[Sidrops] ASPA: Is this really a leak?

["Jakob Heitz (jheitz)" <[e-mail]>]

https://tools.ietf.org/html/draft-ietf-sidrops-aspa-verification-06
finds suspected leaky AS paths.
However, not all routes with suspected leaky AS-PATHs should be automatically dropped,
because some of them may not be unequivocal leaks.
A BGP monitoring service should provide alerts to all suspected leaks.
However, a router should automatically drop only unequivocal leaks.

https://bgpstream.com/event/258771 is listed as a leak.
[cid:image001.jpg@01D6D269.84D10C20]
The as-path is the red line.
The black line is a customer-provider relationship that exists between
37545 and 33765 as can be seen at https://asrank.caida.org/asns?asn=33765.
Therefore, 33756 is an authorized carrier of traffic for 37545 and
ought to not be called out as a leaker.
The route may not have taken the black line because of a temporary
failure of that link. An apparently leaky detour should be allowed
for a temporary failure as long as all the ASes involved are in the
provider cone of either the source AS or the destination AS.
All ASes in the provider cone of an AS are either directly or indirectly
authorized to carry traffic for that AS.

This is just one example. It's easy to find more.

ASPA should add a section that defines an unequivocal leak, such that
a BGP router can optionally drop only unequivocal leaks.

The definition of an unequivocal leak is based on the provider cone.
The provider cone of an AS consists of all the providers of that AS and
all the providers of those providers and so on.

All providers in the provider cone of either the originator or the receiver
of the route are permitted (contracted, actually) to carry the traffic for the
route between these two ASes. Therefore, the AS-path is only invalid if it
contains any ASes not within these provider cones. If valleys exist in the
AS-path, but these valleys are entirely within these provider cones, then
all the ASes in the AS-path are still permitted to carry the traffic and the
route should be declared valid.


Regards,
Jakob.