A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal...
Transcript of A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal...
![Page 1: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/1.jpg)
A week with analysing RPKI status: Internal Story
Fakrul Alam Senior Training Officer, APNIC [email protected]
![Page 2: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/2.jpg)
BGP 101
Send a packet to 2001:DB8::1
I have 2001:DB8::/32
http://thyme.apnic.net/network/!30 November - 4 December, Guam !
![Page 3: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/3.jpg)
AS 100 AS 300 AS 200
Send a packet to 2001:DB8::1
I have 2001:DB8::/32
2001:DB8::/32 100 200 300 i
http://thyme.apnic.net/network/!
BGP 101
30 November - 4 December, Guam !
![Page 4: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/4.jpg)
BGP 101
AS 100 AS 300
Send a packet to 2001:DB8::1
I have 2001:DB8::/32
I have 2001:DB8::/48
AS 420
AS 200
2001:DB8::/32 100 200 300 i
2001:DB8::/48 100 200 420 i
http://thyme.apnic.net/network/!30 November - 4 December, Guam !
![Page 5: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/5.jpg)
Current Trends
• Filtering limited to the edges facing the customer
• Filters on peering and transit sessions are often too complex or take too many resources
• Check prefix before announcing it
• RPSL to automate it
30 November - 4 December, Guam !
![Page 6: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/6.jpg)
RPKI Resource Public Key Infrastructure
public key infrastructure framework designed to secure the Internet's routing
infrastructure
IP Address & AS Numbers! Digital Certificate!
30 November - 4 December, Guam !
![Page 7: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/7.jpg)
RPKI Origin Validation
AS 100 AS 300
I have 2001:DB8::/48
AS 420
AS 200
Send a packet to 2001:DB8::1
I have 2001:DB8::/32
Only AS300
2001:DB8::/32 100 200 300 i
2001:DB8::/48 100 200 420 i
Valid
Invalid / unknown
30 November - 4 December, Guam !
![Page 8: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/8.jpg)
RPKI Deployment
AS 100 AS 300 AS 200
Phase 2 Path Validation Send a packet to
2001:DB8::1
I have 2001:DB8::/32
Phase 1 Origin
Validation
30 November - 4 December, Guam !
![Page 9: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/9.jpg)
RPKI Building Blocks
1. Trust Anchors (RIR’s) 2. Route Origination Authorizations (ROA)
3. Validators
30 November - 4 December, Guam !
![Page 10: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/10.jpg)
Primary Goal
RPKI adoption rate / deployment status
30 November - 4 December, Guam !
![Page 11: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/11.jpg)
RPKI Breakdown
Total Prefix Valid Invalid Unknown Accuracy RPKI
Adoption Rate
APNIC 135876 (100%)
581 (0.43%) 684 (0.5%) 134611 (99.07%)
45.93% 0.93%
BD 2079 (100%) 71 (3.42%) 26 (1.25%) 1982
(95.33%) 73.2% 4.67%
source : http://rpki.surfnet.nl/perrir.html & http://rpki.surfnet.nl/country.php
why so many invalid prefix!!!!
November 2014
30 November - 4 December, Guam !
![Page 12: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/12.jpg)
Invalid Prefix
source : http://rpki.surfnet.nl/bd.html
30 November - 4 December, Guam !
![Page 13: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/13.jpg)
All Invalid prefixes from BD
source : http://rpki.surfnet.nl/bd.html 30 November - 4 December, Guam !
![Page 14: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/14.jpg)
All Invalid prefixes from BD
source : http://rpki.surfnet.nl/bd.html 30 November - 4 December, Guam !
![Page 15: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/15.jpg)
Something more serious
source : https://stat.ripe.net/widget/announced-prefixes#w.resource=58717
source : http://www.cidr-report.org/cgi-bin/as-report?as=as58717&view=2.0
30 November - 4 December, Guam !
![Page 16: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/16.jpg)
Secondary Goal Clients are announcing > /24
and some upstream is allowing them!!
30 November - 4 December, Guam !
![Page 17: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/17.jpg)
Secondary Goal Who are they & how to get all those
prefixes!!
30 November - 4 December, Guam !
![Page 18: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/18.jpg)
Solution ExaBGP + GIXLG
30 November - 4 December, Guam !
![Page 19: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/19.jpg)
• sql backed looking glasses with prefix routing visualisation service high availability automatically isolating dead servers /
broken services DDOS mitigation solutions anycasted services
source : https://github.com/Exa-Networks/exabgp
ExaBGP
30 November - 4 December, Guam !
![Page 20: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/20.jpg)
mysql> desc prefixes; +--------------------+---------------------+------+-----+---------------------+-----------------------------+ | Field | Type | Null | Key | Default | Extra | +--------------------+---------------------+------+-----+---------------------+-----------------------------+ | neighbor | varchar(39) | NO | PRI | NULL | | | type | tinyint(3) unsigned | NO | | NULL | | | prefix | varchar(43) | NO | PRI | NULL | | | length | tinyint(3) unsigned | NO | | NULL | | | ip_start | decimal(39,0) | NO | | NULL | | | ip_end | decimal(39,0) | NO | | NULL | | | ip_poly | polygon | NO | MUL | NULL | | | aspath | varchar(500) | NO | MUL | NULL | | | nexthop | varchar(39) | NO | | NULL | | | community | text | NO | | NULL | | | extended_community | text | NO | | NULL | | | origin | varchar(10) | NO | | NULL | | | originas | int(10) unsigned | NO | | NULL | | | time | timestamp | NO | | 0000-00-00 00:00:00 | on update CURRENT_TIMESTAMP | +--------------------+---------------------+------+-----+---------------------+-----------------------------+
GIXLG
30 November - 4 December, Guam !
![Page 21: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/21.jpg)
select prefix, length, aspath, origin from prefixes where length >
'24';
30 November - 4 December, Guam !
![Page 22: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/22.jpg)
Result
Originating AS
prefix/length
30 November - 4 December, Guam !
![Page 23: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/23.jpg)
Something even more serious!
whois -h whois.cymru.com as132602 AS Name BANGLADESH-AS-AP Bangladesh Submarine Cable Company Limited (BSCCL),BD
whois -h whois.cymru.com 213.144.176.128/31 AS | IP | AS Name 6762 | 213.144.176.128 | SEABONE-NET TELECOM ITALIA SPARKLE S.p.A.,IT
whois -h whois.cymru.com 180.149.11.67/32 AS | IP | AS Name 45904 | 180.149.11.67 | BANGLALION-WIMAX-BD Banglalion Communications Ltd,BD
30 November - 4 December, Guam !
![Page 24: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/24.jpg)
Encourage resource owner to create ROA and start doing RPKI validation
30 November - 4 December, Guam !
![Page 25: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/25.jpg)
RPKI Status : Bangladesh
Total Prefix Valid Invalid Unknown Accuracy RPKI
Adoption Rate
Nov 2014 2079 (100%) 71 (3.42%) 26 (1.25%) 1982
(95.33%) 73.2% 4.67%
Feb 2015 2295 (100%) 137 (5.97%) 9 (0.39%) 2149
(93.64%) 93.84% 6.36%
source : http://rpki.surfnet.nl/perrir.html & http://rpki.surfnet.nl/country.php
30 November - 4 December, Guam !
![Page 26: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/26.jpg)
RPKI Breakdown - APNIC
Year Total Prefix Valid Invalid Unknown Accuracy RPKI
Adoption Rate
November 2014
135876 (100%)
581 (0.43%) 684 (0.5%) 134611 (99.07%)
45.93% 0.93%
November 2015
154338 (100%)
3078 (1.99%) 1123 (0.73%) 150137 (97.28%)
73.27% 2.72%
source : http://rpki.surfnet.nl/perrir.html & http://rpki.surfnet.nl/country.php
30 November - 4 December, Guam !
![Page 27: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/27.jpg)
www.apnic.net/roa!
30 November - 4 December, Guam !
![Page 28: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/28.jpg)
Special thanks to
Jac Kloots SURFnet
http://rpki.surfnet.nl/index.html
Thomas Mangin Exa-Networks : ExaBGP
https://github.com/Exa-Networks/exabgp
Daniel Piekacz GIXtools Project : GIXLG https://gixtools.net
30 November - 4 December, Guam !
![Page 29: A week with analysing RPKI status: Internal Story · A week with analysing RPKI status: Internal Story Fakrul Alam Senior Training Officer, APNIC fakrul@apnic.net](https://reader034.fdocuments.in/reader034/viewer/2022042201/5ea1453a8ad13b74f13761ba/html5/thumbnails/29.jpg)
Thank You