0

I've a basic question regarding BGP. How does a public AS's verifying networks that are being advertised to INTERNET? For example I have /25 assigned from RIR and how is this prefix verified by other routers that it really belongs to me ? And what stopping me from advertising subnets that don't be long to me ? Thanks

1 Answer 1

1

Ideally your ISP generates a filter based on the RIR information such that only your specific /25 is permitted via your BGP peering to them. The various registries (ARIN, RIPE, APNIC, etc) have mechanisms by which routes can be certified as belonging to particular entities. That said, BGP (as widely deployed) has no means to confirming that a given prefix legitimately belongs to a particular ASN or, indeed, whether the prefix was actually originated by the right network.

There are (...and have been over the years) efforts to secure BGP by allowing for the cryptographic signature of prefixes as they're originated and propagated (see BGPsec as an example). Keep in mind that whatever approach is adopted has to make it through the standards bodies, be adopted by various vendors, some kind of set of central authorities has to be able to manage it, the carriers themselves have to adapt it to their operational processes, etc. Overlay all of this against a wildly decentralized network that encompasses most the planet and it gets even more difficult.

In the mean time proper filtering at the edge is very much in the realm of widely accepted best-practice for carriers and when bogus advertisements do occur the complaints and filtering follow pretty quickly.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .