4 ms·

This is known as source routing: https://en.m.wikipedia.org/wiki/Source_routing https://en.m.wikipedia.org/wiki/Source_routing The disadvantage to source routi

This is known as source routing: https://en.m.wikipedia.org/wiki/Source_routing https://en.m.wikipedia.org/wiki/Source_routing The disadvantage to source routing is efficiency. Network operators have a better view of the network than sources, and will know how to route packets more efficiently. At the end of the day they’ll still have route tables and send the packets on the path they want, defeating the purpose of having the source specify a path. A kind of source routing has interesting applications in P2P routing. Yggdrasil uses a spanning tree to assign every node a location, so that peers can determine efficient paths upfront. https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/

toast0 6y ago
Network operators have a different view of the network than sources, and of course, they have real time information about the next hop, but that doesn't mean all of their information is better. If a source had information on available paths, and was able to select the path taken, it could measure and estimate congestion and latency and pick the best paths. As far as I know, most BGP routers are using least AS hops as the primary metric. Latency, link capacity, and utilization aren't generally considered.
- pdkl95 6y ago
  Source routing also gives malicious hosts the ability to influence packet routing. IPv4 already tried this with the LSRR/SSRR[1] options. The LSRR option was useful to malicious hosts for many purposes, such as[2]: o Bypass firewall rules. o Reach otherwise unreachable internet systems. o Establish TCP connections in a stealthy way. o Learn about the topology of a network. o Perform bandwidth-exhaustion attacks. Due to these "well-known security implications"[2], RFC 7126 recommends[3]: Routers, security gateways, and firewalls SHOULD implement an option- specific configuration knob to select whether packets with this option are dropped, packets with this IP option are forwarded as if they did not contain this IP option, or packets with this option are processed and forwarded as per [RFC0791]. The default setting for this knob SHOULD be "drop", and the default setting MUST be documented. [1] "{Loose/Strict} Source and Record Route" http://www.networksorcery.com/enp/protocol/ip/option003.htm http://www.networksorcery.com/enp/protocol/ip/option003.htm [2] https://tools.ietf.org/html/rfc7126#section-4.3.3 https://tools.ietf.org/html/rfc7126#section-4.3.3 [3] https://tools.ietf.org/html/rfc7126#section-4.3.5 https://tools.ietf.org/html/rfc7126#section-4.3.5
- donavanm 6y ago
  I can’t qualify “most”, but it’s certainly not as-path only. I’d be shocked if any significant network wasn’t using MED and local-preference. Your large networks (and NSPs and carriers) are also going to support various communities for all sorts of reasons, like redistribution of routes. The days of path pretending, deaggregation, and crossing fingers are quite a ways behind us.
DyslexicAtheist 6y ago
> Network operators have a better view of the network than sources, and will know how to route packets more efficiently. the value proposition here targets operators not end-users. if you look at it from an operator pov there are many advantages: 1) geo-fencing service for enterprise customers (think public sector, or ICS, which may have a strong need to guarantee a packet never leaves a jurisdiction) 2) "transparency" in the data plane while isolating the control plane. I'm not convinced about this being better for security. let me rephrase, I doubt that it will eliminate/mitigate more security issues than it will create on its own. apart from the superior-security sales angle it will further lead to a "balkanization of the Internet". This technology is extremely political and so there is little surprise it has momentum now when the focus is on isolating ourselves. See 1 Above - this value proposition isn't just great for off-shore banks, but also for countries who want less exposure to traffic from other countries (for whatever reason! think copyright laws, political sanctions, incompatible "human rights", or content-control e.g. social / free-speech / whatever values our own overlords might disagree with). SCION allows fine grained control over what to impose on who and helps with censorship since not everyone will be affected, it allows micro sanctions on anyone they disagree with and it will be harder for them to say it's happening because only they experience it. Think of it as a great-firewall-lite without all the political stigma and dressed up in the language of "security".
- samoa42 6y ago
  well said, especially > This technology is extremely political

toast0 6y ago

Network operators have a different view of the network than sources, and of course, they have real time information about the next hop, but that doesn't mean all of their information is better. If a source had information on available paths, and was able to select the path taken, it could measure and estimate congestion and latency and pick the best paths. As far as I know, most BGP routers are using least AS hops as the primary metric. Latency, link capacity, and utilization aren't generally considered.

pdkl95 6y ago
Source routing also gives malicious hosts the ability to influence packet routing. IPv4 already tried this with the LSRR/SSRR[1] options. The LSRR option was useful to malicious hosts for many purposes, such as[2]: o Bypass firewall rules. o Reach otherwise unreachable internet systems. o Establish TCP connections in a stealthy way. o Learn about the topology of a network. o Perform bandwidth-exhaustion attacks. Due to these "well-known security implications"[2], RFC 7126 recommends[3]: Routers, security gateways, and firewalls SHOULD implement an option- specific configuration knob to select whether packets with this option are dropped, packets with this IP option are forwarded as if they did not contain this IP option, or packets with this option are processed and forwarded as per [RFC0791]. The default setting for this knob SHOULD be "drop", and the default setting MUST be documented. [1] "{Loose/Strict} Source and Record Route" http://www.networksorcery.com/enp/protocol/ip/option003.htm http://www.networksorcery.com/enp/protocol/ip/option003.htm [2] https://tools.ietf.org/html/rfc7126#section-4.3.3 https://tools.ietf.org/html/rfc7126#section-4.3.3 [3] https://tools.ietf.org/html/rfc7126#section-4.3.5 https://tools.ietf.org/html/rfc7126#section-4.3.5
donavanm 6y ago
I can’t qualify “most”, but it’s certainly not as-path only. I’d be shocked if any significant network wasn’t using MED and local-preference. Your large networks (and NSPs and carriers) are also going to support various communities for all sorts of reasons, like redistribution of routes. The days of path pretending, deaggregation, and crossing fingers are quite a ways behind us.

DyslexicAtheist 6y ago

> Network operators have a better view of the network than sources, and will know how to route packets more efficiently. the value proposition here targets operators not end-users. if you look at it from an operator pov there are many advantages: 1) geo-fencing service for enterprise customers (think public sector, or ICS, which may have a strong need to guarantee a packet never leaves a jurisdiction) 2) "transparency" in the data plane while isolating the control plane. I'm not convinced about this being better for security. let me rephrase, I doubt that it will eliminate/mitigate more security issues than it will create on its own. apart from the superior-security sales angle it will further lead to a "balkanization of the Internet". This technology is extremely political and so there is little surprise it has momentum now when the focus is on isolating ourselves. See 1 Above - this value proposition isn't just great for off-shore banks, but also for countries who want less exposure to traffic from other countries (for whatever reason! think copyright laws, political sanctions, incompatible "human rights", or content-control e.g. social / free-speech / whatever values our own overlords might disagree with). SCION allows fine grained control over what to impose on who and helps with censorship since not everyone will be affected, it allows micro sanctions on anyone they disagree with and it will be harder for them to say it's happening because only they experience it. Think of it as a great-firewall-lite without all the political stigma and dressed up in the language of "security".

samoa42 6y ago
well said, especially > This technology is extremely political