Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19

  • From: Michael.Dillon
  • Date: Fri Jan 21 09:38:20 2005

> > Well, if the router CAN run BGP, the feed from Cymru is only about 84
> > prefixes - not a lot of memory tied up there, is there?

Not a very wise solution. If hundreds of thousands of routers
take this feed from Cymru, then it won't be long
before someone attacks Cymru in order to control
the feed. And given the upsurge in criminal activity
related to network abuse, the danger to Cymru is not
just from network exploits. The principals could
find themselves looking at a gun barrel in their
face with their families held hostage. It is very
unwise to push people towards creating a new single
point of failure (or single attack point) in the
Internet.

> my point was that not all managed routers, the majority actually, can't
> and don't run BGP. their code doesn't even support bgp...

Thankfully this is true. However, the majority
of managed routers are managed by servers/workstations
which *ARE* capable of running BGP as well as
scripts to compare ACLS and alert staff when 
inconsistencies are discovered.

The prudent course of action is to encourage 
people to take the Cymru feed into their
*management systems* and use that feed to vet
their current ACLs or BGP filters. This extra 
layer of indirection actually strengthens the
system and protects Cymru from becoming too
important.

--Michael Dillon





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.