Re: [RPSEC] FW: AS 8437 announced a quarter of the net for half ofan hour

In message <D533B682-2B41-4A39-83A8-36E6977868D0@muada.com>
Iljitsch van Beijnum writes:
>  
> On 15-aug-2006, at 20:47, Curtis Villamizar wrote:
>  
> > I agree that the solution has to be simple to administer, better yet
> > trivial.
>  
> I disagree. This is a race to the bottom you can't win: business will  
> just hire less skilled people and you'll have the same problems as  
> before.

Much of the current problems were solved problems in the early 1990s.
To get to most of the Internet you had to go through the NSFNET.  To
get anything through the NSFNET you had to register routes.  The
NSFNET didn't have the types of problems we are now seeing.  The
commercial providers of the time did.

When the NSFNET was decommissioned the requirement to register routes
to get anywhere gradually diminished.  The IRR became ineffective
because certain providers didn't make use of the IRR and so they
refused to register routes.  They regarded use of the IRR as a
competitive advantage for their competitors and they were not going to
do something that helped their competitor.  The big offenders were
Sprintlink and UUNET.

Many providers still resist any form of route registration.  That is
why I made the comment that any administrative cost should be put on
those who benefit because they have the incentive to do the work.  For
example, that might mean building routing databases with both
registered and observed routes rather than just registered routes.

> The problem with idr administration isn't making it run 99% of the  
> time, but doing something during 99% of the time that minimizes the  
> trouble during the remaining 1% of the time.

Trust me.  I get it.

> > The way filters are set today is rather ad-hoc and coverage
> > is incomplete.
>  
> Right; the above is not to say that there isn't room for improvement  
> in current implementations.

There is lots of room for improvement.  In terms of routing security
most major US corporate users of the Internet (but not all, only 65%
of the fortune 500 were directly connected to the NSFNET when it was
decommissioned in 1995) were better off a decade ago than now.

I'm trying to be realistic given the historic level of cooperation
among Internet providers towards solving this.

Regards,

Curtis

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec