Re: Helpful BGP Feature

[Brandon Black <[e-mail]>]

On Mon, 3 Feb 1997 [e-mail] wrote:

> It may be helpful to add a feature to allow for Directed Route
> announcements. The originator of a BGP Route, for example, could
> specify in an optional attribute, the desired recipient(s) of the
> Route Advertisement e.g.listing the AS numbers or IP addresses of
> the Networks or even the specific gateways that should receive
> the Route Advertisement.
> 
> This would allow for capabilities including:
> 
> Creating Virtual Private Networks. Controlling access to a
> destination.
> 
> Limiting where Route advertisements are propogated. Not all
> destinations need or want to be in all the Global Routing tables.
> Avoiding the need to get Network Service Providers to place
> complex policy statements on their Routers - which may not
> have the desired granularity anyway.
> 
> Avoiding having to wait for Service Providers to enter the policy
> changes,which sometimes can only occur during monthly
> change windows.
> Thanks, Ed Segal [e-mail] 914 784-3259
> 


Well... that might allow for "Virtual Networks", but no Private ones.
Simply not advertising your route does _NOT_ protect your traffic.  For
one, it can still be sniffed at the providers the Virtual Network uses,
and it can be sniffed at the NAP's... (do you trust every single employee
at all of those places...?).  Two, I've heard rumors of people claiming it
is possible to "remote sniff" traffic, by sending carefully contructed BGP
advertisements which reroute the desired traffic to the sniffer, and then
routing it back out.  It sounds very complicated to me, but I believe
there are people out there capable of doing it.

Point is.... encryption leads to Private networks, not obscurity.  And
most people who would give so little care to their traffic as to route it
across the current IPv4 Internet Backbone in an attempt to make a Virtual
Network, will probably want Internet access from their sites as well.. and
thus wouldn't use the feature. 

The idea probably still has merit as a useful hack for Multihomed
non-transit customers with wierd routing requirements... but I don't see
it as a tool for "Virtual Private Networks"..... just wait for IPv6, and
then (hopefully) we can make VPN's where and when we want to easily.

.................................             ..............
: Brandon Lee Black  : [Office] :.............: [Personal] :....
:....................: [e-mail] : [e-mail] :.......
: "Sanity is the     : +1.281.362.6466 .......: [e-mail] :
: trademark of a     :.................:..../\: [e-mail] :
: weak mind. . ."    : LDDS WorldCom, Inc. :\/: +1.281.397.3490 ......:
:....................:.....................:..:.................: