2 ms·

Is it too costly to check the source IP of UDP packets exiting ISPs networks?

by Thaxll 10y ago

DanielDent 10y ago
BCP-38 solves some people's problems, but it also causes a lot of problems. Triangular routing is a use case which becomes lost. As does the the ability to easily set up certain kinds of peering/multihoming connectivity. The larger and more complex a network gets, the harder it can become to determine if a source IP is "correct".
rmdoss 10y ago
Too complex for most large networks with many peers and client BGP announcements.
jauer 10y ago
Not really... On the low end (small ISPs with zero or a handful of downstream ASes), people aren't aware or are too lazy to implement egress ACLs. Complicating this: A surprising number of small ISPs and telcos don't actually staff for internet routing skills (e.g. can work with BGP & have heard of a BCP). They'll bring on a consultant to "turn up my new circuit" and move on. If the first consultant sets up egress ACLs and they get a new netblock chances are the next consultant will just remove the ACL instead of updating it... Medium to large ISPs: IRRs are supposed to solve this but implementation is spotty / OMG scripting changes on routers / etc. http://www.irr.net/docs/list.html http://www.irr.net/docs/list.html High end: I've heard that some providers have so many customers landing on a given aggregation router that the ACLs from IRRs end up too large for the router. Cogent's approach is to require a LOA for the subnets that you are announcing and filter out everything else. This seems reasonable, though it gets annoying when you have a downstream AS that has downstream ASes (BUT that's fairly uncommon). I use egress ACLs that allow my RIR-issued and downstream customer blocs and drop everything else. I have a friend that runs a slightly larger ISP (5x more downstream ASes) that does automation with IRRs.
kkirsche 10y ago
You can in customer networks but how is the source IP helpful on a transit network where you receive it from another ISP or transit provider?

Is it too costly to check the source IP of UDP packets exiting ISPs networks?

by Thaxll 10y ago

Is it too costly to check the source IP of UDP packets exiting ISPs networks?

BCP-38 solves some people's problems, but it also causes a lot of problems. Triangular routing is a use case which becomes lost. As does the the ability to easily set up certain kinds of peering/multihoming connectivity. The larger and more complex a network gets, the harder it can become to determine if a source IP is "correct".

rmdoss 10y ago

Too complex for most large networks with many peers and client BGP announcements.

jauer 10y ago

Not really... On the low end (small ISPs with zero or a handful of downstream ASes), people aren't aware or are too lazy to implement egress ACLs. Complicating this: A surprising number of small ISPs and telcos don't actually staff for internet routing skills (e.g. can work with BGP & have heard of a BCP). They'll bring on a consultant to "turn up my new circuit" and move on. If the first consultant sets up egress ACLs and they get a new netblock chances are the next consultant will just remove the ACL instead of updating it... Medium to large ISPs: IRRs are supposed to solve this but implementation is spotty / OMG scripting changes on routers / etc. http://www.irr.net/docs/list.html http://www.irr.net/docs/list.html High end: I've heard that some providers have so many customers landing on a given aggregation router that the ACLs from IRRs end up too large for the router. Cogent's approach is to require a LOA for the subnets that you are announcing and filter out everything else. This seems reasonable, though it gets annoying when you have a downstream AS that has downstream ASes (BUT that's fairly uncommon). I use egress ACLs that allow my RIR-issued and downstream customer blocs and drop everything else. I have a friend that runs a slightly larger ISP (5x more downstream ASes) that does automation with IRRs.

kkirsche 10y ago

You can in customer networks but how is the source IP helpful on a transit network where you receive it from another ISP or transit provider?