Re: [RPSEC] FW: AS 8437 announced a quarter of the net for half ofan hour

On 16-aug-2006, at 15:05, Curtis Villamizar wrote:

> Much of the current problems were solved problems in the early 1990s.
> To get to most of the Internet you had to go through the NSFNET.  To
> get anything through the NSFNET you had to register routes.  The
> NSFNET didn't have the types of problems we are now seeing.  The
> commercial providers of the time did.

Yes; but the NFSnet didn't have to maintain filters for 25k ASes and  
several times that number in routes. I don't think generating  
comprehensive filters using current technology is a reasonable  
solution. _Maybe_ if the router vendors implement better ways to get  
the filters into their boxes. But then you still have the issue of  
trusting a database somewhere. In the NFSnet days those weren't all  
that secure. This has gotten better (especially for the RIPE db  
because it's also a registry DB) and will be even better when we have  
certificates in those databases, but I'm still reluctant to have  
filters change on me automatically.

What I thought you meant was better defaults so it's not so  
incredibly easy to leak routes. The default is to propagate, wrong  
filter = leak. With a default that doesn't propagate, all of this  
gets a lot easier, but of course there are still ways to screw that up.

It may even be a good approach to have default "transit", "peer" and  
"customer" classes so that people only have to say what type a link  
is and the filtering happens automatically, at least for those of us  
who don't need more complexity than this.

Iljitsch

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec