3 ms·

Border Gateway Protocol, which is the standard for routing on a super-organizational scale. There are two (main) flavors, but here eBGP (external) is the relev

by vitus 9y ago

Border Gateway Protocol, which is the standard for routing on a super-organizational scale. There are two (main) flavors, but here eBGP (external) is the relevant one. Instead of explaining how it'll route traffic through itself, Google can tell its neighbors that it can reach, say, Vodafone (but with a certain cost). Importantly, this approach allows for autonomous systems to decide which routes to advertise to which neighbors. Content providers generally don't also provide transit, e.g. Google typically doesn't carry traffic from AT&T customers to Comcast customers free of charge, even if it is directly connected to both of them.

sillysaurus3 9y ago
Now talk about how it used to be hackable, and how they fixed it. :) Actually, it's still hackable: https://www.theguardian.com/technology/2014/aug/07/hacker-bitcoin-mining-pool-internet-service-providers-canada-dell https://www.theguardian.com/technology/2014/aug/07/hacker-bi...
- vitus 9y ago
  Of course it's still hackable. There's nothing stopping you from advertising specific prefixes and hijacking all of Youtube traffic globally. https://dyn.com/blog/pakistan-hijacks-youtube-1/ https://dyn.com/blog/pakistan-hijacks-youtube-1/ Oh wait, that happened almost a decade ago, and there's been no fundamental change to the protocol to protect against that. Except, if you keep something like that in place persistently, nobody will want to peer with you. * My understanding is that the global hijack was accidental. Pakistan Telecom just wanted to block Youtube traffic internally, and they used a bad mechanism for doing that. Oops.
  - notyourday 9y ago
    Oh rubbish. It is not hackable. Proper BGP implementations drop packets with TTL > 1 for non-multihop. This means that the only way to attack BGP between A and B is to have a control of the router on the other side. By doing that one's adversary controls the other side's inbound. It is always the case: Since my outbound is your inbound and since I control my outbound ( by definition ) then you cannot control your inbound. This means that the only defense is filtering.

by vitus 9y ago

sillysaurus3 9y ago

Now talk about how it used to be hackable, and how they fixed it. :) Actually, it's still hackable: https://www.theguardian.com/technology/2014/aug/07/hacker-bitcoin-mining-pool-internet-service-providers-canada-dell https://www.theguardian.com/technology/2014/aug/07/hacker-bi...

vitus 9y ago
Of course it's still hackable. There's nothing stopping you from advertising specific prefixes and hijacking all of Youtube traffic globally. https://dyn.com/blog/pakistan-hijacks-youtube-1/ https://dyn.com/blog/pakistan-hijacks-youtube-1/ Oh wait, that happened almost a decade ago, and there's been no fundamental change to the protocol to protect against that. Except, if you keep something like that in place persistently, nobody will want to peer with you. * My understanding is that the global hijack was accidental. Pakistan Telecom just wanted to block Youtube traffic internally, and they used a bad mechanism for doing that. Oops.
- notyourday 9y ago
  Oh rubbish. It is not hackable. Proper BGP implementations drop packets with TTL > 1 for non-multihop. This means that the only way to attack BGP between A and B is to have a control of the router on the other side. By doing that one's adversary controls the other side's inbound. It is always the case: Since my outbound is your inbound and since I control my outbound ( by definition ) then you cannot control your inbound. This means that the only defense is filtering.