level: X-Spam-Status: No, score=-0.652 tagged_above=-999 required=5 tests=[AWL=-0.215, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id drujmCD+M3Ri; Fri, 29 Feb 2008 08:13:28 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8388228C664; Fri, 29 Feb 2008 08:13:12 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 28E4D3A67C0; Thu, 28 Feb 2008 10:35:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ExemVKMSlbdB; Thu, 28 Feb 2008 10:35:15 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 9C2723A688D; Thu, 28 Feb 2008 10:35:15 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id m1SIYouj004699; Thu, 28 Feb 2008 12:34:50 -0600 Received: from nemo.columbia.ads.sparta.com (nemo.columbia.sparta.com [157.185.80.75]) by Beta5.sparta.com (8.12.11/8.13.1) with ESMTP id m1SIYox4021289; Thu, 28 Feb 2008 12:34:51 -0600 Received: from SANDYM-LT.columbia.ads.sparta.com ([157.185.81.104]) by nemo.columbia.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Thu, 28 Feb 2008 13:34:50 -0500 Date: Thu, 28 Feb 2008 13:34:49 -0500 (Eastern Standard Time) From: Sandra Murphy To: Vishwas Manral In-Reply-To: <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> Message-ID: References: <47C4E38E.1070105@bogus.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> X-X-Sender: sandy@nemo.columbia.sparta.com MIME-Version: 1.0 X-OriginalArrivalTime: 28 Feb 2008 18:34:50.0117 (UTC) FILETIME=[9A0A1B50:01C87A38] X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (M4.sparta.com [157.185.61.2]); Thu, 28 Feb 2008 12:34:50 -0600 (CST) X-Mailman-Approved-At: Fri, 29 Feb 2008 08:13:11 -0800 Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Thu, 28 Feb 2008, Vishwas Manral wrote: > Hi Sandra, > > Thanks for the reply. You put forward the all the points correctly and > precisely. > > My concern is that, unlike the normal PKI model where the final output > is to authenticate the user using the just the certificate, the > Routing based model we are now talking about verifying just a small > bit of information which is used for the BGP Best Path selection - the > sanity of which we are trying to protect, and protecting just the > Origin does not make sense in a malicious case at all. Though you may > say that it protects in case the malicious person plays with the > Origin attribute, it however does not protect much as with the same > amount of effort a malicious person can still cause the same attacks. > What increases is the over head in each of the domains to maintain the > new PKI information. > (Yes, I know I already replied to this message, but to a different point and I wanted to keep them separate.) When I say origination of route advertisements, I am not talking about the ORIGIN attribute in the BGP Update. I am talking about an ISP that creates a BGP Update that has an AS_PATH containing only its AS number. That is the point at which a route is first advertised into the BGP system. I'm talking about an action, not a protocol field. It is indeed possible for a route to modify attributes other than the AS_PATH. But many of those (local preference, community strings, etc) have only local significance. And as we have seen, bogus AS_PATHs have a whole lot of impact. --Sandy _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:36 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 64C1728C72D; Fri, 29 Feb 2008 08:13:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.637 X-Spam-Level: X-Spam-Status: No, score=-0.637 tagged_above=-999 required=5 tests=[AWL=-0.200, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jRHKOA1S2rFV; Fri, 29 Feb 2008 08:13:30 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C103228C680; Fri, 29 Feb 2008 08:13:12 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F3FF428C1BE; Thu, 28 Feb 2008 13:13:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CTALd5LDcs4L; Thu, 28 Feb 2008 13:13:21 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id F2A7428C776; Thu, 28 Feb 2008 13:12:43 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id m1SLCEn0013681; Thu, 28 Feb 2008 15:12:14 -0600 Received: from nemo.columbia.ads.sparta.com (nemo.columbia.sparta.com [157.185.80.75]) by Beta5.sparta.com (8.12.11/8.13.1) with ESMTP id m1SLCE9i031585; Thu, 28 Feb 2008 15:12:14 -0600 Received: from SANDYM-LT.columbia.ads.sparta.com ([157.185.81.104]) by nemo.columbia.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Thu, 28 Feb 2008 16:12:14 -0500 Date: Thu, 28 Feb 2008 16:12:13 -0500 (Eastern Standard Time) From: Sandra Murphy To: Vishwas Manral In-Reply-To: <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> Message-ID: References: <47C4E38E.1070105@bogus.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> <77ead0ec0802280649k66671fc9s9fc24314963c68a0@mail.gmail.com> <77ead0ec0802280956s3dcff81cx25fd152ea1c798fb@mail.gmail.com> <77ead0ec0802281056y2862d71dt8b753f5f3f3b0df9@mail.gmail.com> <77ead0ec0802281102o3e2efedl479ff6351dca0f63@mail.gmail.com> X-X-Sender: sandy@nemo.columbia.sparta.com MIME-Version: 1.0 X-OriginalArrivalTime: 28 Feb 2008 21:12:14.0275 (UTC) FILETIME=[97324130:01C87A4E] X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (M4.sparta.com [157.185.61.2]); Thu, 28 Feb 2008 15:12:14 -0600 (CST) X-Mailman-Approved-At: Fri, 29 Feb 2008 08:13:11 -0800 Cc: opsec wg mailing list , Stephen Kent , sidr@ietf.org Subject: Re: [OPSEC] [Sidr] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org On Thu, 28 Feb 2008, Vishwas Manral wrote: > Hi Sandra, > > To further clarify, >> The only point I want to add to the discussion is because we have to >> verify the Origin only in the first hop peer, we do not need a global >> database (as I mentioned we are not saving against malicious attacks >> in any case). > This would mean for someone who gets the information from RIPE does > not need to necessarily use the mechanism the way it currently stands. > As long as: (a) you were interested in protecting only those prefixes that are managed by RIPE - data in RIPE about other prefixes doesn't fall under the protection of their security model, and the RIPE database does not contain all prefixes, and (b) you were comfortable with the trust model of RIPE (they authenticate the upload of the data with varying strength of authentication and you must get the data, whose aussurance you can not yourself verify, from them and only them with a protected transport they support). As an additional wrinkle, I believe that RIPE does allocate prefixes to LIRs. I do not know if the LIRs are required to maintain the RIPE security model in their allocations. --Sandy _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:50 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF04E28C5D9; Fri, 29 Feb 2008 08:13:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.495 X-Spam-Level: X-Spam-Status: No, score=-0.495 tagged_above=-999 required=5 tests=[AWL=-0.058, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TTJfCSXY2a87; Fri, 29 Feb 2008 08:13:50 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 378AB28C5F5; Fri, 29 Feb 2008 08:13:29 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 953883A680D for ; Wed, 27 Feb 2008 19:08:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mYOZfO2bJ-qL for ; Wed, 27 Feb 2008 19:08:19 -0800 (PST) Received: from mx11.bbn.com (unknown [128.33.0.80]) by core3.amsl.com (Postfix) with ESMTP id 3715228C687 for ; Wed, 27 Feb 2008 19:07:38 -0800 (PST) Received: from dommiel.bbn.com ([192.1.122.15] helo=[169.223.13.71]) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1JUZ7A-0005Gk-4F; Wed, 27 Feb 2008 22:07:20 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> Date: Wed, 27 Feb 2008 22:07:15 -0500 To: "Vishwas Manral" From: Stephen Kent X-Mailman-Approved-At: Fri, 29 Feb 2008 08:13:27 -0800 Cc: opsec wg mailing list , Stephen Kent Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 5:12 PM -0800 2/27/08, Vishwas Manral wrote: >Hi folks, > >I looked at the SIDR documents in brief. It can probably be used to >help prevent any attacks caused due to non-malicious intent. > >I found easy ways to get over the SIDR security when done with a >malicious intent. SIDR just tells the mapping between AFI, AF and AS >number which can originate the same. However the choosing of a route >by BGP does not depend on these fields alone. So if a malicious router >changed the attributes attached to an NLRI update so that it becomes >the chosen AS to the prefix (of course without changing the >originating AS field). It can still redirect all the traffic to itself >for the prefix and then do whatever malicious it wants to do, >including just drop the packet. > >In this way still achieving the attack, but this time for sure with >malicious intent. > >Thanks, >Vishwas Your example of how an AS can tamper with a route, without changing the origin AS assertion is correct. I think the SIDR WG participants understand that. The work so far i SIDR focuses on establishing an infrastructure that will enable more comprehensive routing security capabilities in the future. Both the soBGP and SBGP proposal need this sort of infrastructure, so it is viewed as a reasonable initial effort. I also agree with your observation that the infrastructure makes it potentially easier to distinguish between some forms of attacks vs. accidental routing errors, and that, in itself, seems valuable too. Steve _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:51 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 228C428C758; Fri, 29 Feb 2008 08:13:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.493 X-Spam-Level: X-Spam-Status: No, score=-0.493 tagged_above=-999 required=5 tests=[AWL=-0.056, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j+IsUEiAIjWX; Fri, 29 Feb 2008 08:13:50 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 77DA028C6B8; Fri, 29 Feb 2008 08:13:29 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E93AA28CA4D for ; Wed, 27 Feb 2008 20:14:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p0TP5aCDW6WJ for ; Wed, 27 Feb 2008 20:14:39 -0800 (PST) Received: from mx11.bbn.com (unknown [128.33.0.80]) by core3.amsl.com (Postfix) with ESMTP id 6AE663A6B41 for ; Wed, 27 Feb 2008 20:14:11 -0800 (PST) Received: from dommiel.bbn.com ([192.1.122.15] helo=[169.223.13.71]) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1JUa9Z-0005kN-5f; Wed, 27 Feb 2008 23:13:54 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> Date: Wed, 27 Feb 2008 23:13:24 -0500 To: "Vishwas Manral" From: Stephen Kent X-Mailman-Approved-At: Fri, 29 Feb 2008 08:13:27 -0800 Cc: opsec wg mailing list , Stephen Kent Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org At 7:13 PM -0800 2/27/08, Vishwas Manral wrote: >Hi Steve, > >Thanks a lot for the comments. I agree it can be a good first step but >not sure what the future holds. > >I am not sure if a heavy solution like this is required which only >gives reasonable security. What about the CPU DoS attacks that can be >result when new random routes are injected into a domain. > >Thanks again, >Vishwas > Vishwas, The current SIDR plans for use of this infrastructure calls for ISPs to download the certs, CRLs, ROAs, etc. on a daily basis, to process them offline, and to use the results in constructing route filters. Even the more comprehensive models offered by SBGP and soBGP did not require routers to process certs, CRLs, etc., i.e., they assume offline processing to verify signed objects and pass the results to routers to use in route verification. Give this background, I don't know what sort of CPU DoS attacks you are worried about. Could you provide some additional context? Steve _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From opsec-bounces@ietf.org Fri Feb 29 08:13:52 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C83B928C6B8; Fri, 29 Feb 2008 08:13:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.021 X-Spam-Level: X-Spam-Status: No, score=0.021 tagged_above=-999 required=5 tests=[AWL=-0.542, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, HTML_MESSAGE=1, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8HO6UQaJ1rmb; Fri, 29 Feb 2008 08:13:52 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 93A5628C700; Fri, 29 Feb 2008 08:13:29 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6C1AB3A6847; Thu, 28 Feb 2008 03:35:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aR1uWm5mUucH; Thu, 28 Feb 2008 03:35:41 -0800 (PST) Received: from mx11.bbn.com (mx11.bbn.com [128.33.0.80]) by core3.amsl.com (Postfix) with ESMTP id 14FB028C730; Thu, 28 Feb 2008 03:35:33 -0800 (PST) Received: from dommiel.bbn.com ([192.1.122.15] helo=[169.223.13.71]) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1JUh2q-0000CD-4F; Thu, 28 Feb 2008 06:35:25 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> References: <47C4E38E.1070105@bogus.com> <77ead0ec0802262134q6ac2e497m91ca3e8237e021e4@mail.gmail.com> <158FF097-65BB-49BF-B8A1-1191281F2F93@cisco.com> <77ead0ec0802262229wd5e695ag95021040d7492828@mail.gmail.com> <3DD63532-9442-4B12-B1DF-5EA70A66C87D@cisco.com> <77ead0ec0802271712m53e8a1d4sc9cae09ee75686f7@mail.gmail.com> <77ead0ec0802271913u2c032ec2y2d03b73cb36de37f@mail.gmail.com> <77ead0ec0802272031j6d958279tf3028c4096093020@mail.gmail.com> Date: Thu, 28 Feb 2008 06:35:20 -0500 To: "Vishwas Manral" From: Stephen Kent X-Mailman-Approved-At: Fri, 29 Feb 2008 08:13:27 -0800 Cc: opsec wg mailing list , sidr@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0061980969==" Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org --===============0061980969== Content-Type: multipart/alternative; boundary="============_-1007923971==_ma============" --============_-1007923971==_ma============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" At 8:31 PM -0800 2/27/08, Vishwas Manral wrote: >Hi Stephen, > >The point I raise is that there is a cost associated with this, using >certificates has a CPU cost associated with it. > >I may be missing the point but even if you leave aside the cost of an >off line server to do this check but if the checks are done on each >new prefix we can still overload the off line server. If we do things >like rate limiting we can still have an attacks, or cause delays in >the convergence times. > >Thanks, >Vishwas I think you are missing the point. So long as the processing is done as an offline operation, not as a gating item in routing, it does not strike me as a DoS concern. The initial use of the infrastructure is analogous to downloading IRR databases and processing the RPSL assertions, an operation many ISPs perform today on a daily basis. More to the point, folks have implemented the necessary software and tested it with about 20K certs and CRLs and 10K ROAs, a reasonable starting point. I don't have the precise figures in front of me now, but I believe their results show that the time to do all the processing (on a laptop) is about 20-30 minutes, and the time is dominated by the retrieval of the data from online repositories, not by the crypto operations per se. For a once daily, offline operations, this seems quite reasonable. Steve --============_-1007923971==_ma============ Content-Type: text/html; charset="us-ascii" Re: [OPSEC] pccw as17557 leak...
At 8:31 PM -0800 2/27/08, Vishwas Manral wrote:
Hi Stephen,

The point I raise is that there is a cost associated with this, using
certificates has a CPU cost associated with it.

I may be missing the point but even if you leave aside the cost of an
off line server to do this check but if the checks are done on each
new prefix we can still overload the off line server. If we do things
like rate limiting we can still have an attacks, or cause delays in
the convergence times.

Thanks,
Vishwas

I think you are missing the point. So long as the processing is done as an offline operation, not as a gating item in routing, it does not strike me as a DoS concern. The initial use of the infrastructure is analogous to downloading IRR databases and processing the RPSL assertions, an operation many ISPs perform today on a daily basis.

More to the point, folks have implemented the necessary software and tested it with about 20K certs and CRLs and 10K ROAs, a reasonable starting point. I don't have the precise figures in front of me now, but I believe their results show that the time to do all the processing (on a laptop) is about 20-30 minutes, and the time is dominated by the retrieval of the data from online repositories, not by the crypto operations per se. For a once daily, offline operations, this seems quite reasonable.

Steve
--============_-1007923971==_ma============-- --===============0061980969== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec --===============0061980969==-- From opsec-bounces@ietf.org Fri Feb 29 09:05:35 2008 Return-Path: X-Original-To: ietfarch-opsec-archive@core3.amsl.com Delivered-To: ietfarch-opsec-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E069728C5C8; Fri, 29 Feb 2008 09:05:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.081 X-Spam-Level: X-Spam-Status: No, score=-1.081 tagged_above=-999 required=5 tests=[AWL=-0.644, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pxAuBVL35-Uy; Fri, 29 Feb 2008 09:05:30 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3932928C414; Fri, 29 Feb 2008 09:05:30 -0800 (PST) X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2BE7A28C414 for ; Fri, 29 Feb 2008 09:05:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VmentAXxRoIh for ; Fri, 29 Feb 2008 09:05:24 -0800 (PST) Received: from QMTA05.emeryville.ca.mail.comcast.net (qmta05.emeryville.ca.mail.comcast.net [76.96.30.48]) by core3.amsl.com (Postfix) with ESMTP id D5B2F28C46E for ; Fri, 29 Feb 2008 09:05:23 -0800 (PST) Received: from OMTA03.emeryville.ca.mail.comcast.net ([76.96.30.27]) by QMTA05.emeryville.ca.mail.comcast.net with comcast id vQ7c1Y0010b6N64A50Ld00; Fri, 29 Feb 2008 17:04:24 +0000 Received: from Harrington73653 ([24.128.66.199]) by OMTA03.emeryville.ca.mail.comcast.net with comcast id vV571Y0074HwxpC8P00000; Fri, 29 Feb 2008 17:05:12 +0000 X-Authority-Analysis: v=1.0 c=1 a=yrh8Z8tmAAAA:8 a=48vgC7mUAAAA:8 a=V_XHQIPOwKpdW1i_c8oA:9 a=wObuYUfXatfdVCBY7YYA:7 a=dtNJ3xaCVr82K2SQ4o5fPBovm08A:4 a=Ii8CCqQrlkMA:10 a=si9q_4b84H0A:10 a=hPjdaMEvmhQA:10 a=lZB815dzVvQA:10 a=YK30HMD7P3IA:10 a=peF9eE_zjQwA:10 a=50e4U0PicR4A:10 From: "David Harrington" To: "'Mark Smith'" , "'Paul Ferguson'" References: <20080227.111847.6641.1@webmail06.vgs.untd.com> <20080228070735.e2b7bcb0.nanog@85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org> Date: Fri, 29 Feb 2008 12:05:07 -0500 Message-ID: <0b8b01c87af5$3d0b0e10$0600a8c0@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 Thread-Index: Ach67g9y+D16eI5HQtWod+3YuOLZVQAA8o/g X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138 In-Reply-To: <20080228070735.e2b7bcb0.nanog@85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org> Cc: opsec@ietf.org Subject: Re: [OPSEC] pccw as17557 leak... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: opsec-bounces@ietf.org Errors-To: opsec-bounces@ietf.org Hi, [Am not an operator ...; am a professional standards developer] The IETF produces products (standards, BCPs, et al ) and the operators are our potential customers. Standards are our real products, and BCPs are our white papers. As with most producers of products, you cannot force customers to use your products correctly, you can only work to explain why it is to their benefit to do so. Maybe the RFCs and BCPs they ignore are heavy on technical engineering details, and short on why it is beneficial to customers to use our products properly. I don't think we should not produce BCPs because they might be ignored. We should work on improving our BCPs to highlight how following best current practices will benefit the operators, and the companies they work for. (But not producing marketing fluff.) And, of course, promoting the BCPs at NOGs would be helpful, through tutorials and presentations. Many vendors promote the effective use of their products through tutorials and white papers rather than waiting for customers to get involved by signing up for the vendors' internal mailing lists for product engineering. ;-) David Harrington dbharrington@comcast.net ietfdbh@comcast.net dharrington@huawei.com > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Mark Smith > Sent: Wednesday, February 27, 2008 3:38 PM > To: Paul Ferguson > Cc: opsec@ietf.org > Subject: Re: [OPSEC] pccw as17557 leak... > > On Wed, 27 Feb 2008 19:18:47 GMT > "Paul Ferguson" wrote: > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > - -- Ron Bonica wrote: > > > > >I think that it would helpful if this working group were > to produce a > > >document (or two) recommending BGP policy for ISP. > > > > If you do decide to do this, please engage people in the operational > > community. Please. > > > > (Am an operator ...) > > It seems to me that they're the ones not engaging. They seem to be the > ones not signing up to IETF mailing lists, or spending time reading > drafts and providing feedback. > > If they choose not to be involved in a process they can be, I don't > think they can blame the other party for their own lack of > involvement. > > > Over on the NANOG list, as many of you are probably already aware, > > this issue is one that has been highlighted on several ocassions -- > > the fact that appropriate RFCs and BCPs exist to address specific > > operational issues, yet many ISPs choose to ignore them or are > > simply ignorant of them. > > > > It seems to me that remaining ignorant is a choice they've decided to > make, and one that the IETF can't really force them to make > differently. "For the good of the Internet" doesn't seem to hold much > sway ... > > > Separate problems, but certainly there is a lesson to be > > learned here: the operational community has long known that > > filtering downstream/customer ASs for prefix announcements is > > a Good Thing, yet the majority of ISPs on the planet simply do > > not do it... > > > > - - ferg > > > > -----BEGIN PGP SIGNATURE----- > > Version: PGP Desktop 9.6.3 (Build 3017) > > > > wj8DBQFHxbeVq1pz9mNUZTMRAnsRAJ4ugSnmh8m/9W6s6nVFrITMP55ziACgxmb8 > > YdUCHYvWrodg4D/xOOW7V0M= > > =A4Ox > > -----END PGP SIGNATURE----- > > > > > > -- > > "Fergie", a.k.a. Paul Ferguson > > Engineering Architecture for the Internet > > fergdawg(at)netzero.net > > ferg's tech blog: http://fergdawg.blogspot.com/ > > > > > > > > _______________________________________________ > > OPSEC mailing list > > OPSEC@ietf.org > > https://www.ietf.org/mailman/listinfo/opsec > > > -- > > "Sheep are slow and tasty, and therefore must remain > constantly > alert." > - Bruce Schneier, "Beyond Fear" > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec