Life After IPv4 Depletion
|
|
|
- Myrtle Greene
- 5 years ago
- Views:
Transcription
1 1 Life After IPv4 Depletion Jon Worley Analyst Securing Core Internet Functions Resource Certification, RPKI Mark Kosters Chief Technology Officer
2 2 Core Internet Functions: Routing & DNS The Internet relies on two critical resources DNS: Translates domain names to IP addresses and IP addresses to domain names Routing: Tells us how to get to an IP address These critical resources are not secure DNSSEC and RPKI secure these critical resources
3 Routing A Primer
4 4 Routing Architecture The Internet uses a two level routing hierarchy: Interior Gateway (Routing) Protocol - IGP Exterior Gateway (Routing) Protocol - EGP
5 5 Routing Architecture IGP: Interior Routing Protocols, used by each network to determine how to reach all destinations that lie within the network Interior Routing protocols maintain the current topology of the network 5
6 6 Routing Architecture EGP: Exterior Routing Protocol, used to link each component network together into a single whole Exterior protocols assume that each network is fully interconnected internally 6
7 7 Exterior Routing: BGP BGP is a large set of bilateral (1:1) routing sessions A tells B all the destinations (prefixes) that A is capable of reaching B tells A all the destinations that B is capable of reaching / / /18 A B /24 7
8 Securing Routing With RPKI
9 9 What is RPKI? Resource Public Key Infrastructure Cryptographically certifies network resources AS Numbers IP Addresses Also certifies route announcements Route Origin Authorizations (ROAs) allow you to authorize your block to be routed 9
10 10 Why is RPKI Important? Allows routers (or other processes) to validate routes Provides stronger validation than existing technologies, such as: IRR registries LOAs or just Seems legit 10
11 11 Case Study: YouTube Pakistan Telecom was ordered to block YouTube Naturally, they originated their own route for YouTube s IP address block YouTube s traffic was temporarily diverted to Pakistan This incident could have been prevented with widespread adoption of RPKI
12 12 Case Study: Turk Telekom Turkish President ordered censorship of Twitter Turk Telekom s DNS servers were configured to return false IP addresses So people started using Google s DNS ( ) Turk Telekom hijacked Google s IP addresses in BGP Could have been prevented with RPKI
13 13 RPKI Basics All of ARIN s RPKI data is publicly available in a repository RFC 3779 certificates show who has each resource ROAs show which AS numbers are authorized to announce blocks CRLs show revoked records Manifests list all data from each organization 13
14 14 Hierarchy of Resource Certificates ICANN /0 0::/0 ARIN / /8 LACNIC AFRINIC RIPE NCC APNIC Regional ISP /16 Other Small ISP /24 Some Small ISP /20 14
15 15 Route Origin Authorizations ICANN /0 0::/0 ARIN / /8 LACNIC AFRINIC RIPE NCC APNIC Regional ISP /16 Other Small ISP / /16 AS /24 AS2000 Some Small ISP / /20 AS
16 16 Current Practices ICANN /0 0::/0 ARIN / /8 LACNIC AFRINIC RIPE NCC APNIC Regional ISP /16 Some Small ISP /20 Other Small ISP / /16 AS / /20 AS2000 AS
17 17 Using ARIN s RPKI Repository (Theory) 1. Pull down these files using a manifest-validating mechanism 2. Validate the ROAs contained in the repository 3. Communicate with the router to mark routes: Valid Invalid unknown Ultimately, the ISP uses local policy on how to route to use this information. 17
18 18 Using ARIN s RPKI Repository (Practice) 1. Get the RIPE NCC RPKI Validator 18
19 19 Using ARIN s RPKI Repository (Practice, continued) 2. Get the ARIN TAL ml 3. Plug it in to your routing policy engine: Directly to the router via RTR protocol Using custom scripts and the REST API As RPSL route objects 19
20 20 Putting Your Routes in the RPKI 1. Determine if you want to allow ARIN to host your Certificate Authority (CA), or if you want ARIN to delegate to your Certificate Authority. 2. Sign up with ARIN Online. 3. Create Resource Certificates and ROAs.
21 21 Hosted vs. Delegated RPKI Hosted ARIN has done all of the heavy lifting for you Think point click ship Available via web site or RESTful interface Delegated using Up/Down Protocol A whole lot more work Might make sense for very large networks 21
22 22 Hosted RPKI - ARIN Online Pros Easy-to-use web interface ARIN-managed (buying/deploying HSMs, etc. is expensive and time consuming) Cons Downstream customers can t use RPKI Large networks would probably need to use the RESTful interface to avoid tedious management We hold your private key 22
23 23 Delegated RPKI with Up/Down Pros Allows you to keep your private key Follows the IETF up/down protocol Allows downstream customers to use RPKI Cons Extremely hard to set up Requires operating your own RPKI environment High cost of time and effort 23
24 24 Delegated with Up/Down You have to do all the ROA creation Need to set up a Certificate Authority Have a highly available repository Create a CPS 24
25 25 RPKI Usage Certified Orgs Oct 2012 Apr 2013 Oct 2013 Apr 2014 Oct 2014 Apr 2015 Oct 2015 Apr 2016 Oct 2016 Apr ROAs Covered Resources Up/Down Delegated
26 RPKI vs The Routing Table: Globally 26
27 RPKI vs The Routing Table: RIPE 27
28 RPKI vs The Routing Table: APNIC 28
29 RPKI vs The Routing Table: AFRINIC 29
30 RPKI vs The Routing Table: LACNIC 30
31 RPKI vs The Routing Table: ARIN 31
32 32 Takeaways If you re not using RPKI, you re vulnerable to route hijacking Plenty of readily available documentation regarding implementation details If we can help, contact us
33 Q&A
Securing Core Internet Functions Resource Certification, RPKI. Mark Kosters ARIN CTO
Securing Core Internet Functions Resource Certification, RPKI Mark Kosters ARIN CTO Core Internet Functions: Routing & DNS The Internet relies on two critical resources DNS: Translates domain names to
Securing Internet Infrastructure: Route Origin Security using RPKI at ARIN. Mark Kosters CTO
Securing Internet Infrastructure: Route Origin Security using RPKI at ARIN Mark Kosters CTO What is RPKI? Resource Public Key Infrastructure Attaches digital certificates to network resources AS Numbers
Securing Routing: RPKI Overview. Mark Kosters Chief Technology Officer
Securing Routing: RPKI Overview Mark Kosters Chief Technology Officer Why are DNSSEC and RPKI important? Two of the most critical resources DNS Routing Hard to tell when resource is compromised Focus of
Security Overlays on Core Internet Protocols DNSSEC and RPKI. Mark Kosters ARIN CTO
Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN CTO Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard to tell if compromised From the user point of
Madison, Wisconsin 9 September14
1 Madison, Wisconsin 9 September14 2 Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN Engineering 3 Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard
Security Overlays on Core Internet Protocols DNSSEC and RPKI. Mark Kosters ARIN CTO
Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN CTO Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard to tell if compromised From the user point of
Secure Routing with RPKI. APNIC44 Security Workshop
Secure Routing with RPKI APNIC44 Security Workshop Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
Misdirection / Hijacking Incidents
Security Tutorial @ TWNOG SECURE ROUTING WITH RPKI 1 Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
Resource Public Key Infrastructure
Resource Public Key Infrastructure A pilot for the Internet2 Community to secure the global route table Andrew Gallo The Basics The Internet is a self organizing network of networks. How do you find your
ISP 1 AS 1 Prefix P peer ISP 2 AS 2 Route leak (P) propagates Prefix P update Route update P Route leak (P) to upstream 2 AS 3 Customer BGP Update messages Route update A ISP A Prefix A ISP B B leaks
Problem. BGP is a rumour mill.
Problem BGP is a rumour mill. We want to give it a bit more authorita We think we have a model AusNOG-03 2009 IP ADDRESS AND ASN CERTIFICATION TO IMPROVE ROUTING SECURITY George Michaelson APNIC R&D ggm@apnic.net
Update on Resource Certification. Geoff Huston, APNIC Mark Kosters, ARIN IEPG, March 2008
Update on Resource Certification Geoff Huston, APNIC Mark Kosters, ARIN IEPG, March 2008 Address and Routing Security What we have had for many years is a relatively insecure interdomain routing system
Resource PKI. NetSec Tutorial. NZNOG Queenstown. 24 Jan 2018
Resource PKI NetSec Tutorial NZNOG2018 - Queenstown 24 Jan 2018 1 Fat-finger/Hijacks/Leaks Bharti (AS9498) originates 103.0.0.0/10 Dec 2017 (~ 2 days) No damage more than 8K specific routes! Google brings
Resource Certification. Alex Band, Product Manager DENIC Technical Meeting
Resource Certification Alex Band, Product Manager DENIC Technical Meeting Internet Routing Routing is non-hierarchical, open and free Freedom comes at a price: - You can announce any address block on your
Introducción al RPKI (Resource Public Key Infrastructure)
Introducción al RPKI (Resource Public Key Infrastructure) Roque Gagliano rogaglia@cisco.com 4 Septiembre 2013 Quito, Equator 2011 Cisco and/or its affiliates. All rights reserved. 1 Review of problem to
Deploying RPKI An Intro to the RPKI Infrastructure
Deploying RPKI An Intro to the RPKI Infrastructure VNIX-NOG 24 November 2016 Hanoi, Vietnam Issue Date: Revision: Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours)
ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
Resource Public Key Infrastructure (RPKI) Nurul Islam Roman, APNIC
Resource Public Key Infrastructure (RPKI) Nurul Islam Roman, APNIC Target Audience Knowledge of Internet Routing(specially BGP) Fair idea on Routing Policy No need to know Cryptography Basic knowledge
Robust Inter-Domain Routing
Establishing the Technical Basis for Trustworthy Networking Robust Inter-Domain Routing Addressing Systemic Vulnerabilities in BGP Doug Montgomery (dougm@nist.gov) Manager, Internet and Scalable Systems
RPKI Introduction. APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By:
RPKI Introduction APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By: 1 Content Why do we need RPKI What is RPKI How to deploy RPKI Configuration case Misdirection / Hijacking Incidents
Internet Resource Certification and Inter- Domain Routing Security! Eric Osterweil!
Internet Resource Certification and Inter- Domain Routing Security! Eric Osterweil! Who is allowed to do what?! BGP (the Internet s inter-domain routing protocol) runs by rumor Participants assert reachability
Overview of the Resource PKI (RPKI) Dr. Stephen Kent VP & Chief Scientist BBN Technologies
Overview of the Resource PKI (RPKI) Dr. Stephen Kent VP & Chief Scientist BBN Technologies Presentation Outline The BGP security problem RPKI overiew Address & AS number allocation system Certificates
Securing BGP - RPKI. ThaiNOG Bangkok. 21 May Tashi Phuntsho
Securing BGP - RPKI ThaiNOG2018 - Bangkok 21 May 2018 Tashi Phuntsho (tashi@apnic.net) 1 Fat-finger/Hijacks/Leaks Amazon (AS16509) Route53 hijack April2018 AS10279 (enet) announced/originated more specifics
Just give me a button!
Just give me a button! The challenges of routing security RIPE NCC Members organisation founded in 1992 Manages IP and ASN allocations in Europe, Middle East and former Soviet Union - Ensure unique holdership
BGP Origin Validation (RPKI)
University of Amsterdam System & Network Engineering BGP Origin Validation (RPKI) July 5, 2013 Authors: Remy de Boer Javy de Koning Supervisors: Jac Kloots
Securing BGP: The current state of RPKI. Geoff Huston Chief Scientist, APNIC
Securing BGP: The current state of RPKI Geoff Huston Chief Scientist, APNIC Incidents What happens when I announce your addresses in BGP? All the traffic that used to go to you will now come to me I can
APNIC s role in stability and security. Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013
APNIC s role in stability and security Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013 Overview Introducing APNIC Working with LEAs The APNIC Whois Database
RPKI Trust Anchor. Geoff Huston APNIC
RPKI Trust Anchor Geoff Huston APNIC Public Keys How can you trust a digital signature?? What if you have never met the signer and have no knowledge of them or their keys? One approach is transitive trust
RPKI. Resource Pubic Key Infrastructure
RPKI Resource Pubic Key Infrastructure Purpose of RPKI RPKI replaces IRR or lives side by side? Side by side: different advantages Security, almost real time, simple interface: RPKI Purpose of RPKI Is
RPKI deployment at AFRINIC Status Update. Alain P. AINA RPKI Project Manager
RPKI deployment at AFRINIC Status Update Alain P. AINA RPKI Project Manager What is Resource Certifcation? Resource Certifcation is a security framework for verifying the association between resource holders
Decentralized Internet Resource Trust Infrastructure
Decentralized Internet Resource Trust Infrastructure Bingyang Liu, Fei Yang, Marcelo Bagnulo, Zhiwei Yan, and Qiong Sun Huawei UC3M CNNIC China Telecom 1 Critical Internet Trust Infrastructures are Centralized
BGP Configuration Automation on Edge Routers
BGP Configuration Automation on Edge Routers System and Network Engineering Msc. Research Project Stella Vouteva & Tarcan Turgut Supervisor: Stavros Konstantaras, NLNetLabs Introduction Big Internet Depletion
IPv4 Run-Out, Trading, and the RPKI
IPv4 Run-Out, Trading, and the RPKI RIPE 56 / Berlin 2008.05.07 Randy Bush http://rip.psg.com/~randy/080507.ripe-v4-trad-rpki.pdf 2008.05.07 RIPE v4 Trade RPKI 2 Internet Initiative Japan
An ARIN Update. Susan Hamlin Director of Communications and Member Services
An ARIN Update Susan Hamlin Director of Communications and Member Services ARIN, a nonprofit member-based organization, supports the operation of the Internet through the management of Internet number
IPv4 Run-Out, Trading, and the RPKI
IPv4 Run-Out, Trading, and the RPKI MENOG 3 / Salmiya 2008.04.15 Randy Bush http://rip.psg.com/~randy/080415.menog-v4-trad-rpki.pdf 2008.04.15 MENOG v4 Trade RPKI 2 Internet Initiative
Resource Certification
Resource Certification CISSP, science group manager RIPE NCC robert@ripe.net 1 Contents Motivation for Resource Certification (RPKI) Architecture overview Participating in RPKI Most importantly: use cases
3/10/2011. Copyright Link Technologies, Inc.
Mikrotik Certified Trainer / Engineer MikroTik Certified Dude Consultant Consulting Since 1997 Enterprise Class Networks WAN Connectivity Certifications Cisco, Microsoft, MikroTik BGP/OSPF Experience Deployed
ARIN Update. Mark Kosters CTO
ARIN Update Mark Kosters CTO Agenda What does ARIN do? A short ARIN status report How you can get IP space from us? 2 3 ARIN, a nonprofit member-based organization, supports the operation of the Internet
Life After IPv4 Depletion. Leslie Nobile
Life After IPv4 Depletion Leslie Nobile Recent Observations Still strong demand for IPv4 Seeing increased activity in IPv4 transfers/transfer market, pre-approvals, and Specified Transfer Listing Service
BRINGING YOU ANSWERS DENVER, CO 13 JUNE 2017
BRINGING YOU ANSWERS DENVER, CO 13 JUNE 2017 Here Today From ARIN Dan Alexander Chair, ARIN Advisory Council Susan Hamlin Director, Communications & Member Services Richard Jimmerson Chief Information
Engineering Report. Mark Kosters
Engineering Report Mark Kosters Staffing Operations 7 operations engineers + 2 managers (AT FULL STRENGTH) Development 8 programmers + manager (AT FULL STRENGTH) New PM taken from engineering New hire
PKI-An Operational Perspective. NANOG 38 ARIN XVIII October 10, 2006
PKI-An Operational Perspective NANOG 38 ARIN XVIII October 10, 2006 Briefing Contents PKI Usage Benefits Constituency Acceptance Specific Discussion of Requirements Certificate Policy Certificate Policy
Securing the Internet at the Exchange Point Fernando M. V. Ramos
Securing the Internet at the Exchange Point Fernando M. V. Ramos 18.09.2017 Securing the Internet at the Exchange Point Fernando M. V. Ramos 18.09.2017 There are vulnerabilities in the Internet architecture
A PKI For IDR Public Key Infrastructure and Number Resource Certification
A PKI For IDR Public Key Infrastructure and Number Resource Certification AUSCERT 2006 Geoff Huston Research Scientist APNIC If You wanted to be Bad on the Internet And you wanted to: Hijack a site Inspect
APNIC Trial of Certification of IP Addresses and ASes
APNIC Trial of Certification of IP Addresses and ASes ARIN XVII Open Policy Meeting George Michaelson Geoff Huston Motivation: Address and Routing Security What we have today is a relatively insecure system
Some Thoughts on Integrity in Routing
Some Thoughts on Integrity in Routing Geoff Huston Chief Scientist, APNIC What we want We want the routing system to advertise the correct reachability information for legitimately connected prefixes at
Networking 101 ISP/IXP Workshops
Networking 101 ISP/IXP Workshops 1 Network Topology and Definitions Definitions and icons Network topologies PoP topologies Interconnections and IXPs IP Addressing Gluing it all together 2 Topologies and
BGP Origin Validation
BGP Origin Validation ISP Workshops These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/) Last updated
<36 th APNIC Meeting, XIAN CHINA> KISA(KRNIC) UPDATE. YOUNGSUN LA Korea Internet & Security Agency
KISA(KRNIC) UPDATE YOUNGSUN LA (rays@kisa.or.kr) Korea Internet & Security Agency 1 Contents IPv6 Verified NSDs R&D WHOIS User Analysis & Statistics RPKI Testbed 2 IPv6
Here today from ARIN
Little Rock, Arkansas 7 March 2017 Here today from ARIN Dan Alexander Jan Blacka John Curran Susan Hamlin Aaron Hughes Ed MacDonald Andy Newton Jon Worley Chair, ARIN Advisory Council Senior User Experience
The RPKI & Origin Validation
The RPKI & Origin Validation RIPE / Praha 2010.05.03 Randy Bush Rob Austein Steve Bellovin And a cast of thousands! Well, dozens :) 2010.05.03 RIPE RPKI
9/6/2015. COMP 535 Lecture 6: Routing Security. Agenda. In the News. September 3, 2015 Andrew Chi
COMP 535 Lecture 6: Routing Security September 3, 2015 Andrew Chi Includes content used with permission by Angelos Keromytis (Columbia), Philip Smith (APNIC), and Steve Kent (BBN) Agenda
BGP Routing Security and Deployment Strategies
Bachelor Informatica Informatica Universiteit van Amsterdam BGP Routing Security and Deployment Strategies Bryan Eikema June 17, 2015 Supervisor(s): Benno Overeinder (NLnet Labs), Stavros Konstantaras
Interdomain routing CSCI 466: Networks Keith Vertanen Fall 2011
Interdomain routing CSCI 466: Networks Keith Vertanen Fall 2011 Overview Business relationships between ASes Interdomain routing using BGP Advertisements Routing policy Integration with intradomain routing
IETF81 Secure IDR Rollup TREX Workshop David Freedman, Claranet
IETF81 Secure IDR Rollup TREX Workshop 2011 David Freedman, Claranet Introduction to Secure IDR (SIDR) You are in a darkened room at the IETF. You are surrounded by vendors. A lone operator stands quietly
RPKI and Routing Security
Presentation September 2015 Yerevan Regional Meeting Routing Security 2 Routing Registry route objects RPKI (Resource Public Key Infrastructure) ROAs (Route Origin Authorisation) What is the Purpose of
ARIN Update. Summer 2011 ESCC/Internet2 Joint Techs Mark Kosters Chief Technology Officer
ARIN Update Summer 2011 ESCC/Internet2 Joint Techs Mark Kosters Chief Technology Officer Agenda A Brief Overview of ARIN IPv4 and IPv6 Stats Call to Action Technology Initiatives 2 of 23 About ARIN Regional
Inter-Domain Routing: BGP
Inter-Domain Routing: BGP Stefano Vissicchio UCL Computer Science CS 3035/GZ01 Agenda We study how to route over the Internet 1. Context The Internet, a network of networks Relationships between ASes 2.
APNIC RPKI Report. George Michaelson
APNIC RPKI Report George Michaelson APNIC RPKI Current Activities The RPKI TA Framework APNIC s TA Changes Provisioning Protocol Services The RPKI TA Framework The RPKI TA Framework Managing TAs is an
IPv4 Address Report. This report generated at 12-Mar :24 UTC. IANA Unallocated Address Pool Exhaustion: 03-Feb-2011
IPv4 Address Report This report generated at 12-Mar-2018 08:24 UTC. IANA Unallocated Address Pool Exhaustion: 03-Feb-2011 Projected RIR Address Pool Exhaustion Dates: RIR Projected Exhaustion Remaining
Introduction to The Internet
Introduction to The Internet ITU/APNIC/MICT IPv6 Security Workshop 23 rd 27 th May 2016 Bangkok Last updated 5 th May 2015 1 Introduction to the Internet p Topologies and Definitions p IP Addressing p
Measuring IPv6 Deployment
Measuring IPv6 Deployment The story so far IANA Pool Exhaustion In this model, IANA allocates its last IPv4 /8 to an RIR on the 18 th January 2011 Ten years ago we had a plan Oops! We were meant to have
RPKI in practice. Sebastian Wiesinger DE-CIX Technical Meeting June 2017
RPKI in practice Sebastian Wiesinger sebastian.wiesinger@noris.net DE-CIX Technical Meeting June 2017 Generate ROAs Generate ROAs for your prefixes RIPE NCC makes this very easy Available at the LIR portal
RPKI and Internet Routing Security ~ The regional ISP operator view ~
RPKI and Internet Routing Security ~ The regional ISP operator view ~ APNIC 29/APRICOT 2010 NEC BIGLOBE, Ltd. (AS2518) Seiichi Kawamura 1 Agenda Routing practices of the regional ISP today How this may
BRINGING YOU ANSWERS SASKATOON, SK 14 SEPTEMBER 2017
BRINGING YOU ANSWERS SASKATOON, SK 14 SEPTEMBER 2017 Here Today From ARIN Eddie Diego, Senior Resource Analyst Susan Hamlin, Director Communications and Member Services Alyssa Moore, ARIN Advisory Council
Some Lessons Learned from Designing the Resource PKI
Some Lessons Learned from Designing the Resource PKI Geoff Huston Chief Scientist, APNIC May 2007 Address and Routing Security The basic security questions that need to be answered are: Is this a valid
Facilitating Secure Internet Infrastructure
Facilitating Secure Internet Infrastructure RIPE NCC http://www.ripe.net About the RIPE NCC RIPE Network Coordination Centre Bottom-up, self-regulated, membership association, notfor-profit Regional Internet
Requirements for Resource Public Key Infrastructure (RPKI) Relying Parties (draft-madi-sidrops-rp-00) Di Ma & Stephen Kent.
Requirements for Resource Public Key Infrastructure (RPKI) Relying Parties (draft-madi-sidrops-rp-00) Di Ma & Stephen Kent IETF 99, Prague 1 Background (1/2) Requirements imposed on Relying Parties (RPs)
Secure Inter-domain Routing with RPKI
Secure Inter-domain Routing with RPKI Srinivas (Sunny) Chendi VNIX-NOG 2018, Da Nang sunny@apnic.net Xin chào và chào buổi sáng 1 3 4 What is the fundamental Problem? An underlying problem in routing
Attacks on routing: IP hijacks
Attacks on routing: IP hijacks How Internet number resources are managed IANA ARIN LACNIC APNIC RIPE NCC AfriNIC ISP NIC.br NIC.MX ISP #1 LIRs/ISPs LIRs/ISPs End users ISP mx How Internet number resources
IPv6 Deployment: Business Case and Development Opportunities. University College of the Caribbean Internet Day. 12 July 2012 Tim Christensen, ARIN
IPv6 Deployment: Business Case and Development Opportunities University College of the Caribbean Internet Day 12 July 2012 Tim Christensen, ARIN Internet Governance Definition of Internet governance*:
IPv4 depletion & IPv6 deployment in the RIPE NCC service region. Kjell Leknes - June 2010
IPv4 depletion & IPv6 deployment in the RIPE NCC service region Kjell Leknes - June 2010 Outline About RIPE and RIPE NCC IPv4 depletion IPv6 deployment Engaging the community - RIPE NCC and the RIPE community
Security in inter-domain routing
DD2491 p2 2011 Security in inter-domain routing Olof Hagsand KTH CSC 1 Literature Practical BGP pages Chapter 9 See reading instructions Beware of BGP Attacks (Nordström, Dovrolis) Examples of attacks
CIDR. The Life Belt of the Internet 2005/03/11. (C) Herbert Haas
CIDR The Life Belt of the Internet (C) Herbert Haas 2005/03/11 Early IP Addressings Before 1981 only class A addresses were used Original Internet addresses comprised 32 bits (8 bit net-id = 256 networks)
IPv4 Transfer Sta/s/cs Analy'c View Alain Durand, May 25 th 2016
IPv4 Transfer Sta/s/cs Analy'c View Alain Durand, May 25 th 2016 Questions For This Study A. IPv4 Transfer Market Health 1) What is the concentra'on of address holders? 2) Is the transfer market dominated
Internet Routing Protocols, DHCP, and NAT
Internet Routing Protocols, DHCP, and NAT Hwajung Lee Modified from Slides Courtesy of Cisco Networking Academy and the book titled Communication Networks by Leon-Garcia Contents Basic Routing Single Area
Internet Kill Switches Demystified
Internet Kill Switches Demystified Benjamin Rothenberger, Daniele E. Asoni, David Barrera, Adrian Perrig EuroSec 17, Belgrade B.Rothenberger 23.04.2017 1 B.Rothenberger 23.04.2017 2 Internet Kill Switches
Database Update. Paul Palse Database Manager, RIPE NCC
Database Update Paul Palse Database Manager, RIPE NCC Outline Introduction to the Database Group Status of APs and outstanding deliverables Projects completed between RIPE 60 and 61 RIPE Labs publication
IPv6 HD Ratio. ARIN Public Policy Meeting April Geoff Huston APNIC
IPv6 HD Ratio ARIN Public Policy Meeting April 2005 Geoff Huston APNIC 1 Background Current IPv6 Address Allocation policies refer to the use of the Host Density Ratio as a metric for acceptable utilization
TTM AS-level Traceroutes
TTM AS-level Traceroutes Matching IPs to ASes René Wilhelm New Projects Group RIPE NCC 1 Motivation TTM performs frequent traceroutes to find closest IP route for delay measurements
Introduction to The Internet
Introduction to The Internet ITU/APNIC/MOIC IPv6 Workshop 19 th 21 st June 2017 Thimphu These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
Route Security for Inter-domain Routing
Route Security for Inter-domain Routing Alvaro Retana (aretana@cisco.com) Distinguished Engineer, Cisco Services 3 This could happen to YOUR network 4 This could happen be happening to YOUR network 5 Agenda
Multi-stakeholder Network Infrastructure Security Concerns. Tony Tauber October 27, 2017
Multi-stakeholder Network Infrastructure Security Concerns Tony Tauber October 27, 2017 About me... Started in network operations in 1994 In engineering and architecture roles for 20 years Always pretty
IPv6 HD Ratio. ARIN Public Policy Meeting April Geoff Huston APNIC
IPv6 HD Ratio ARIN Public Policy Meeting April 2005 Geoff Huston APNIC 1 Background Current IPv6 Address Allocation policies refer to the use of the Host Density Ratio as a metric for acceptable utilization
APNIC & Internet Address Policy in the Asia Pacific
APNIC & Internet Address Policy in the Asia Pacific NZ Internet Industry Forum Auckland, 29 November 2001 Anne Lord, APNIC Overview Introduction to APNIC Policy Development Address Management APNIC Update
HD Ratio for IPv4. RIPE 48 May 2004 Amsterdam
HD Ratio for IPv4 RIPE 48 May 2004 Amsterdam 1 Current status APNIC Informational presentation at APNIC 16 Well supported, pending presentation at other RIRs ARIN Similar proposal made at ARIN XIII Not
How does Internet (Big-I) routing work? The Internet is broken up into Autonomous Systems (AS) An AS is an administrative boundary. Each ISP has 1 or
Internet Routing Robustness Improving ftp://engr.ans.net/pub/slides/ndss/feb-1999/ Curtis Villamizar How does Internet routing work? How noticeable are routing related outages? Why have
Golden Prefixes IRR Lockdown Job Snijders
Golden Prefixes IRR Lockdown Job Snijders Agenda What s the problem? IRR not ideal A possible solution: Golden prefixes Making the best of IRR: IRR Lockdown Actual Frustrations The Youtube
Measuring RPKI Route Origin Validation in the Wild
Master Thesis Measuring RPKI Route Origin Validation in the Wild Andreas Reuter Matr. 4569130 Supervisor: Prof. Dr. Matthias Wählisch Institute of Computer Science, Freie Universität Berlin, Germany January
Shifting Sands. PLNOG March Andrzej Wolski Training Department
Shifting Sands PLNOG March 2014 Andrzej Wolski Training Department RIPE NCC 2 Began operating in 1992 Not-for-profit membership organisation 10,000 members (Local Internet Registries) Neutral, Impartial,
Problem Statement and Considerations for ROA Mergence. 96 SIDR meeting
Problem Statement and Considerations for ROA Mergence draft-yan-sidr-roa-mergence-00 @IETF 96 SIDR meeting fuyu@cnnic.cn Background RFC 6482 1/19 ROA mergence What is the ROA mergence? is a common case
APNIC allocation and policy update. JPNIC OPM July 17, Tokyo, Japan Guangliang Pan
APNIC allocation and policy update JPNIC OPM July 17, 2007 - Tokyo, Japan Guangliang Pan 1 Overview Internet registry structure Number resource allocation statistics APNIC recent policy implementations
Routing Security DDoS and Route Hijacks. Merike Kaeo CEO, Double Shot Security
Routing Security DDoS and Route Hijacks Merike Kaeo CEO, Double Shot Security merike@doubleshotsecurity.com DISCUSSION POINTS Understanding The Growing Complexity DDoS Attack Trends Packet Filters and
Routing Concepts. IPv4 Routing Forwarding Some definitions Policy options Routing Protocols
Routing Basics 1 Routing Concepts IPv4 Routing Forwarding Some definitions Policy options Routing Protocols 2 IPv4 Internet uses IPv4 Addresses are 32 bits long Range from 1.0.0.0 to 223.255.255.255 0.0.0.0
BRINGING YOU ANSWERS COLUMBUS, OH 2 NOVEMBER 2017
BRINGING YOU ANSWERS COLUMBUS, OH 2 NOVEMBER 2017 Here Today From ARIN Dan Alexander, Chair, ARIN Advisory Council Eddie Diego, Senior Resource Analyst Susan Hamlin, Director Communications and Member
Routing Security Workshop Internet Routing Registries
Routing Security Workshop Internet Routing Registries Jeff Bartig Senior Interconnection Architect, Internet2 IRR Presentation Overview NANOG 74 Updates IRR Overview IRR Tools Internet2 Participant IRR
Lessons learned running an RPKI service
Lessons learned running an RPKI service Alex Band Product Manager @alexander_band NANOG 63, San Antonio, Texas RPKI: Ultra Quick Intro 2 RIR becomes a Certificate Authority - Puts IPs and ASNs on a digital
The ISP Column A column on various things Internet. Securing the Routing System at NANOG 74. A Legal Perspective. October 2018 Geoff Huston
The ISP Column A column on various things Internet October 2018 Geoff Huston Securing the Routing System at NANOG 74 The level of interest in the general topic of routing security seems to come in waves
Internet Corporation for Assigned Names & Numbers - Internet Assigned Numbers Authority Update
Internet Corporation for Assigned Names & Numbers - Internet Assigned Numbers Authority Update PacNOG 3, Rarotonga Save Vocea Regional Liaison - Australasia/Pacific 17 June 2007 ICANN Mission To coordinate,
APNIC Trial of Certification of IP Addresses and ASes
APNIC Trial of Certification of IP Addresses and ASes RIPE 52 Plenary George Michaelson Geoff Huston Motivation: Address and Routing Security What we have today is a relatively insecure system that is