Mailing List Archive: I thought AS5397 said it was a limited test back in Feb 2005?

I thought AS5397 said it was a limited test back in Feb 2005?

Apr 20, 2005, 9:09 AM

Post #1 of 11 (4104 views)

They are at it again:

Apr 19 17:36:10 gp1 2117: Apr 19 17:36:09: %BGP-6-ASPATH: Long AS path
20965 1299 3320 15589 15589 5397
{33,109,145,278,293,513,559,1257,1275,1752,1853,2042,2497,2500,2607,2914,3257,3265,3292,3352,3425,3549,3748,3786,4691,4697,4716,4725,5609,5623,6175,6320,6342,6435,6830,6939,7033,8447,10566,12779,13944,14277,17715,17965,24136,24895,29686,31103,32266}
received from 2001:798:201B:10AA::1: More than configured MAXAS-LIMIT
Apr 19 17:38:10 gp1 2118: Apr 19 17:38:09: %BGP-6-ASPATH: Long AS path
20965 1299 3320 15589 15589 5397
{33,109,145,278,293,513,559,1257,1752,1853,2042,2497,2500,2914,3257,3265,3292,3352,3425,3549,3748,3786,4691,4697,4716,4725,5609,5623,6175,6320,6342,6435,6830,6939,7033,8447,10566,12779,13944,14277,17715,17965,24136,24895,29686,31103,32266}
received from 2001:798:201B:10AA::1: More than configured MAXAS-LIMIT
Apr 19 17:39:44 gp1 2119: Apr 19 17:39:43: %BGP-6-ASPATH: Long AS path
20965 1299 3320 1275 15589 15589 5397
{33,109,145,278,293,513,559,1257,1752,1853,2042,2497,2500,2914,3257,3265,3292,3352,3425,3549,3748,3786,4691,4697,4716,4725,5609,5623,6175,6320,6342,6435,6830,6939,7033,8447,10566,12779,13944,14277,17715,17965,24136,24895,29686,31103,32266}
received from 2001:798:201B:10AA::1: More than configured MAXAS-LIMIT
Apr 19 18:18:04 gp1 2120: Apr 19 18:18:03: %BGP-6-ASPATH: Long AS path
20965 1299 3320 15589 15589 5397
{33,109,145,278,293,513,559,1257,1752,1853,2042,2497,2500,2914,3257,3265,3292,3352,3425,3549,3748,3786,4691,4697,4716,4725,5609,5623,6175,6320,6342,6435,6830,6939,7033,8447,10566,12779,13944,14277,17715,17965,24136,24895,29686,31103,32266}
received from 2001:798:201B:10AA::1: More than configured MAXAS-LIMIT
Apr 19 19:07:02 gp1 2121: Apr 19 19:07:01: %BGP-6-ASPATH: Long AS path
20965 1299 3320 1275 15589 15589 5397
{33,109,145,278,293,513,559,1257,1752,1853,2042,2497,2500,2914,3257,3265,3292,3352,3425,3549,3748,3786,4691,4697,4716,4725,5609,5623,6175,6320,6342,6435,6830,6939,7033,8447,10566,12779,13944,14277,17715,17965,24136,24895,29686,31103,32266}
received from 2001:798:201B:10AA::1: More than configured MAXAS-LIMIT

-Hank

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 21, 2005, 11:25 PM

Post #2 of 11 (4028 views)

On Wed, Apr 20, 2005 at 10:07:03AM +0300, Hank Nussbacher wrote:
> They are at it again:
>
> Apr 19 17:36:10 gp1 2117: Apr 19 17:36:09: %BGP-6-ASPATH: Long AS path
> 20965 1299 3320 15589 15589 5397
> {33,109,145,278,293,513,559,1257,1275,1752,1853,2042,2497,2500,2607,2914,3257,3265,3292,3352,3425,3549,3748,3786,4691,4697,4716,4725,5609,5623,6175,6320,6342,6435,6830,6939,7033,8447,10566,12779,13944,14277,17715,17965,24136,24895,29686,31103,32266}
> received from 2001:798:201B:10AA::1: More than configured MAXAS-LIMIT

Lorenzo,

in a 2005-03-01 posting to {nanog@merit.edu, routing-wg@ripe.net,
ris-users@ripe.net} you've announced the plan to do those experiments
in IPv4 world and you heard a lot of concerns. In the same mail you
wrote "We have been performing similar experiments over IPv6, in
collaboration with the NAMEX internet exchange, since December 2004
with no ill effects".

I guess what Hank sees is exactly that, can you confirm?

The thread concluded that your group will come up with a document
explaining the technique and why it won't harm. "Once it is ready we
will post a link to this list and elsewhere so people can comment on it,
discussion can continue, and hopefully aconsensus can be found on the
use of the techniques. We hope to have something ready in two to three
weeks.".

By these words, I do understand that you cease those experiments until
consensus is reached.

I'm not able to find any later posting from you that publishes the
document, or any discussion.

So I wonder why you continue those experiments in IPv6? The IPv6 DFZ
ain't a playground, not more than the IPv4 DFZ.

Please let us know what's going on there. Thanks!

Regards,
Daniel

--
CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 22, 2005, 2:42 AM

Post #3 of 11 (4030 views)

Daniel Roesen wrote:
> On Wed, Apr 20, 2005 at 10:07:03AM +0300, Hank Nussbacher wrote:
>
>>They are at it again:
>>
>>Apr 19 17:36:10 gp1 2117: Apr 19 17:36:09: %BGP-6-ASPATH: Long AS path
>>20965 1299 3320 15589 15589 5397
>>{33,109,145,278,293,513,559,1257,1275,1752,1853,2042,2497,2500,2607,2914,3257,3265,3292,3352,3425,3549,3748,3786,4691,4697,4716,4725,5609,5623,6175,6320,6342,6435,6830,6939,7033,8447,10566,12779,13944,14277,17715,17965,24136,24895,29686,31103,32266}
>>received from 2001:798:201B:10AA::1: More than configured MAXAS-LIMIT
>
>
> Lorenzo,
>
> in a 2005-03-01 posting to {nanog@merit.edu, routing-wg@ripe.net,
> ris-users@ripe.net} you've announced the plan to do those experiments
> in IPv4 world and you heard a lot of concerns. In the same mail you
> wrote "We have been performing similar experiments over IPv6, in
> collaboration with the NAMEX internet exchange, since December 2004
> with no ill effects".
>
> I guess what Hank sees is exactly that, can you confirm?
>
> The thread concluded that your group will come up with a document
> explaining the technique and why it won't harm. "Once it is ready we
> will post a link to this list and elsewhere so people can comment on it,
> discussion can continue, and hopefully aconsensus can be found on the
> use of the techniques. We hope to have something ready in two to three
> weeks.".
>
> By these words, I do understand that you cease those experiments until
> consensus is reached.
>
> I'm not able to find any later posting from you that publishes the
> document, or any discussion.
>
> So I wonder why you continue those experiments in IPv6? The IPv6 DFZ
> ain't a playground, not more than the IPv4 DFZ.
>
> Please let us know what's going on there. Thanks!

Hi Daniel,

apologies for not replying to this, but unfortunately Hank did not CC
either our research group or the admins of AS5397, so I did not receive
the email directly, and I am not subscribed to the list.

Those AS-sets do indeed come from us. We announced them because we are
finalizing the document that describes our techniques and we needed
another set of experimental results to confirm their effectiveness.

We know the IPv6 network is not a playground, but we are confident of
the safety of our techniques. This is not only because we have tested
them in the lab on real-world equipment, but also because, as my
original posting said, we tested them in the IPv6 network for several
months and saw no negative effects. Actually, nobody even noticed until
our experiments were almost over.

The document is almost ready and should be available soon, hopefully in
a few days' time.

Regards,
Lorenzo

--
---------------------------------------------------------
Lorenzo Colitti Ph.D student
Computer Networks research group Roma Tre University
colitti@dia.uniroma3.it +39-0655173215
---------------------------------------------------------

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 22, 2005, 4:49 PM

Post #4 of 11 (4026 views)

On 2005-Apr-21, at 5:25 PM, Daniel Roesen wrote:

> in a 2005-03-01 posting to {nanog@merit.edu, routing-wg@ripe.net,
> ris-users@ripe.net} you've announced the plan to do those experiments
> in IPv4 world and you heard a lot of concerns.

I think it's more accurate to say that there were a small number of
concerns raised vocally by a small number of people.

Joe

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 22, 2005, 4:50 PM

Post #5 of 11 (4038 views)

Hi,

On Fri, Apr 22, 2005 at 10:48:27AM -0400, Joe Abley wrote:
> On 2005-Apr-21, at 5:25 PM, Daniel Roesen wrote:
>
> >in a 2005-03-01 posting to {nanog@merit.edu, routing-wg@ripe.net,
> >ris-users@ripe.net} you've announced the plan to do those experiments
> >in IPv4 world and you heard a lot of concerns.
>
> I think it's more accurate to say that there were a small number of
> concerns raised vocally by a small number of people.

I saw nobody supporting their plans to "play around with global BGP
announcements", though...

Gert Doering
-- NetMaster
--
Total number of prefixes smaller than registry allocations: 71007 (66629)

SpaceNet AG Mail: netmaster@Space.Net
Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0
D- 80807 Muenchen Fax : +49-89-32356-234

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

koch at tiscali

Apr 22, 2005, 4:52 PM

Post #6 of 11 (4032 views)

On Fri, 22 April 2005 16:50:25 +0200, Gert Doering wrote:
> I saw nobody supporting their plans to "play around with global BGP
> announcements", though...

The big crowd that probably did not care. And it did not
affect me at all yet, so what was the problem again? *sigh*

Alexander

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 22, 2005, 5:08 PM

Post #7 of 11 (4034 views)

On 2005-Apr-22, at 10:50 AM, Gert Doering wrote:

> On Fri, Apr 22, 2005 at 10:48:27AM -0400, Joe Abley wrote:
>
>> On 2005-Apr-21, at 5:25 PM, Daniel Roesen wrote:
>>
>>> in a 2005-03-01 posting to {nanog@merit.edu, routing-wg@ripe.net,
>>> ris-users@ripe.net} you've announced the plan to do those
>>> experiments
>>> in IPv4 world and you heard a lot of concerns.
>>
>> I think it's more accurate to say that there were a small number of
>> concerns raised vocally by a small number of people.
>
> I saw nobody supporting their plans to "play around with global BGP
> announcements", though...

People play around with global BGP announcements every day of the
year. If the Internet was really as sensitive to experimentation as
some of the people in that NANOG thread suggested, it would have
imploded years ago.

Joe

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 22, 2005, 5:11 PM

Post #8 of 11 (4037 views)

Hi,

On Fri, Apr 22, 2005 at 11:07:31AM -0400, Joe Abley wrote:
> People play around with global BGP announcements every day of the year.

Sure, but usually they try to avoid doing this with other people's AS
numbers.

Gert Doering
-- NetMaster
--
Total number of prefixes smaller than registry allocations: 71007 (66629)

SpaceNet AG Mail: netmaster@Space.Net
Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0
D- 80807 Muenchen Fax : +49-89-32356-234

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 22, 2005, 5:16 PM

Post #9 of 11 (4028 views)

On 2005-Apr-22, at 11:11 AM, Gert Doering wrote:

> Sure, but usually they try to avoid doing this with other people's AS
> numbers.

People have been prepending other peoples' AS numbers into their
advertisements as a coarse inter-domain traffic engineering tool for
years. It has been described in NANOG tutorials on inter-domain
traffic engineering. It's old news. Is this really that different?

AS_PATH is a loop detection mechanism, not some kind of legal
endorsement of packet contents.

Joe

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 22, 2005, 5:58 PM

Post #10 of 11 (4028 views)

On Fri, Apr 22, 2005 at 11:15:42AM -0400, Joe Abley wrote:
> People have been prepending other peoples' AS numbers into their
> advertisements as a coarse inter-domain traffic engineering tool for
> years. It has been described in NANOG tutorials on inter-domain
> traffic engineering. It's old news. Is this really that different?

Yes, as we're talking about artificially large AS_SETs, not some random
triple-prepend. Doing TE with dirty (foreign ASN) prepends is a
different matter. My fear is that artifically large AS_SETs might
trigger buffer overflows and thus memory corruption, where the result
(misbehaviour, crashes) is not necessarily correlable to those
announcements because it might take hours, days or weeks to actually
have an adverse effect.

Lorenzo said it was tested before. With which gear of which vendors, and
which OS software releases? Did those test devices run long enough to
see the fallout of possible buffer overflow memory corruption?

And I have a problem with them ceasing the experimentation in IPv4, but
continuing in IPv6 world (with it's unmature IPv6 BGP implementations of
e.g. IOS which sometimes just forgets to forward/send withdrawl e.g.).

> AS_PATH is a loop detection mechanism, not some kind of legal
> endorsement of packet contents.

Artificial other-people-ASN prepends are certainly NOT helpful when
troubleshooting BGP routing.

Joe, I see where you're coming from. Still it's a difference of using
things the "normal" way or "going where noone has gone before
(exaggaration of course) and seeing what'll happen".

IMHO. YMMV.

Best regards,
Daniel

--
CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0

I thought AS5397 said it was a limited test back in Feb 2005? [ In reply to ]

Apr 23, 2005, 2:56 AM

Post #11 of 11 (4021 views)

On 2005-Apr-22, at 11:58 AM, Daniel Roesen wrote:

> Joe, I see where you're coming from. Still it's a difference of using
> things the "normal" way or "going where noone has gone before
> (exaggaration of course) and seeing what'll happen".

I understand what you're saying, too.

Apologies for my knee-jerk responses :-)

Joe