Bogon filtering (don't ban me)
Iljitsch van Beijnum
iljitsch at muada.com
Sun Dec 5 22:17:12 UTC 2004
On 5-dec-04, at 22:06, Cliff Albert wrote:
>> So filtering at the /8 level as in the document linked above isn't
>> really going to buy you much in practice.
> /8 le /32 still stands for /8 and more-specifics as I remember ? :)
You don't say... What will they come up with next??
My point is that if there is even a small part of a /8 in use, then the
/8 isn't in the bogon list. For instance, 191.0.0.0/8 isn't there,
although AFAIK this space isn't used, it's just that 191.255.0.0/16 is
"reserved".
> Secondly not everything is about security but also about keeping
> routing
> tables clean and useful, as more people noticed today.
If only we could...
> Filtering bogons away is just an extra step in making sure that you
> transport real traffic instead of bogus traffic of which you are 100%
> sure that it's *useless* traffic. uRPF will fix it for your own
> network,
Right. So there is no need to use bogon lists.
> but filtering bogon routes away in BGP will also make your downstream
> a happier place.
You are assuming that there are significant bogon routes in the routing
table. I'm sure there is bad stuff in the global routing table from
time to time that Rob's bogon list will catch, but I seriously doubt
it's very much. Injecting bogon routes so you can get past uRPF doesn't
make sense (except maybe for the first hop AS) and for any other
(ab)use such as spamming selecting something that isn't as obvious is
much more useful.
(In any case, ISPs accepting bogon routes from their customers is
completely unacceptable. Filtering routes from peers isn't always
feasible, and even lack of source address filtering on ingress from
customers can be excusable at times, but filtering BGP advertisements
from customers is every ISP's sacred duty.)
> The only argument from you I have seen against bogon filtering is the
> fact that the lists aren't updated by certain parties.
I've never felt that it's useful. So one argument against is more than
sufficient.
However, allow me to contradict myself by taking the position that it's
better for us network operators to do bogon filtering so our customers
don't have to, rather than have any fool with an ipfw or similar shoot
himself in the foot. The preferred way to do this would be uRPF.
More information about the NANOG
mailing list