How to Make Routing More Secure
|
|
|
- Maurice Gerard York
- 7 years ago
- Views:
Transcription
1 How to Make Routing More Secure Resource Certification (RPKI) Mirjam Kühne & Ivo Dijkhuis (RIPE NCC) TF-CSIRT 45 Poznan - Poland 22 May 2015
2 Overview 2 Very brief introduction to the RIPE NCC IPv4 hijacking and IPv4 transfers Problem statement - Routing Security Possible solution - Resource Certification (RPKI) Making routing decisions Uptake of RPKI and future developments
3 The RIPE Network Coordination Centre 3 Established in 1992 by the RIPE community - Initially part of the academic network association - Since 1997 a membership association under Dutch law - Not for profit, independent, neutral, open - Main offices in Amsterdam; staff in Dubai and Moscow Funded by the membership - 11,500 members from 76 countries - Initially mostly ISPs and universities - Now also traditional industries, small Internet companies One of five Regional Internet Registries The Internet Registry System - April 2015
4 Regional Internet Registries 4 The Internet Registry System - April 2015
5 IPv4 Address Hijacking and Transfers 5 Presented on IPv4 hijacking at TF-CSIRT in Rome Number of hijackings went down - Due to clean-up in RIPE Database Number of IPv4 transfer went up significantly - See recent post on RIPE Labs (labs.ripe.net) Transfers can create routing overlaps
6 The Issue 6 Network operators should only announce the IP block (IP prefix) they are the legitimate holder of However, errors can happen - Due to typos or - A bad person is trying to hijack a network by announcing a prefix maliciously So the question is: Is this autonomous system (AS) really supposed to be announcing this IP address block?
7 The Solution - Resource Certification 7 The Regional Internet Registries (RIRs) are the authority on who is the legitimate holder of resources in their region - IPv4 and IPv6 address blocks - Autonomous System Numbers Information is kept in the registry (whois database) Accuracy and completeness are key - Offers validatable proof of holdership
8 Digital Resource Certificates 8 Based on IETF standards - Secure Interdomain Routing (SIDR) working group - RFC 5280: X.509 PKI Certificates - RFC 3779: Extensions for IP Addresses and ASNs - RFC : Resource Public Key Infrastructure Issued by the RIRs since 1 January 2011 Digital certificate states that an Internet number resource has been registered by the RIPE NCC
9 Certification to Secure Internet Routing 9 Resource holders can use their resource certificate to make statements about their BGP routing Route Origin Authorisation (ROA): I authorise this Autonomous System to originate these prefixes Also in a ROA: Maximum Prefix Length - The longest prefix the ASN may announce
10 Example of ROA 10 Kühne & Dijkhuis - TF-CSIRT 45-22/05/2015
11 Making Routing Decisions
12 Route Origin Authorisations 12 A ROA affects the RPKI validity of a BGP route - VALID: ROA found, authorised announcement - INVALID: ROA found, unauthorised announcement - UNKNOWN: No ROA found (resource not yet signed) Every operator is free to base any routing decision on these validity states
13 Validation in Practice 13 All certificates and ROAs are published in a repository and available for download Software running on your own machine will periodically retrieve and verify the information - Cryptographic tools check all the signatures The result is a list of all valid combinations of ASN and prefix, the validated cache
14 The RPKI Ecosystem 14 Validated RPKI information can be sent to router, so operators can use it easily A production system since All RIRs offer the functionality to their members - All major router vendors offer native support Cisco, Juniper, Alcatel Lucent, Quagga Several open source tools to validate ROAs
15 Uptake of RPKI
16 RPKI Adoption 16
17 RPKI Adoption 17
18 Future Developments of RPKI 18 Most major ISP have adopted RPKI - Deutsche Telekom, Telefonica, KPN, SFR, etc. Adoption by smaller ISPs accelerating now Path validation is being standardised - Making it impossible to spoof an AS Origin + Path validation offers full routing security
19 Further References 19 More information on the RIPE NCC web site RPKI Statistics RIPE Labs labs.ripe.net IETF SIDR WG
Resource Certification. Alex Band Product Manager
Resource Certification Alex Band Product Manager The RIPE NCC involvement in RPKI The authority on who is the registered holder of an Internet Number Resource in our region IPv4 and IPv6 Address Blocks
RPKI Tutorial. Certification. Goals. Current Practices in Filtering
RPKI Tutorial MENOG 10, Dubai UAE Marco Hogewoning Trainer Goals Explain where it started Learn what resources certificates are Learn how to request a certificate Learn how to create a Route Origin Authorization
OPPORTUNITIES AND CHALLENGES IN CYBERSECURITY
ASIA-PACIFIC TELECOMMUNITY 5th APT CYBERSECURITY FORUM (CSF-5) 26-28 May 2014, Ulaanbaatar, Mongolia Document CSF-5/INP-13 19 May 2014 Mr. Adli Wahid, APNIC OPPORTUNITIES AND CHALLENGES IN CYBERSECURITY
The ISP Column A monthly column on things Internet. Securing BGP with BGPsec. Introduction
The ISP Column A monthly column on things Internet July 2011 Geoff Huston Randy Bush Securing BGP with BGPsec Introduction For many years the Internet's fundamental elements names and addresses were the
IPv4 Address Trading Using Resource Certificate
Journal of Information Processing Systems, Vol.6, No.1, March 2010 DOI : 10.3745/JIPS.2010.6.1.107 IPv4 Address Trading Using Resource Certificate Cheol-Soon Park*, Jae-Cheol Ryou** and Yong-Tae Park***
Routing Security Training Course
Routing Security Training Course Exercise Booklet November 2015 Introduction Your database objects For your convenience we have already created some objects in the RIPE TEST Database. You can use these
APNIC Trial of Certification of IP Addresses and ASes
APNIC Trial of Certification of IP Addresses and ASes RIPE 51 11 October 2005 Geoff Huston 1 Address and Routing Security What we have today is a relatively insecure system that is vulnerable to various
Improving Rou-ng Security with RPKI
Improving Rou-ng Security with RPKI Russ Clark Russ.Clark@gatech.edu Samuel Norris Samuel.Norris@gatech.edu Cas D Angelo, Sco7 Friedrich Ron Hutchins, Aurore Nguenang Thank you to the Na-onal Science Founda-on
BGP FORGOTTEN BUT USEFUL FEATURES. Piotr Wojciechowski (CCIE #25543)
BGP FORGOTTEN BUT USEFUL FEATURES Piotr Wojciechowski (CCIE #25543) ABOUT ME Senior Network Engineer MSO at VeriFone Inc. Previously Network Solutions Architect at one of top polish IT integrators CCIE
Policy-Based AS Path Verification with Enhanced Comparison Algorithm to Prevent 1-Hop AS Path Hijacking in Real Time
, pp.11-22 http://dx.doi.org/10.14257/ijmue.2016.11.1.02 Policy-Based AS Path Verification with Enhanced Comparison Algorithm to Prevent 1-Hop AS Path Hijacking in Real Time Je-Kuk Yun 1 and Jin-Hee Song
Draft RIPE NCC Activity Plan and Budget 2015. Introduction to the Activity Plan and Budget 2015
Draft RIPE NCC Activity Plan and Budget 2015 Introduction to the Activity Plan and Budget 2015 The RIPE NCC Activity Plan and Budget 2015 documents the activities that the RIPE NCC proposes to undertake
Recent Progress in Routing Standardization An IETF update for UKNOF 23
Recent Progress in Routing Standardization An IETF update for UKNOF 23 Old Dog Consulting Adrian Farrel adrian@olddog.co.uk afarrel@juniper.net IETF Routing Area Director Daniel King daniel@olddog.co.uk
APNIC Plans and Budget - Review
APNIC 2015 Activity Plan and Budget APNIC 2015 Activity Plan and Budget Table of Contents Introduction... 3 Notes on the Plan... 4 Executive Summary... 5 Operating Expenditure 2015... 5 APNIC 2015 Activity
A PKI For IDR Public Key Infrastructure and Number Resource Certification
A PKI For IDR Public Key Infrastructure and Number Resource Certification AUSCERT 2006 Geoff Huston Research Scientist APNIC If You wanted to be Bad on the Internet And you wanted to: Hijack a site Inspect
Internet Operations and the RIRs
Internet Operations and the RIRs Overview ARIN and the Regional Internet Registry (RIR) System IP Number Resources, DNS and Routing IP Address Management Whois ARIN and the RIR System About ARIN One of
RIPE Database Terms and Conditions
RIPE Database Terms and Conditions The RIPE NCC shall make the RIPE Database publicly accessible under these RIPE Database Terms and Conditions (hereinafter: the Terms and Conditions ). The Terms and Conditions
Internet Bodies. Bernard.Tuy@renater.fr
Internet Bodies Bernard.Tuy@renater.fr Agenda Names, Acronyms in the Internet IETF organisation IESG, IAB, ISOC ICANN & IANA Standardisation process Standardisation compliance Internet Registries Requesting
BREAKING HTTPS WITH BGP HIJACKING. Artyom Gavrichenkov R&D Team Lead, Qrator Labs ag@qrator.net
BREAKING HTTPS WITH BGP HIJACKING Artyom Gavrichenkov R&D Team Lead, Qrator Labs ag@qrator.net ABSTRACT OVERVIEW OF BGP HIJACKING GLOBAL AND LOCAL HIJACKING HIJACKING A CERTIFICATE AUTHORITY MITIGATIONS
Global Infrastructure Security and IPv6 Implications. Larry J. Blunk Fall 2004 Internet2 Member Meeting September 29, 2004
Global Infrastructure Security and IPv6 Implications Larry J. Blunk Fall 2004 Internet2 Member Meeting September 29, 2004 1 Defining GlobGg infbasfrusrfee Internet Global Infrastructure consists of core
Internet Structure and Organization
Internet Structure and Organization Resources management and allocation Bernard.Tuy@renater.fr Introduction What s the Internet? Why organizations / bodies are needed? Define protocol specifications Agree
Database Update. Johan Åhlén Assistant Manager and Denis Walker Business Analyst
Database Update Johan Åhlén Assistant Manager and Denis Walker Business Analyst RIPE Database statistics 2,500 unit and integration tests 1,500 end-to-end tests Operational stats: https://www.ripe.net/data-tools/stats/ripe-database
Enabling Operational Use of RPKI via Internet Routing Registries
CYBER SECURITY DIVISION 2013 PRINCIPAL INVESTIGATORS Enabling Operational Use of RPKI via Internet Routing Registries Merit Network, Inc. Dr. Joe Adams 17 September 2013 Agenda Introduction Technical Approach
Collective responsibility for security and resilience of the global routing system
Collective responsibility for security and resilience of the global routing system Andrei Robachevsky www.internetsociety.org Let us look at the problem first BGP is based on trust
Introduction to The Internet. ISP/IXP Workshops
Introduction to The Internet ISP/IXP Workshops 1 Introduction to the Internet Topologies and Definitions IP Addressing Internet Hierarchy Gluing it all together 2 Topologies and Definitions What does all
Network Security. Mobin Javed. October 5, 2011
Network Security Mobin Javed October 5, 2011 In this class, we mainly had discussion on threat models w.r.t the class reading, BGP security and defenses against TCP connection hijacking attacks. 1 Takeaways
Measuring IPv6 Deployment. Geoff Huston APNIC December 2009
Measuring IPv6 Deployment Geoff Huston APNIC December 2009 IPv4 address exhaustion Total Address Count Adver0sed Count IANA Pool Unadver0sed Count IPv4 address exhaustion The model of address consumption
Aggregation (?) Effect of business practices on the Internet today. Philip Smith RIPE 50, Stockholm
Aggregation (?) Effect of business practices on the Internet today Philip Smith RIPE 50, Stockholm BGP Report (gih) Data taken from: bgp.potaroo.net/as4637/ 157000 prefixes total announcements 108000 prefixes
BGP Security The Human Threat
BGP Security The Human Threat RIPE / Amsterdam 2011.05.02 Randy Bush 2011.05.02 The Human Threat 1 Assume RPKI Cert/IANA CA 98.128.0.0/16 SIA Cert/RIPE CA CA CA Cert/ARIN Cert/APNIC 98.128.0.0/20
RIPE Network Coordination Centre RIPE NCC LIR Tutorial
RIPE NCC LIR Tutorial Alex Band, RIPE NCC The Internet Registry (IR) system Getting resources RIPE Database 2 What is an LIR? Local Internet Registry - responsible for obtaining, distributing and registering
IPv6 and 4-byte ASN Update
IPv6 and 4-byte ASN Update Philip Smith PacNOG 8 Pohnpei, FSM 22nd-27th November 2010 1 IPv6 Update 2 2004 Today Resurgence in demand for IPv4 address space 5% address space still unallocated
Preventing Common Attacks on Critical Infrastructure
University of Amsterdam Master System and Network Engineering Research Project Preventing Common Attacks on Critical Infrastructure Students: Wouter Miltenburg Wouter.Miltenburg@os3.nl Koen Veelenturf
Secure routing: State-of-the-art deployment and impact on network resilience
Secure Routing July 10 Secure routing: State-of-the-art deployment and impact on network resilience About ENISA: The European Network and Information Security Agency (ENISA) is an EU agency created to
The IANA Functions. An Introduction to the Internet Assigned Numbers Authority (IANA) Functions
The IANA Functions An Introduction to the Internet Assigned Numbers Authority (IANA) Functions Contents SECTION 1: INTRODUCTION 4 SECTION 2: POLICY, STAKEHOLDERS AND STEWARDSHIP IMPLEMENTATION 6 SECTION
Introduction to RPSL. TorIX Meeting, September 2004 Joe Abley, jabley@isc.org
Introduction to RPSL TorIX Meeting, September 2004 Joe Abley, jabley@isc.org Agenda Some handwaving about why any of this is actually useful Architectural overview Incredibly brief history lesson Brief
How To Get An Ipv6 Allocation On Ipv4 (Ipv4) From Ipv5) From The Ipvripe Ncc (Ip6) From A Ipvv6 Ipv2 (Ip4) To Ip
What s hot at the RIPE NCC PLNOG6, March 2011 Sandra Brás Trainer, RIPE NCC sbras@ripe.net Hot topics - overview The registry system IPv4 depletion IPv6 policy update Independent resources 2 The five RIRs
IPv6 and IPv4 Update from the RIPE NCC. Sandra Brás, Ferenc Csorba
IPv6 and IPv4 Update from the RIPE NCC Sandra Brás, Ferenc Csorba RIPE NCC IPv6 Kongress - Frankfurt 22 May 2014 Schedule IPv6 Kongress 2 RIPE/RIPE NCC. Who are we? IPv4 exhaustion IPv4 transfers IPv6
IPv6 The Big Picture. Rob Evans, Janet Rob.Evans@ja.net
IPv6 The Big Picture Rob Evans, Janet Rob.Evans@ja.net Where are we? IPv4 32 bit addresses 4,294,967,296 possible addresses In practice much less than this. History of large allocations /8s Inefficiency
Embedded BGP Routing Monitoring. Th. Lévy O. Marcé
Embedded BGP Routing Monitoring Th. Lévy O. Marcé Introduction & Motivations Off-line BGP routing monitoring initiatives (i.e based on router logs) already exist: Periodic report : The CIDR Report Objective
Layer Four Traceroute (and related tools) A modern, flexible path-discovery solution with advanced features for network (reverse) engineers
Layer Four Traceroute (and related tools) A modern, flexible path-discovery solution with advanced features for network (reverse) engineers So, what is path discovery and why is it important? Path discovery
F root anycast: What, why and how. João Damas ISC
F root anycast: What, why and how João Damas ISC Overview What is a root server? What is F? What is anycast? F root anycast. Why? How does ISC do it? What is f.root-servers.net? One the Internet s official
Introduction to The Internet
Introduction to The Internet ISP Workshops Last updated 5 September 2014 1 Introduction to the Internet p Topologies and Definitions p IP Addressing p Internet Hierarchy p Gluing it all together 2 Topologies
technical Operations Area IP Resource Management
IP Resource Management technical The IP Resource management is one of the critical areas of AfriNIC's activities. 27 has shown a great growth in its activity through new members and Resources Allocation/Assignment.
BGP Techniques for Internet Service Providers
BGP Techniques for Internet Service Providers Philip Smith AfNOG 2011 Dar Es Salaam, Tanzania 5 June 2011 AfNOG 2011 1 Presentation Slides Will be available on ftp://ftp-eng.cisco.com /pfs/seminars/afnog2011-bgp-techniques.pdf
Network Security Workshop
Network Security Workshop Threat Pragmatics Fakrul (Pappu) Alam bdhub Limited fakrul@bdhub.com Targets Many sorts of targets: Network infrastructure Network services Application services User machines
Introduction to Routing
Introduction to Routing How traffic flows on the Internet Philip Smith pfs@cisco.com RIPE NCC Regional Meeting, Moscow, 16-18 18 June 2004 1 Abstract Presentation introduces some of the terminologies used,
Simple Multihoming. ISP Workshops. Last updated 30 th March 2015
Simple Multihoming ISP Workshops Last updated 30 th March 2015 1 Why Multihome? p Redundancy n One connection to internet means the network is dependent on: p Local router (configuration, software, hardware)
Network Level Multihoming and BGP Challenges
Network Level Multihoming and BGP Challenges Li Jia Helsinki University of Technology jili@cc.hut.fi Abstract Multihoming has been traditionally employed by enterprises and ISPs to improve network connectivity.
Detecting BGP hijacks in 2014
Detecting BGP hijacks in 2014 Guillaume Valadon & Nicolas Vivet Agence nationale de la sécurité des systèmes d information http://www.ssi.gouv.fr/en NSC - November 21th, 2014 ANSSI - Detecting BGP hijacks
DD2491 p1 2008. Load balancing BGP. Johan Nicklasson KTHNOC/NADA
DD2491 p1 2008 Load balancing BGP Johan Nicklasson KTHNOC/NADA Dual home When do you need to be dual homed? How should you be dual homed? Same provider. Different providers. What do you need to have in
Analyzing Capabilities of Commercial and Open-Source Routers to Implement Atomic BGP
Telfor Journal, Vol. 2, No. 1, 2010. 13 Analyzing Capabilities of Commercial and Open-Source Routers to Implement Atomic BGP Aleksandar Cvjetić and Aleksandra Smiljanić Abstract The paper analyzes implementations
Policy Implementation and Experience Report. Leslie Nobile
Policy Implementation and Experience Report Leslie Nobile Recently Implemented Policies ARIN-2012-5: Removal of Renumbering Requirement for Small Multi-homers Ø No longer required to return and renumber
Open Source Software for Routing
APNIC 34 Open Source Software for Routing A look at the status of Open Source Software for Routing Martin Winter OpenSourceRouting.org 1 Who is OpenSourceRouting Quick Overview of what we do and who we
SPAMTRACER TRACKING FLY- BY SPAMMERS
SPAMTRACER TRACKING FLY- BY SPAMMERS NANOG60 PIERRE- ANTOINE VERVIER SYMANTEC RESEARCH LABS Pierre- Antoine_Vervier@symantec.com NANOG60 Atlanta 2014.02.10-12 1 2 BGP hijacking CAUSES The injecmon of erroneous
IPv6 Addressing. ISP Training Workshops
IPv6 Addressing ISP Training Workshops 1 Where to get IPv6 addresses p Your upstream ISP p Africa n AfriNIC http://www.afrinic.net p Asia and the Pacific n APNIC http://www.apnic.net p North America n
Outline. Outline. Outline
Network Forensics: Network Prefix Scott Hand September 30 th, 2011 1 What is network forensics? 2 What areas will we focus on today? Basics Some Techniques What is it? OS fingerprinting aims to gather
SECURE PROTOCOLS FOR THE ROUTING INFRASTRUCTURE (SPRI) INITIATIVE. A ROAD MAP (First Draft)
SECURE PROTOCOLS FOR THE ROUTING INFRASTRUCTURE (SPRI) INITIATIVE A ROAD MAP (First Draft) SPARTA, INC SEPTEMBER 2006 Table of Contents Table of Contents... i List of Figures... i 1 Executive Summary...
Network Infrastructure Under Siege
Network Infrastructure Under Siege Char Sample Security Engineer, CERT Information Security Decisions TechTarget Disclaimer Standard Disclaimer - This talk represents the opinions and research of the presenter
BGP Routing. Course Description. Students Will Learn. Target Audience. Hands-On
Hands-On Course Description This Hands-On course on (Border Gateway Protocol), from the basics of how it works through to advanced issues such as route reflectors, policy, filtering, route selection and
IPE Database Features
RIPE Database Software Recent Changes Shane Kerr, RIPE NCC shane@ripe.net APNIC 18, September 2004 RIPE Database Software: Recent Changes Page 1 of 7 X.509 Support Added As part of the Improved Secure
Practical BGP Security: Architecture, Techniques and Tools
renesys WHITE PAPER Practical BGP Security: Architecture, Techniques and Tools Laris Benkis A practical approach to identify weaknesses and highlight strategies for the detection of internetwork failures
Interconnections on the Internet: Exchange Points
Interconnections on the Internet: Exchange Points Keith Mitchell CTO, XchangePoint RIPE NCC Regional Meeting Dubai, 7 th Dec 2003 Outline of Presentation Introduction Internet Interconnect Principles Internet
RIPE Policy Development Process
RIPE Policy Development Process And some recent topics 1 Overview RIPE RIPE Policy Development Process (PDP) Current Topics - IPv4 Depletion - IPv6 Deployment 2 RIPE Folks in Europe talking about TCP/IP
Managing security-relevant data from measurements on Internet scale
Managing security-relevant data from measurements on Internet scale (Tales from the road) Ralph Holz 9 June 2015 About the speaker PhD from Technische Universität München, 2014 Dissertation on measurement
Introduction. Internet Address Depletion and CIDR. Introduction. Introduction
Introduction Internet Address Depletion and A subnet is a subset of class A, B, or C networks IP addresses are formed of a network and host portions network mask used to separate the information Introduction
Simple Multihoming. ISP/IXP Workshops
Simple Multihoming ISP/IXP Workshops 1 Why Multihome? Redundancy One connection to internet means the network is dependent on: Local router (configuration, software, hardware) WAN media (physical failure,
Locator/ID Separation Protocol: do we really need such a thing?
Locator/ID Separation Protocol: do we really need such a thing? GBR'11 - Beyond Networking Luigi Iannone Senior Research Scientist Deutsche Telekom Laboratories The Internet as we know it? Who remembers
Introduction to IP Numbers vs. Domain names. Adiel A. Akplogan CEO, AFRINIC. 2014
Introduction to IP Numbers vs. Domain names Adiel A. Akplogan CEO, AFRINIC. 2014 Identifying an IP address Internet identifiers including information about how to reach a network location (via the Internet
IPv6 RIPEness from 4 to 5 stars. Vesna Manojlovic Community Builder for Measurement Tools BECHA@ripe.net
IPv6 RIPEness from 4 to 5 stars Vesna Manojlovic Community Builder for Measurement Tools BECHA@ripe.net SEE4, Belgrade, 2015 IPv6RIPEness.ripe.net 2 Measure of IPv6 readiness for LIRs - allocation - reverse
AWS Direct Connect. User Guide API Version 2013-10-22
AWS Direct Connect User Guide AWS Direct Connect: User Guide AWS Direct Connect User Guide Table of Contents What is AWS Direct Connect?... 1 Requirements... 1 How Do I...?... 2 Getting Started... 3 Getting
Examination. IP routning på Internet och andra sammansatta nät, DD2491 IP routing in the Internet and other complex networks, DD2491
Examination IP routning på Internet och andra sammansatta nät, DD2491 IP routing in the Internet and other complex networks, DD2491 Date: December 15 2009 14:00 18:00 1. No help material is allowed - You
The benefits of BGP for every service provider
The benefits of BGP for every service provider UKUUG - Spring 2011 24th of March 2011 Thomas Mangin Exa Networks Whatever a speaker is missing in depth he will compensate for in length Montesquieu NO Networking
Fireware How To Dynamic Routing
Fireware How To Dynamic Routing How do I configure my Firebox to use BGP? Introduction A routing protocol is the language a router speaks with other routers to share information about the status of network
RTMA Working Group Agenda. Overview Speakers Discussion
RTMA Working Group Agenda Overview Speakers Discussion Speakers Speakers Bill Woodcock Packet Clearinghouse Philip Smith Cisco Systems Scott Marcus Genuity/ARIN Board Abha Ahuja Arbor Networks Vijay Gill
Information Technology Sector. Risk Management Strategy Internet Routing, Access and Connection Services
Information Technology Sector Strategy Internet Routing, Access and Connection Services July 2011 Contents Executive Summary...1 1 Internet Routing Strategy...3 1.1 Risk of Concern Partial or complete
Information Pack! October 2014!! Bijal Sanghani! bijal at euro-ix dot net! Twitter: @euroix!!
Information Pack! October 2014!! Bijal Sanghani! bijal at euro-ix dot net! Twitter: @euroix!! Introduction! Euro-IX is an association of Internet Exchanges Points, promoting an open interchange of ideas
Using Resource Certificates Progress Report on the Trial of Resource Certification
Using Resource Certificates Progress Report on the Trial of Resource Certification October 2006 Geoff Huston Chief Scientist APNIC From the PPML Mailing List 2006-3 ("Capturing Originations in Templates")
Routing in Small Networks. Internet Routing Overview. Agenda. Routing in Large Networks
Routing in Small Networks Internet Routing Overview AS, IGP,, BGP in small networks distance vector or link state protocols like RIP or OSPF can be used for dynamic routing it is possible that every router
IPv4-IPv6 transition
IPv4-IPv6 transition Just to cut the Gordian Knot? turchanyi.geza@gmail.com mohacsi@niif.hu 1 Oct. 2008, page 1 Table of contents! IPv4, IPv6 two languages! A borrowed slide fix-mobile convergence! About
DDoS Protection. How Cisco IT Protects Against Distributed Denial of Service Attacks. A Cisco on Cisco Case Study: Inside Cisco IT
DDoS Protection How Cisco IT Protects Against Distributed Denial of Service Attacks A Cisco on Cisco Case Study: Inside Cisco IT 1 Overview Challenge: Prevent low-bandwidth DDoS attacks coming from a broad
Securing DNS Infrastructure Using DNSSEC
Securing DNS Infrastructure Using DNSSEC Ram Mohan Executive Vice President, Afilias rmohan@afilias.info February 28, 2009 Agenda Getting Started Finding out what DNS does for you What Can Go Wrong A Survival
Network provider filter lab
Network provider filter lab Olof Hagsand Pehr Söderman KTH CSC Group Nr Name 1 Name 2 Name 3 Name 4 Date Instructor s Signature Table of Contents 1 Goals...3 2 Introduction...3 3 Preparations...3 4 Lab
IPV6 FRAGMENTATION. The Case For Deprecation. Ron Bonica NANOG58
IPV6 FRAGMENTATION The Case For Deprecation Ron Bonica NANOG58 BACKGROUND 2 Copyright 2013 Juniper Networks, Inc. www.juniper.net STATUS QUO In order to send a packet larger than the PMTU, an IPv6 node
Euro6IX project and Italian IPv6 Task Force
Pisa, 11/05/05 Background information Telecom Italia Lab is the research department of Telecom Italia Group Working on IPv6 since 1995 and actively contributing to its development and standardization (FC
NetFlow & BGP multi-path: quo vadis?
NetFlow & BGP multi-path: quo vadis? Paolo Lucente Elisa Jasinska Netnod, Stockholm Agenda About Netflix About pmacct Brief digression on BGP ADD-PATHS Putting all
Netflow Overview. PacNOG 6 Nadi, Fiji
Netflow Overview PacNOG 6 Nadi, Fiji Agenda Netflow What it is and how it works Uses and Applications Vendor Configurations/ Implementation Cisco and Juniper Flow-tools Architectural issues Software, tools
What's inside the cloud?!
What's inside the cloud?! Initial Arpanet Initial Arpanet Interface Message Processors - DDP-516 mini-computers - 24 Kbyte of Core memory - Store-and-forward packet switching - Predecessors of present
APNIC elearning: Requesting IP Address
APNIC elearning: Requesting IP Address 19 AUG 2015 01:00 PM AEST Brisbane (UTC+10) Issue Date: 07 July 2015 Revision: 2.0 Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties:
IPv6 Address Planning
eip604_v1.0 APNIC elearning: IPv6 Address Planning Contact: training@apnic.net Overview Where to Get IPv6 Addresses Addressing Plans ISP Infrastructure Addressing Plans Customer Example Address Plan Addressing
Claudio Jeker. RIPE 41 Meeting Amsterdam, 15. January 2002. oppermann@pipeline.ch. jeker@n-r-g.com. Using BGP topology information for DNS RR sorting
BGPDNS Using BGP topology information for DNS RR sorting a scalable way of multi-homing André Oppermann oppermann@pipeline.ch Claudio Jeker jeker@n-r-g.com RIPE 41 Meeting Amsterdam, 15. January 2002 What
IPv6 First Hop Security Protecting Your IPv6 Access Network
IPv6 First Hop Security Protecting Your IPv6 Access Network What You Will Learn This paper provides a brief introduction to common security threats on IPv6 campus access networks and will explain the value
Global IP Network Mobility
Brian L. Skeen brian.l.skeen@boeing.com Global IP Network Mobility using Border Gateway Protocol (BGP) BGP Network Mobility Connexion Service Summary Current IP Mobility standards Network and Service Challenges
Firewall-on-Demand. GRNET s approach to advanced network security services management via bgp flow-spec and NETCONF. Leonidas Poulopoulos
Firewall-on-Demand GRNET s approach to advanced network security services management via bgp flow-spec and NETCONF Leonidas Poulopoulos 1 leopoul@nocgrnetgr 1 NOC/Greek Research and Technology Network
IXP Member connection Best Practice. Kittinan Sriprasert BKNIX kittinan@bknix.co.th
IXP Member connection Best Practice Kittinan Sriprasert BKNIX kittinan@bknix.co.th Agenda Prerequisites How to Connect to BKNIX Topology Overview Logical Connection Physical Connection Best Connection
Verifying Growth of IPv6 DNS Entries
Verifying Growth of IPv6 DNS Entries Jonathan Carroll, Radhouan Allani, Sriram Akella, Vineet Gupta jonathan.carroll@colorado.edu, radhouan.allani@colorado.edu, sriram.akella@colorado.edu, vineet.gupta@colorado.edu
The ISP Column A monthly column on things Internet. Leaking Routes. March 2012 Geoff Huston. Its happened again.
The ISP Column A monthly column on things Internet March 2012 Geoff Huston Leaking Routes Its happened again. We've just had yet another major routing leak, this time bringing down the Internet for most
Understanding Route Aggregation in BGP
Understanding Route Aggregation in BGP Document ID: 5441 Contents Introduction Prerequisites Requirements Components Used Conventions Network Diagram Aggregate Without the as set Argument Aggregate with
Update from the RIPE NCC
RIPE Network Coordination Centre Update from the RIPE NCC RIPE 59, 5-9 October, Lisbon http://www.ripe.net 1 Member Services - New LIR Setup - Billing Customer Services - Administrative and LIR Portal
BGP overview BGP operations BGP messages BGP decision algorithm BGP states
BGP overview BGP operations BGP messages BGP decision algorithm BGP states 1 BGP overview Currently in version 4. InterAS (or Interdomain) routing protocol for exchanging network reachability information
Autonomous Security for Autonomous Systems
Autonomous Security for Autonomous Systems Josh Karlin, Stephanie Forrest, and Jennifer Rexford Abstract The Internet s interdomain routing protocol, BGP, supports a complex network of Autonomous Systems