IETF Logo Mail Archive

Re: [GROW] WGLC: draft-ietf-grow-simple-leak-attack-bgpsec-no-help

Nick Hilliard <nick@inex.ie> Tue, 20 May 2014 09:42 UTC

Return-Path: <nick@inex.ie>
X-Original-To: grow@ietfa.amsl.com
Delivered-To: grow@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6411D1A0664 for <grow@ietfa.amsl.com>; Tue, 20 May 2014 02:42:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.002
X-Spam-Level:
X-Spam-Status: No, score=-0.002 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NCQrFfBYrnY6 for <grow@ietfa.amsl.com>; Tue, 20 May 2014 02:42:23 -0700 (PDT)
Received: from mail.netability.ie (mail.netability.ie [IPv6:2a03:8900:0:100::5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92C731A04C8 for <grow@ietf.org>; Tue, 20 May 2014 02:42:18 -0700 (PDT)
X-Envelope-To: grow@ietf.org
Received: from crumpet.dyn.netability.ie (089-101-195154.ntlworld.ie [89.101.195.154] (may be forged)) (authenticated bits=0) by mail.netability.ie (8.14.8/8.14.5) with ESMTP id s4K9gEYH041741 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Tue, 20 May 2014 10:42:14 +0100 (IST) (envelope-from nick@inex.ie)
X-Authentication-Warning: cheesecake.netability.ie: Host 089-101-195154.ntlworld.ie [89.101.195.154] (may be forged) claimed to be crumpet.dyn.netability.ie
Message-ID: <537B2375.7080408@inex.ie>
Date: Tue, 20 May 2014 10:42:13 +0100
From: Nick Hilliard <nick@inex.ie>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Jared Mauch <jared@puck.nether.net>
References: <CAL9jLabRKA2gezfRdzND1TSYMJO+a_4mVV+M302cLBFTUwYmTQ@mail.gmail.com> <CF96AEDB.1B684%wesley.george@twcable.com> <CAL9jLaZ9J52Dt5n1Wk2KYTqwzmefGxvq-bRcfMfhWBNwf_6ZGg@mail.gmail.com> <EFD759C6-6F35-4397-A27E-BF1E650663BC@tislabs.com> <34076248-B77A-418F-9ED2-E5A607D39B51@tcb.net> <CD783686-9D5B-4D0B-92CC-3D4ACF1A6D07@puck.nether.net>
In-Reply-To: <CD783686-9D5B-4D0B-92CC-3D4ACF1A6D07@puck.nether.net>
X-Enigmail-Version: 1.6
X-Company-Info-1: Internet Neutral Exchange Association Limited. Registered in Ireland No. 253804
X-Company-Info-2: Registered Offices: 1-2, Marino Mart, Fairview, Dublin 3
X-Company-Info-3: Internet Neutral Exchange Association Limited is limited by guarantee
X-Company-Info-4: Offices: 4027 Kingswood Road, Citywest, Dublin 24.
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/grow/zxmP2UVFkwscix31T9Y1jvaiFV0
Cc: "grow@ietf.org grow@ietf.org" <grow@ietf.org>
Subject: Re: [GROW] WGLC: draft-ietf-grow-simple-leak-attack-bgpsec-no-help
X-BeenThere: grow@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Grow Working Group Mailing List <grow.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/grow>, <mailto:grow-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/grow/>
List-Post: <mailto:grow@ietf.org>
List-Help: <mailto:grow-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/grow>, <mailto:grow-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 20 May 2014 09:42:26 -0000

On 20/05/2014 02:11, Jared Mauch wrote:
> Is there a need for this to be explicitly documented within the IETF?  I
> certainly agree there is a problem, but this feels like operational
> guidance or perhaps a BCP or similar document?  (eg: Filter your peer
> ASNs from your other peers).

Well-maintained prefix / asn filters work well up to a certain size, but no
further.  Poorly maintained filters break connectivity in ways which
surprise and amaze.  Operationally there is an intersection of operator
clue, network size and peer network size where prefix filters can work
really well, but thar be dragons outside that intersection.

Nick

v2.23.0 | Report a Bug | By Email