Re: [Sidrops] New Version Notification for draft-sriram-sidrops-drop-invalid-policy-00.txt

[Job Snijders <[e-mail]>]

On Sun, Mar 11, 2018 at 12:50:17PM +0900, Randy Bush wrote:
> > Take as example the DE-CIX Peering LAN prefix (taken from
> > https://www.peeringdb.com/ix/31) - it is not really globally
> > reachable, and that is the intention. What we see here though that
> > some folks carry it in their IGP
> > http://lg.ring.nlnog.net/prefix_detail/lg01/ipv4?q=80.81.192.0 and
> > seem to advertise it by accident to this collector.
> > 
> > These accidental announcements shouldn't be accepted, ever. This is
> > the ROA: http://localcert.ripe.net:8088/roas?q=80.81.192.0 - with
> > the current DSIR idea they _would_ be accepted if I am not mistaken.
> > 
> > DE-CIX is not announcing the peering lan prefix for various
> > operational reasons, and the ROA should help supress global
> > visiblity, especially the global visibility of more-specifics.
> > More-specifics of the peering lan are disastrous for IXPs.
> 
> who has the authority to issue valid roas for any possibly improper
> subset of the de-cix lan?
> 
> if someone else announces a possibly improper subset of that lan, it's
> a misannouncement and would be marked invalid.
> 
> if you hear that announcement and believe it, who's the fool?

Perhaps what is lacking in the semantics of RPKI is a "kill roa". On the
other hand, perhaps IXP Peering LAN prefixes are not a real problem. In
NTT's network this type of announcement is dropped regardless of any IRR
or RPKI information.

I feel AS 0 is being overloaded, AS0's non-routablility is being used in
a number of (too many) different ways.

Kind regards,

Job