Filter on IXP
Jérôme Nicolle
jerome at ceriz.fr
Fri Feb 28 15:42:59 UTC 2014
Hi Chris,
Le 23/02/2014 01:43, Chris Laffin a écrit :
> It would be really cool if peering exchanges could police ntp on their connected members.
Well, THIS looks like the worst idea ever. Wasting ASIC ressources on
IXP's dataplanes is a wet-dream for anyone willing to kill the network.
IXP's neutrality is a key factor to maintain reasonable interconnexion
density.
Instead, IXPs _could_ enforce BCP38 too. Mapping the route-server's
received routes to ingress _and_ egress ACLs on IXP ports would mitigate
the role of BCP38 offenders within member ports. It's almost like uRPF
in an intelligent and useable form.
A noticeable side-effect is that members would be encouraged to announce
their entire customer-cones to ensure egress trafic from a non-exchanged
prefix would not be dropped on the IX's port.
By the way, would anyone know how to generate OpenFlow messages to push
such filters to member ports ? Would there be any smat way to do that on
non-OpenFlow enabled dataplanes (C6k...) ?
Best regards,
--
Jérôme Nicolle
+33 6 19 31 27 14
More information about the NANOG
mailing list