<html>
<body>
<pre>On Jan 16, 2006, at 8:48 AM, Gustavo Rodrigues Ramos wrote:
</pre>> The problem takes place five or six AS far from me... Where I
can't do <br>
> much. I still can't reach some prefixes announced by large
ISPs.<br>
<pre>On Jan 16, 2006, at 7:29 AM, Gustavo Rodrigues Ramos wrote:
>Last week we received a DoS attack which got down my BGP connections
to
>my upstream providers (for three or four times I believe). I also
belive
>that event caused some routers to suppress my BGP announcement.
</pre>We have been conducting simulation studies to quantify<br>
the impact of BGP peering session attacks and how RFD <br>
could severely amplify the outage periods.<br>
I can share some insights we have developed which <br>
I hope are helpful although they may not directly address <br>
the problem you are experiencing.<br>
<br>
Please use this link to our BGP attack simulation work<br>
(at NIST) for additional details:<br>
<a href="http://www.antd.nist.gov/iip_pubs/BGP_RFD_NIST_Sept05.pdf" eudora="autourl">
http://www.antd.nist.gov/iip_pubs/BGP_RFD_NIST_Sept05.pdf<br>
</a> <br>
One point to be noted with certainty is that if your BGP<br>
router loses its BGP session with a peer<br>
and when the session gets restored shortly thereafter, <br>
the peer then resets your RFD penalty to zero. <br>
Hence, even if the attack events happen multiple times,<br>
RFD penalties for prefixes in your AS at your peer are <br>
not incrementing and your peer does not put <br>
your BGP router or prefixes under RFD suppression.<br>
However, your peer's peers and other ASs upstream<br>
(who are more than one hop away from you)<br>
could place the prefixes in your AS under RFD suppression.<br>
When the DOS attacks that caused the BGP session<br>
to be lost multiple times have subsided, then the RFD penalty<br>
will decay below the RFD reuse threshold within<br>
a few thousands of seconds. The half-time of the exponential decay<br>
is typically 900s and hence it takes a few thousands of seconds<br>
for RFD penalty value to fall back below the RFD reuse threshold.<br>
<br>
The BGP speakers that are two or more hops away from your<br>
BGP speaker should restore all prefixes in your AS in their routing<br>
tables within that amount of time (about 2000s to 4000s) after <br>
the attacks have subsided. <br>
From the experimental results in paper we have written<br>
(click on the link noted above for a pdf copy),<br>
it can be seen that even under large scale attacks, the<br>
unreachability between ASs and prefixes lasts for a few <br>
thousands of seconds (after attacks have subsided), <br>
and all AS-prefix routes are restored back to <br>
their stable paths after that amount of time.<br>
If the unreachability in your case has lasted for hours or days
after<br>
the attacks have happened, then it is not clear what<br>
may have caused that. It may be something that is due to operational<br>
procedures with some providers that are extraneous to the<br>
normal operating principles of RFD (just a thought).<br>
<br>
Sriram <br>
<x-sigsep><p></x-sigsep>
K. Sriram<br>
E-Mail: ksriram@nist.gov<br>
Web:
<a href="http://www.antd.nist.gov/iipp.shtml" eudora="autourl">
http://www.antd.nist.gov/iipp.shtml<br>
</a></body>
</html>