4 ms·

What is a prefix (in context), and what does it mean to ‘announce’ one?

by alex_g 9y ago

iDemonix 9y ago
In BGP you have sets of IP destinations, which you summarise as a prefix. Announcing or advertising means exactly what it sounds like, you announce to your peers that you have paths to these networks.
deleted 9y ago
[deleted]
jlgaddis 9y ago
A prefix is an IP subnet, basically. Most here are familiar with Google's public DNS resolver, 8.8.8.8, so let's use that as an example. Google has been assigned the autonomous system number (ASN) 15169. The 8.0.0.0/8 IP address space was allocated to Level3 and they have reallocated a small part of it, 8.8.8.0/24, to Google. Google, when speaking to their BGP peers, "announces" routes, including an announcement for the 8.8.8.0/24 prefix. An announcement is basically Google's router telling, for example, Level3's router, "Hey, I know how to get to 8.8.8.0/24. If you have traffic going there, you can send it to me." Level3 then passes that along to other peers, like me. Level3 says, "If you have traffic for 8.8.8.0/24, you can send it to me and I'll send it on towards its origin". The announcements continue to be passed along to other peers. A withdrawal is the opposite of an announcement: "Hey, I don't have a route to 8.8.8.0/24 anymore" or, in many cases, "the route to 8.8.8.0/24 has changed, here's the new one". Here's a (slimmed down) example from one of my routers: # sh ip bgp 8.8.8.0/24 | b 3356 3356 15169, (received & used) 4.69.248.15 from 4.69.248.15 (4.69.180.167) Origin IGP, metric 0, localpref 100, valid, external, best Community: 3356:3 3356:86 3356:575 3356:666 3356:2042 This shows the "AS path" (the path through the various ASNs back to the origin), "3356 15169". AS3356 is Level3. We can see that AS15169 (Google) originated the prefix (8.8.8.0/24), and announced it to their BGP peer, Level3. Level3 then passed that announcement along to my router. Here's the same thing for 66.232.224.0/24, mentioned in the article: # sh ip bgp 66.232.224.0/24 BGP routing table entry for 66.232.224.0/24, version 1125190207 Paths: (1 available, best #1, table Default-IP-Routing-Table) Advertised to update-groups: 4 3356 209 40839, (received & used) 4.69.248.15 from 4.69.248.15 (4.69.180.167) Origin IGP, metric 0, localpref 100, valid, external, best Community: 209:209 209:13070 3356:3 3356:22 3356:86 3356:575 3356:666 3356:2042 The AS path here is "3356 209 40839" which shows that traffic from me to 66.232.224.0/24 will first go to Level3 (AS3356), then to Qwest/CenturyLink (AS209), and finally to AS40839 (Kohl's Department Stores). With regard to the hijack described in the article, this means that another organization announced the prefixes into BGP, effectively saying, "So, all of that traffic you have that's going to Apple/Facebook/Google/etc., just go ahead and start sending that to AS39523 now". Instead of ending up at Apple/Facebook/Google, it'll instead be redirected to this unknown organization in Russia. (N.B.: Before anyone chimes in to "correct" something, this is a bit simplified. There's much more to BGP than this and there are a number of different factors which determine which route is chosen. A longer prefix -- mentioned in the article -- is one way to "defeat" a better route.)
- digi_owl 9y ago
  One curious thing about 8.8.8.8 (and 8.8.4.4) is that it gets redirected to the closest Google CDN.
  - jsjohnst 9y ago
    > One curious thing DNS is something that’s commonly Anycasted. In laymen’s terms, basically what that means is rather than 8.8.8.8 pointing to one server (or a load balanced cluster in one DC) as you might expect, it rather points to potentially thousands of servers all over the globe and the closest one (BGP route wise) is the one picked for you.
    - sp332 9y ago
      8.8.8.8 is already an IP address so DNS is not involved. The anycast is handled by just BGP.
      - kelnos 9y ago
        I think the parent meant that anycast is often used for DNS servers, not that a DNS lookup is used to find the closest Google DNS server.
      - jsjohnst 9y ago
        Kelnos was correct, the service that 8.8.8.8 provides is DNS, hence the relevance when talking about 8.8.8.8 being anycasted.
        sp332 9y ago
        Man, I must have been asleep this afternoon because I could not figure out what a bare IP address had to do with DNS. I get it now.
- Grimm665 9y ago
  Thanks for this explanation.
dredmorbius 9y ago
Sometimes it's slightly simpler to show rather than tell. The CIDR Report is a publicly accessible compendium of BGP routing announcements. Mind that this isn't the entire Internet, or even entirely current, though it's a very large and generally current version of it. One of the complications is that you're only seeing the routes the CIDR Report itself is aware of (there may be others, though generally those will be small/obscure). But if you want to know what "the Internet" is, this is pretty much it: a bunch of rules for routing data. http://www.cidr-report.org/as2.0/ http://www.cidr-report.org/as2.0/ As for BGP, Border Gateway Protocol: https://en.wikipedia.org/wiki/Border_Gateway_Protocol https://en.wikipedia.org/wiki/Border_Gateway_Protocol The routes advertised by the AS (autonomous system) in question, AS39523: http://www.cidr-report.org/cgi-bin/as-report?as=AS39523&view=2.0 http://www.cidr-report.org/cgi-bin/as-report?as=AS39523&view... (There are a maximum of 2^16 == 65,536 autonomous systems possible under BGP, at least until those counters are extended. What happens under IPv6 may be a bit of a mess....) Edit: There's 4 billion and change as ASNs are now 32 bit, see: https://news.ycombinator.com/item?id=15915417 https://news.ycombinator.com/item?id=15915417

What is a prefix (in context), and what does it mean to ‘announce’ one?

by alex_g 9y ago

What is a prefix (in context), and what does it mean to ‘announce’ one?

In BGP you have sets of IP destinations, which you summarise as a prefix. Announcing or advertising means exactly what it sounds like, you announce to your peers that you have paths to these networks.

deleted 9y ago

[deleted]

jlgaddis 9y ago

A prefix is an IP subnet, basically. Most here are familiar with Google's public DNS resolver, 8.8.8.8, so let's use that as an example. Google has been assigned the autonomous system number (ASN) 15169. The 8.0.0.0/8 IP address space was allocated to Level3 and they have reallocated a small part of it, 8.8.8.0/24, to Google. Google, when speaking to their BGP peers, "announces" routes, including an announcement for the 8.8.8.0/24 prefix. An announcement is basically Google's router telling, for example, Level3's router, "Hey, I know how to get to 8.8.8.0/24. If you have traffic going there, you can send it to me." Level3 then passes that along to other peers, like me. Level3 says, "If you have traffic for 8.8.8.0/24, you can send it to me and I'll send it on towards its origin". The announcements continue to be passed along to other peers. A withdrawal is the opposite of an announcement: "Hey, I don't have a route to 8.8.8.0/24 anymore" or, in many cases, "the route to 8.8.8.0/24 has changed, here's the new one". Here's a (slimmed down) example from one of my routers: # sh ip bgp 8.8.8.0/24 | b 3356 3356 15169, (received & used) 4.69.248.15 from 4.69.248.15 (4.69.180.167) Origin IGP, metric 0, localpref 100, valid, external, best Community: 3356:3 3356:86 3356:575 3356:666 3356:2042 This shows the "AS path" (the path through the various ASNs back to the origin), "3356 15169". AS3356 is Level3. We can see that AS15169 (Google) originated the prefix (8.8.8.0/24), and announced it to their BGP peer, Level3. Level3 then passed that announcement along to my router. Here's the same thing for 66.232.224.0/24, mentioned in the article: # sh ip bgp 66.232.224.0/24 BGP routing table entry for 66.232.224.0/24, version 1125190207 Paths: (1 available, best #1, table Default-IP-Routing-Table) Advertised to update-groups: 4 3356 209 40839, (received & used) 4.69.248.15 from 4.69.248.15 (4.69.180.167) Origin IGP, metric 0, localpref 100, valid, external, best Community: 209:209 209:13070 3356:3 3356:22 3356:86 3356:575 3356:666 3356:2042 The AS path here is "3356 209 40839" which shows that traffic from me to 66.232.224.0/24 will first go to Level3 (AS3356), then to Qwest/CenturyLink (AS209), and finally to AS40839 (Kohl's Department Stores). With regard to the hijack described in the article, this means that another organization announced the prefixes into BGP, effectively saying, "So, all of that traffic you have that's going to Apple/Facebook/Google/etc., just go ahead and start sending that to AS39523 now". Instead of ending up at Apple/Facebook/Google, it'll instead be redirected to this unknown organization in Russia. (N.B.: Before anyone chimes in to "correct" something, this is a bit simplified. There's much more to BGP than this and there are a number of different factors which determine which route is chosen. A longer prefix -- mentioned in the article -- is one way to "defeat" a better route.)

digi_owl 9y ago
One curious thing about 8.8.8.8 (and 8.8.4.4) is that it gets redirected to the closest Google CDN.
- jsjohnst 9y ago
  > One curious thing DNS is something that’s commonly Anycasted. In laymen’s terms, basically what that means is rather than 8.8.8.8 pointing to one server (or a load balanced cluster in one DC) as you might expect, it rather points to potentially thousands of servers all over the globe and the closest one (BGP route wise) is the one picked for you.
  - sp332 9y ago
    8.8.8.8 is already an IP address so DNS is not involved. The anycast is handled by just BGP.
    - kelnos 9y ago
      I think the parent meant that anycast is often used for DNS servers, not that a DNS lookup is used to find the closest Google DNS server.
    - jsjohnst 9y ago
      Kelnos was correct, the service that 8.8.8.8 provides is DNS, hence the relevance when talking about 8.8.8.8 being anycasted.
      - sp332 9y ago
        Man, I must have been asleep this afternoon because I could not figure out what a bare IP address had to do with DNS. I get it now.
Grimm665 9y ago
Thanks for this explanation.

dredmorbius 9y ago

Sometimes it's slightly simpler to show rather than tell. The CIDR Report is a publicly accessible compendium of BGP routing announcements. Mind that this isn't the entire Internet, or even entirely current, though it's a very large and generally current version of it. One of the complications is that you're only seeing the routes the CIDR Report itself is aware of (there may be others, though generally those will be small/obscure). But if you want to know what "the Internet" is, this is pretty much it: a bunch of rules for routing data. http://www.cidr-report.org/as2.0/ http://www.cidr-report.org/as2.0/ As for BGP, Border Gateway Protocol: https://en.wikipedia.org/wiki/Border_Gateway_Protocol https://en.wikipedia.org/wiki/Border_Gateway_Protocol The routes advertised by the AS (autonomous system) in question, AS39523: http://www.cidr-report.org/cgi-bin/as-report?as=AS39523&view=2.0 http://www.cidr-report.org/cgi-bin/as-report?as=AS39523&view... (There are a maximum of 2^16 == 65,536 autonomous systems possible under BGP, at least until those counters are extended. What happens under IPv6 may be a bit of a mess....) Edit: There's 4 billion and change as ASNs are now 32 bit, see: https://news.ycombinator.com/item?id=15915417 https://news.ycombinator.com/item?id=15915417