Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security The Internet

Router Holes in BGP Threaten Net 177

Posted by timothy from the don't-all-nets-have-holes dept.
Vishal Mishra writes "The widely used Border Gateway Protocol (BGP) for efficiently routing data through the Internet, is rife with security holes and needs to be replaced. Some 12,000 routers that act as the gateway to approximately 130,000 networks are currently using BGP. A router running BGP can communicate with its neighbors, essentially telling them to which networks the router can efficiently send data. Check out this ZDnet article that says 'A compromised router can cause chaos by advertising itself as the best path to any significant network. That's because routers using BGP implicitly trust their neighbors on the Internet--they don't ask for any sort of digital identification.'"
This discussion has been archived. No new comments can be posted.

Router Holes in BGP Threaten Net More

Router Holes in BGP Threaten Net

Comments Filter:

  • Identification is of no use (Score:5, Informative)

    by andi75 ( 84413 ) on Monday March 03, 2003 @06:51AM (#5422997) Homepage
    Once a router is compromised, identification is of no use. Identification only prohibits 'spoofing', e.g. sending a router invalid data from a third host, masquerading as a neighboring router, which is pretty difficult to pull off.

    - Andreas

    • Could, for example, some little bastard at home throw off his cable provider's network by routing all traffic to his neighbor's house, by re-signaling some router that doesn't know better, using his neighbor's MAC address?

      Unless Im talking out my ass here (quite possible, IANANetworkExpert) this sounds like it has the potential to be a DOS-like attack without the hassle of finding machines to carry it out. Just re-route and watch the overload, like an ICMP storm against a 14.4...

      • Re:Identification is of no use (Score:5, Informative)

        by sych ( 526355 ) on Monday March 03, 2003 @07:18AM (#5423056)
        No, sorry - you're talking out of your ass.

        BGP is a connection-oriented protocol that runs over TCP. A BGP session is set up between two routers when the router's administrators tell those routers eacho other's IP addresses. Things like Access Lists and Filters control what is transmitted and received - it's not open slather (unless it's very poorly configured.)

        BGP generally runs on major network routers only - often called Border routers - and these are the routers that interface one large network with another.

        This is why BGP is called an Exterior Routing Protocol, as opposed to an Interior Routing Protocol - it's used for one large network (generally an ISP or something of that size) to talk to another. Within that large network an Interior Routing Protocol like EIGRP, OSPF or RIP is used.

        The chances of "some little bastard at home" being able to get anywhere near a router running BGP is slim at best.
        • comst companies keep their border routers behind some kinda forewall....I know sungard has junipers behind checkpoints...

        • Re:Identification is of no use (Score:4, Interesting)

          by Alan Cox ( 27532 ) on Monday March 03, 2003 @10:00AM (#5423568) Homepage
          People break into routers. Also you don't have to break into a BGP router if you can spoof interior routes and get it to believe them. You can also intercept BGP sessions, although some systems do at least basic MD5 challenges.

          Thats not to say the original article isn't overhyping it. You can bring the internet down that way, but its an awfully hard way to do it, only affects some chunks are is much easier to fix than many other attacks.

          With computing security as poor as it is why would a terrorist go to so much unneccessary trouble

          • It's certainly not as bad as they are making out. It's only been a few months since one of worldcom's border routers went bad and took out several other isp's with it. My uplink isp went so dead it wouldn't even route to itself in the next city and remained that way for most of the afternoon.

            Other than watching my boss turn new shades of red and screaming nothing much happend and life went on.

          • Considering some of the BGP storms that bad IOS versions and clueless newbies at major ISP's have caused I would say that purposfully attacking a couple of key hosts could make for a hell of a bad day or two on the internet. The major problem is that unless something better is used the attacker could reimpliment their attack and the degredation would happen again, this is not a problem with the above BGP flaws.

    • Re:Identification is of no use (Score:1, Interesting)

      by Anonymous Coward
      It is, depending how its done. Look at S-BGP (which I'm guessing is the reference to the digital signatures). A router can't advertise a prefix without having authorisation.

      • And how is this any different from current filtering practices? (as-path and distribute-list filters which even the dumbest ISPs have been doing for years.) All the signing and "authorisation" does is increase processing loads and memory utilization, and require some group of central authorities to be the root of the trust tree. For this sort of thing to work, every prefix would have to be signed with a unique key.

        This isn't something that can be fixed on napkins over dinner. And it's technically not something that needs new (read: overly complex) technology to fix. If the '97 incident was as serious as the article indicates, why don't I remember it? I remember some idiots stealing 199.72.1.0/24 and pissing us off for a few days. BGP has long since ignored 0/0 (unless instructed otherwise), so "[advertising] best route to the entire internet" would be over 120,000 route entries at this very moment. (things to be considered... as-path length, prefix-length, metrics which nobody sends, and locally configured preferences.)

    • "which is pretty difficult to pull off."

      And since there aren't to many reports about this even though the technology is wide spread, I'd say that this looks to me as a news-duck!

    • This loads of bull

      All sane ISPs verify the routing updates versus access lists that are generated from routing registries like RIPE. Any routes that do not match what is declared publically and matches address space are discarded.

      If you take routing updates without verification you get whatever you dererve.

    • Even in the event of compromise, identity would be useful. It would allow other networks to explicitly ignore the offending router until it was fixed. Changing the ID wouldn't help the attacker since then it wouldn't have a trusted identity at all.

      It would seem that a simple strategy of phasing in signed messages would help. Once providers get routers that can check signatures, they can require new downstream routers to sign messages. In the interem, they could at least keep track of who said what amongst the routers that do support signatures.

    • Well, since routers are specifically configured to only accept certain routes from certain peers, Mr. Dugan is talking out his ass.

      Now, you could cause some problems by polluting IBGP routes, but that would only affect one ISP, and maybe any of their customers it has that use BGP to get only a default route (Fairly common for hulti T1 customers wanting failover).

      But between AS's, route advertisment acceptance is based off agreed upon access or prefix lists. And you can't spoof another router, because hop-counts greater than 1 must be explicitly configured, and nobody sane sets ebgp multihop to be greater than 2.

  • One possible idea would be to setup zones of authority so that routers can only advertise routes for blocks they are authoritative for. I have a feeling that doing this though would make the routing system so hierarchial that traffic would grind to a halt. I'm not really an expert on routing tho... maybe someone who is can inform me.

    • Re: You are right (Score:1, Informative)

      by Anonymous Coward
      Your comment is on the spot. The routing would break down.

      --
      Andre
    • And that's exactly what everybody does.

      It's entertaining to see what people with only theoretical knowledge of backbone routing (Like Stephen Dugan) come up with for mythical security holes.

  • Router Holes in BGP Threatens Net (Score:4, Funny)

    by whoisvaibhav ( 654143 ) on Monday March 03, 2003 @06:58AM (#5423012) Homepage
    A Net is always made of Holes. So what's new???

  • How? (Score:3, Interesting)

    by captainclever ( 568610 ) <rj AT audioscrobbler DOT com> on Monday March 03, 2003 @06:59AM (#5423015) Homepage
    So how does one compromise a router?

    do you have to get physical access to it? i've not really heard of people hijacking routers, anyone have any info on this?

    not that i fancy trying it, just interested :P

    • Re:How? (Score:2, Informative)

      by banana fiend ( 611664 )
      The more configurable ones (and I haven't had to configure one in years - a cisco I believe), can be telnetted into and, reconfigured.

      However, the article talks about weaknesses in the protocol as well as configuration problems.

      However, a misconfigured router, or one that has been compromised by an online intruder, can cause chaos by advertising itself as the best path to an unrelated network

      The problem is caused by the BGP protocol and the fact that the routers trust each other for information. Insert "trusted" script kiddie here. - chaos ensues.

      • Re:How? (Score:3, Insightful)

        by TheCrazyFinn ( 539383 )
        except a properly configured router will only accept the routes it's told to accept from a given peer.

        Access Lists and Prefix Lists.

        So you need to comprimise a router which has a peer that was configured by rabid monkeys in order to break anything.

        Backbone NOC's are extremely paranoid about this sort of thing, and the Author of the Article in question rather obviously know sweet fuck all about BGP.

    • Re:How? (Score:2, Insightful)

      by vekotin ( 535759 )
      A router might just as well be your common linux/bsd box as well. In many cases, sshd is run to make administration easier and in some cases, it just might not be secure enough. Easily avoidable problem, but then again, so was Nimda...

    • Re:How? (Score:5, Informative)

      by ghostrider_one ( 182445 ) on Monday March 03, 2003 @07:08AM (#5423040)
      You dont need physical access, although it can help if you dont know the passwords to the router (search for "password recovery" on cisco.com). If you know the passwords, you telnet/ssh to the router (most low-end routers only support telnet, so an eavesdropping attack to obtain the passwords is possable), make whatever configuration changes you want, and voila, it's hijacked. Or, you can try and knock it offline somehow, then try and impersonate it to cause mischief. That's a lot more difficult though.
      • If you have physical access to the router (especially Cisco routers), you could hose the config by just knowing how to modify the boot register. You don't need to know a password. In fact, password recovery is one of the first things you learn if you take a Cisco CCNA training course.

        To secure a router for remote access, I would set up an ACL which would permit Telnet traffic destined to the router from certain IP addresses only, and deny telnet traffic from everywhere else.

        • Re:How? (Score:3, Interesting)

          by afidel ( 530433 )
          I'd do and have done better than that, only allow telnet on the console and async line, that way you have to either be physically at the console or dialed up to the external modem on the access server and know the access server(possibly multiple if using RADIUS authentication) and console passwords =)

      • Re:How? (Score:2, Insightful)

        by zerocool^ ( 112121 )
        If you know the passwords, you telnet/ssh to the router (most low-end routers only support telnet, so an eavesdropping attack to obtain the passwords is possable), make whatever configuration changes you want, and voila, it's hijacked.

        *Sigh*

        Granted, cisco routers are great, but they're also hella expensive.
        We use a Linux based router, with 3 Dual T-1 cards (cyclades PC300's).
        We run Zebra (emulate cisco, more or less) and bgpd (bgp service).
        Because we're using our own software, we can do several really cool things.
        One: Disable access to the router outside of the internal network.
        Two: Disable telnet access.

        And, a really cool third:
        Multi-homed BGP, for those of you who don't know, is used for best route selection when your router is connected to two or more links. Roughly. Sort of. Search google for "Avi freedman doc BGP". It's really for announcing your network (autonomous system) to other routers, but it does the deciding on what to announce... anyway...
        Unfortunately, one thing it doesn't take into account is bandwidth saturation on the network. We have one provider (sprint) who provides the bandwidth to another of our providers (ntelos). So, the route for Ntelos is at least two hops longer. As a result, our one T-1 through sprint may end up being completely slammed, and both of the nTelos ones may have only 10-20k going out them because BGP has decided that the best way to get everywhere is to go out sprint.
        We could just prepend our sprint routes a couple of hops, but that requires all kinds of multihop wizardry.

        Enter our autoscaling package. It's a set of modifications to the BGP source (eat it cisco). What it does is calculate the bandwidth available on any one link, and shift routes around to links with more available bandwidth, so that all our traffic is balanced.
        Granted, it may take a slightly longer time over a link that BGP didn't select for that route, BUT we feel that having traffic going out a link that may have a slightly longer pathlength is preferable to having all bandwidth fight for the one "preferable" link.

        Ahh, the joys of open source.

        Or, you can try and knock it offline somehow, then try and impersonate it to cause mischief. That's a lot more difficult though.
        Yep.
        For us, if we're getting an attack from someone, usually all we have to do is start dropping their packets. Keep in mind, most home connections are short on outgoing bandwidth, and we have gobs of incomming bandwidth to spare, so this is usually enough. Alternatively, if it's a huge attack, we just figure out where it's comming from, and call our upstream ISP, and they block packets for us. It's kind of hard to ping flood the Quest backbone =). R1d3 tha L1gh7, script kiddies.

        Also, another precaution we take is that we don't (can't) get into the BGP interface on the router unless we're already on the router, so unless someone on the internal network can sniff out a telnet connection to localhost, we're probably OK.

        But, the point is well taken. If you have the password, you can cause havoc. Being able to secure your router because you have the source, and you can block accesses, does help, but it's not the end all be all.

    • Re:How? (Score:2, Informative)

      by Anonymous Coward
      do you have to get physical access to it? i've not really heard of people hijacking routers, anyone have any info on this?

      SSH to it then login with your SecurID token. Make sure your IP address is in the ACL that allows access to the vty lines. Otherwise just attach a serial cable to the console or login to a terminal server that's attached to the router. What, did you think it was something easy like "Telnet to port 179 and type "login bgp"?

      The only other time you're going to "compromise" a router is via extremely poor configs (like leaving default snmp communities setup like public/private or when there's a bug in one of the services like SNMP (happened a couple years ago) or SSH/Telnet.

  • Death of Internet predicted, film at 11... (Score:5, Informative)

    by mdb31 ( 132237 ) on Monday March 03, 2003 @07:00AM (#5423017)
    While the article is correct in stating that BGPv4 doesn't offer any support for route authentication, this problem isn't very likely to 'bring down' the Internet anytime soon.

    Just about every ISP already implements route filters, so they will only accept expected routes from its peers. So if a rogue BGP speakers suddenly starts announcing a default route, not many (if any...) peers are going to believe it, keeping the impact on the global Internet next to nothing.

    Several databases are used by ISPs to automatically build route filters, for example Merit's RADB [radb.net]. Although not every ISP participates in databases like this, all of them use at least a private scheme, unless they're especially small and/or clueless.

    Secure BGP would be really nice (as would Secure DNS, etc.), since it would eliminate the need for a lot of manual and error-prone list maintenance. However, the infrastructure changes and (most importantly) the more difficult initial set-up for new sessions (need to authenticate and exchange keys out-of-band) will probably keep this from happening for a while.
    • Well, there's a heck of a lot more than 12,000 BGP capable routers out there. I think the article was implying an ISP's BGP router being compromised, THAT would cause a big headache for their peers until it got corrected (which could take up to 18hrs at the national ISP I used to work at, at least on weekends.)

      • Re:Death of Internet predicted, film at 11... (Score:5, Interesting)

        by mdb31 ( 132237 ) on Monday March 03, 2003 @07:36AM (#5423081)
        I think the article was implying an ISP's BGP router being compromised, THAT would cause a big headache for their peers until it got corrected

        Well, that would depend on the nature of the compromise, and what exactly the attacker is trying to achieve. The worst case scenario as described by the article, the compromised router acting as some kind of global Internet default gateway, is unlikely to happen, though, for several reasons:

        1. All peers of the compromised routers will have route filters in place. That means they simply will not accept announcements for unexpected address space, including 0.0.0.0/0;

        2. Even if one or more peers are braindead, and have not configured route filters, the resulting traffic spike will cause link saturation, and thus the BGP session to go down at some point. The resulting flapping will definitely get noted by someone...

        Of course, any situation where a router gets compromised is bad news, but even Secure BGP won't fix that: the current 'non secure' situation is a non-issue even in that light. Errors in protocol implementations, bad network security, etcetera are bigger problems, and can be mitigated today (by using IPsec to carry BGP traffic, amongst other things), without the BGP protocol redesign the article seems to want.
    • I thought these are News for Nerds. How can this be news for nerds? This is the 3rd posting on /. about this topic and it won't change cause it's not a big problem and won't cause any severe damage.

      Please... stop posting FUD to slashdot. It just sucks...

      btw: This one was posted to "security" and the last ones were posted to "the internet" but who cares?

    • Re:Death of Internet predicted, film at 11... (Score:5, Informative)

      by Michael Hunt ( 585391 ) on Monday March 03, 2003 @07:31AM (#5423072) Homepage
      Aye.

      This is correct in the case of small networks multi-homing with larger networks. Specifically, the 'upstream' peers (in the 'you pay them' sense) are ordinarily locked down to the point where you have to advise them BEFORE you add any additional prefixes to your BGP session with them, or they'll be silently dropped and you'll wonder why.

      In the case of larger networks peering with a route server at a peering facility, this could be an issue. Considering the dynamic nature of the TLAs being advertised, the tier 1 (and to an extent tier 2) providers have to trust each other more or less implicitly. However, in the case of eBGP sessions at an IX, most everyone is only peering with one peer, the 'route server', and this box is likely to be about as locked down as they come.

      CIDR provides a further saving grace - in order to cause mass chaos, one would have to advertise a prefix shorter than one already being advertised. Since most large providers in the states and elsewhere filter out almost everything shorter than a full TLA (/19) (there are exceptions to this, mostly concerning pre-1998 assigned class C nets), the best you could do is blackhole a random subset of traffic to a given block.

      That said, considering the fact that 99.99% of the world's tier 1/2 BGP servers are run by competent admins who stand to lose their jobs and become gardeners or trash-os if their BGP routers get compromised and wreak the sort of havoc alluded to in this article, one can reasonably assume that they're secure. Additionally, (I know APnic does this, not sure about other RIRs,) the netblocks assigned for IXs are usually /24 or longer, and aren't allowed to be advertised to the internet at large, so generally the really INTERESTING routers aren't reachable anyways.

      I had a rad diagram here except the 'lameness' filter whacked it.

      In an IX scenario, anyhow, all the routers speaking eBGP (as well as the route server) will be on unreachable IP addresses. The closest 'accessible' routers will likely be route reflectors peering via iBGP with both the eBGP 'peering' routers (unreachable) and the eBGP 'customer-side' routers (reachable, untrusted.)

      So, to cut a short story long, this article is hype :)

      Cheers,

      MH

    • Routing protocols are finiky things. Just this morning, I spent an hour troubleshooting an OSPF network that used static routes for non-ospf-speaking equipment.

      Anyway, If I crack (not gonna happen) a core router and advertise your network as living on fas0/0, then your network would cease to exist for a large portion of the internet. All the filters in the world will not stop that traffic from being shunted into oblivion.

      Seems to me it would be just as effective as a DDoS. Well, not quite. A DoS would cost you bandwidth. The blackhole just causes you hits.

      Of course, I could tell the router that every Class B lives on your line. Then the traffic would DoS you in a heartbeat.

      • Re:Routing Protocols (Score:2, Insightful)

        by ckuhtz ( 87644 )
        > Of course, I could tell the router that every Class B lives on your line. Then the traffic would DoS you in a heartbeat

        Ahh, nothing more refreshing than another /.'er speaking out of his ass on a Monday morning.

        You presume that anyone will listen to your advertisement and not ACL what they listen to from you.

        Yet another /.'er speaking without any operational or technical experience. Wahoo.

    • darn, you beat me to it (Score:5, Informative)

      by Artifex ( 18308 ) on Monday March 03, 2003 @08:13AM (#5423135) Journal
      Every Tier 1 provider uses route filtering, and probably all are auto-built from config servers and common route object databases. If some dinky Florida ISP decides that they're going to announce a /2 (example from actual history), and my table says their ASN should only be broadcasting a /21, we reject it all (historically, most people didn't, and a huge chunk of the net fell down that day). None of this "we adjust it to match" either - it matches what it should be, or it gets blocked. Not only that, but the configs on the routers explicitly allow only predetermined ASNs, so if the dinky Florida ISP suddenly gets an IBM satellite office connected to it, they have to fix their routing object to say that their ASN will be announcing IBM's ASN, etc.

      Any network engineer who works for an ISP should tell you that the biggest likely problem with BGP isn't bad routes, it's BGP on a flapping connection, because until the auto-dampening kicks in, every time the circuit goes up, BGP restarts its handshake and route announcement, and when the line is just dirty enough to get lots of flaps but still some signal time, you get major load on the routers involved. The load from a flapping OC-12 can conceivably take down underpowered aggregate routers from some vendors, which can knock out entire regions of customers.

      Now... think about how you connect in to fix one of those, if it doesn't stay up long enough for you to remote in. :)
      • Now... think about how you connect in to fix one of those, if it doesn't stay up long enough for you to remote in. :)
        I have someone connect a terminal directly to the router. Simple, no?
        • I have someone connect a terminal directly to the router. Simple, no?


          You'd think so, except when the router is somewhere in Wyoming and there are no engineers on payroll near it, and the one nearest is a 4 hour plane ride away. Oh, and the insecure way the POP is laid out internally, you don't want anyone not on payroll, like a local contractor, getting entry.
          • Then I'd have someone do the same with the upstreams. Or just have them physically pull the plug.
          • Why don't you have some kind of terminal server hooked up to provide the necessary out-of-band access so the lack of truster personnel on site isn't an issue? A modem? Secondary IP connectivity?

            At least have a plan in place to isolate the untrusted router from the network should things go haywire.

            I mean, I'm no router god, but every router god I ever dealt with beat it into my head that you always have out of band access to your remote equipment.
            • Why don't you have some kind of terminal server hooked up to provide the necessary out-of-band access so the lack of truster personnel on site isn't an issue? A modem? Secondary IP connectivity?


              This is already covered in answers to other responses. Essentially, though, that's one good answer, and so is having the telco loop the circuit or otherwise disable it so it stops flapping and you can get to it through another line.

              The example in reality that I'm thinking of involved an ISP that was bought out, and some of their backbone had yet to be suborned into the buyer's structure fully. Nobody left knew their term server dialin info, or if they even had one. :) You can imagine the excitement when it was discovered that nobody had a valid CID, either.
      • Now... think about how you connect in to fix one of those, if it doesn't stay up long enough for you to remote in. :)

        You dial in to the modem attached to the AUX port.
        • You dial in to the modem attached to the AUX port.


          I didn't say the line stayed up long enough (remember, there are multiple lines, it's an aggregate), I said the router doesn't stay up enough. As in, would you even finish handshaking? Doubtful. But you could dial into a term server connected to it, then try to interrupt the loading process, reconfigure that flapping interface to be admin down, and so forth. Another good answer (as another reader mentioned) is to call the telco and have them shove the line down, like forcing a loop or something.

      • All of that is true, and is why the sky won't fall anytime soon. However, it does strike me as 'fixing' the lack of a deadbolt for your door by hiring a guard rather than installing the deadbolt. In the IBM example, if the broadcasts from the small ISP had IBM's signature on them, you wouldn't need to do anything special at all to handle the change as long as you could obtain IBM's public key from an authoritative source.

        As for the route flap problem, that wouldn't be so much of a problem if router's processors weren't so anemic.

        • All of that is true, and is why the sky won't fall anytime soon. However, it does strike me as 'fixing' the lack of a deadbolt for your door by hiring a guard rather than installing the deadbolt. In the IBM example, if the broadcasts from the small ISP had IBM's signature on them, you wouldn't need to do anything special at all to handle the change as long as you could obtain IBM's public key from an authoritative source.


          Properly implemented, routing object servers already provide this level of security. The downstream user has to modify the routing object, using his password/pgpkey/whatever, and he/she has to use his/her AS number when making the announcement. The AS is only accepted through his/her interface(s) (and those of other transit providers if he/she is multi-homed). The routing filters are built automatically incorporating the routing object server information, on a regular basis.

          Everything stays smooth and secure, at least for the ISP side, because a compromise in the system almost certainly involves a broken password/pgpkey/whatever on the downstream side. The only real problem with this method, of course, is when customers get "consultants" who know nothing about routing objects, or BGP itself, or the customer's admin runs off with the password. The ISP can rewrite the password code for the object, or simply wipe the object and letthe customer start from scratch, but it can't do much about clueless consultants, because it's not selling a BGP training program :)
      • I usually deal with flapping connections by "administratively" shutting down the interface in Cisco IOS. Just connect to the interface and issue a "shut", or "shutdown" command.

        Of course this is difficult if you don't have physical access. Most large core routers should have a console server attached to them with a different physical circuit attached to it, so you should still be able to console into it even if your primary net connections are down.

  • Authentication not much help... (Score:4, Redundant)

    by Goonie ( 8651 ) <robert DOT merkel AT benambra DOT org> on Monday March 03, 2003 @07:01AM (#5423020) Homepage
    If the router is compromised, there's nothing stopping it sending out properly authenticated packets-of-doom.

    I don't know what the complete solution to this is, but simple authentication isn't it. At a first line of defence, what about some sanity checking on the routing information provided?

  • For more information.... (Score:5, Informative)

    by Jouster ( 144775 ) <slashdot@NOspaM.angelfaq.com> on Monday March 03, 2003 @07:01AM (#5423021) Homepage Journal
    Check out CiteSeer's links: CiteSeer [nec.com]. This problem has been known for quite a while. Check out the MOAS problems with BGP, though, if this isn't enough to worry you.

    Jouster
    • The fact that this problem has been known for years is probably exactly why nothing much has been done about it. As a matter of fact, routers emitting IGMP broadcasts and every WinXP machine replying have been causing me a lot more trouble than BGP. On the other hand, every possible security hole should be fixed ASAP.

      BTW I assume that virusses on P2P networks use a similar method to spread as fast as possible.
      • BTW I assume that virusses on P2P networks use a similar method to spread as fast as possible.
        Huh?
        As a matter of fact, routers emitting IGMP broadcasts and every WinXP machine replying have been causing me a lot more trouble than BGP.
        Yep, it's a bitch. I'm a big fan of throwing big ping packets at the broadcast addresses that cover the printer pool, though. Most printers have *terrible* protocol implementations. Send 30k ping to broadcast with a falsified source, you'll get twenty printers trying to respond. It's great!

        Jouster

  • did anyone notice the .NET discussion underneath? (Score:3, Interesting)

    by wadiwood ( 601205 ) on Monday March 03, 2003 @07:01AM (#5423022) Journal
    in the second post under the news article somebody confused .NET with NET
    most of the rest of the thread under that was people calling the .NET'r stupid.
    I knew Microsoft was trying to usurp the language for their own profit again.

    the posts marked Storm teacup were informative, ie if we're using secure telnet ie the ssh part of putty or just plain old ssh or secure ftp, router spoofing won't matter a lot. I have trouble believing that routers have been misconfigured as GOD routers only once (1997). This must have happened more than once. How many routers would you need to stuff up to make a glitch in the internet?
    • I remember talking to a sysadmin 10 years+ ago, that had a hard time not rolling over from laugther. Someone somewhere on the DECnet in the middle of nowhere in American had by mistake announced their transatlantic routing-cost as zero. Then two things happened:

      1) as most machines on both side of the pond automaticly updated their routing tables this unfortunate machine got almost all transatlantic traffic routed to it.
      2) as transatlantic traffic virtually stopped then all of this machines immitiate neighbors rather quickly manually updated their routing cost to this machine to close to infinity.

      Or this is at least how I remember the story...
  • implicitly trust their neighbors on the Internet

    Didnt the internet figure out the security issues of trust-host relationships years ago?

    But then like nething else thats core-of-the-net, no one wants the hassle of upgrading it.. alla BIND.
    • Perhaps not a complete revamp of DNS and I don't know enough about the alternate name server software to say, however this story SLASHDOT article [slashdot.org] might point towards things to come...

  • Secure BGP (Score:2, Informative)

    by seasunset ( 469481 )
    This information about a Secure BGP effort might be interesting [bbn.com].
    There is also soBGP (you can google for it), but between the 2, I don't know which has more possibilities to go forward (if any).

  • Old news (Score:3, Informative)

    by cravey ( 414235 ) on Monday March 03, 2003 @07:03AM (#5423026)
    The article seems a bit vague on detail of the 'holes', but the big one that they do mention is one that every halfway decent router admin is aware of. It's a matter of trust and most providers don't trust their customers routers to be accurate. This is really not a problem except for networks providing transit to third party networks or maybe a few very poorly configured ones which really drastically limits the number of 'vulnerable' router networks. Realistically, I seriously doubt that even 10% of AS's have the ability to cause these problems. certainly not "Anyone at an Internet service provider could do this." That's just complete BS by a fear mongering 'expert'.

    Anyone administering a router that is NOT getting transit trhough a peer can prevent that peer from injecting new routes into their table. The RADB helps with this for those that do.

  • You have GOT to be kidding me (Score:5, Insightful)

    by ghostrider_one ( 182445 ) on Monday March 03, 2003 @07:03AM (#5423028)
    That ZDnet article is one of the greatest crocks of sh_t I've read online. "Digital identification" might prevent someone impersonating a particular router to stage an attack, but if a router is either accidently or deliberately mis-configured to advertise networks it shouldn't, how is "digital identification" going to prevent this? Statements like "We have to stop trusting routers" make me think that the paper quoted in the article was written to get media attention and not much else.
    • The same way showing a valid drivers licensce prevents me from strapping dynamite to my chest and taking out some infidels. Nobody who passes the driving test can be against us!
    • Good points. And to extend it further, trust what ? You can verify with route-maps that a AS_PATH starts with or contains your neighbours' ASN but this is about what we can do.

      The whole idea of authentication is dull anyway. Who needs P2P authentication when you know the hassle that one has to go through to get and maintain a peering agreement with a Tier1/2 service provider ? And of course, BGP neighbours are manually setup by the remote party. So it's not like you can suddenly take control of internet routers and modify the peering points or anything..

  • All major ISPs do filtering on their BGP Sessions (Score:5, Informative)

    by Anonymous Coward on Monday March 03, 2003 @07:04AM (#5423030)
    I am working with BGP4 since 1996 and since then many things have been done. The breakdown in 1997 when the one ISP was sending half of the Internet as singel Class-C routes aint possible anymore.

    All major ISPs do heavy route filtering on all their border routers. Even the small ones do it. They do it for one simple reason: They don't want to transport traffic nobody is paying for. So in essence the market has already taken care of the problem.

    Also when you look at the RIPE database you'll see what the individual filters are. Klick here to see such a Routing Policy [ripe.net] (Swisscom in this case). This is what the routers are enforcing.

    The whole blabla about this BGPsec is useless and by nice engineering people who haven't got any clue how the network is managed and run nowadays. They propose to use DNS to authenticate the prefix announcements... How are you supposed to do that if you can't reach one of the DNS Root servers?

    This entire BGP and security discussion is just some hyped non-issue and smells awfully like the
    orange and banana alert bullshit the US government is so proud of...

    --
    Andre
    • I totally agree. I've been using BGPv4 for many years, this article is just froth. In my experience there are a *few* excellent security engineers out there, but the majority are sensationalist with a very poor understanding of network protocols. These engineers cause many more problems than their security prevents.

  • Old old old (Score:5, Informative)

    by Pike65 ( 454932 ) on Monday March 03, 2003 @07:04AM (#5423033) Homepage
    When the L0pht [l0pht.com] group (now working for @stake) claimed in a Government Affairs Committee in May 1998 that they could make the Internet "unusable" in 30 minutes, they were largely talking about exploiting BGP.

    RFC 2385 [ietf.org] was released three months later referring to the problem . . .

  • Non-story (Score:5, Interesting)

    by stroudie ( 173480 ) on Monday March 03, 2003 @07:13AM (#5423048)
    This is a bit of a non-story, I think. Why? Well...

    1) Misconfigured routers cause much more trouble that compromised ones. Routers seem to be cursed so that admins (especially junior ones) feel the need to 'tweak' them endlessly.

    2) A compromised router (i.e. one that is under the control of someone 'bad' - a Junior admin for example) is a pain whatever - BGP extends the range of the damage that can be caused, but ultimately securing the router is more important.

    Yes, I think S-BGP is a good idea, but hiding those router passwords is a better one.

    • Re:Non-story (Score:4, Insightful)

      by Jouster ( 144775 ) <slashdot@NOspaM.angelfaq.com> on Monday March 03, 2003 @07:39AM (#5423090) Homepage Journal
      I'm not sure where you went to "router school", but I learned my routing (just like I learned my Linux, BSD, and UNICOS) in the dirt. Until you've fucked it up a few times, you don't really understand it.

      By the time you've graduated to fucking it up in SOURCE, you're qualified to administrate a production box. You understand the dangers of success.

      One of the gentlemen in my division spent two years carefully toeing the line of what he understood. Finally, I pointed out the fuckbox we keep on the network for three dozen different uses, and explicitly told him to make it fail and then bring it back up. When he had completed that, I was at last willing to write up promotion papers (which is good, since we had been needing a new senior network tech).

      I want my people capable of doing their day-to-day jobs without errors--if they couldn't do that, the network wouldn't be able to run. But at the same time, I want them to be able to do the occasional impossible task without fear of failure--THAT is how to run a network team.

      Jouster

    • Re:Non-story (Score:3, Funny)

      by hburch ( 98908 )
      My personal theory is that the Internet is being run by 20 morons:

      We are all morons. Not complete morons, of course. Assuming that we make mistakes 1% of the time, but catch those mistakes 99% of the time before they become a problem, that still means that we make un-caught mistakes (are morons) 0.01% of the time. Thus, everyone is at least 0.0001 of a moron. If there are 200,000 system and network administrators out there, that means there are 20 morons running the Internet.

      Determining the number of morons using the Internet is left to the interested reader.

  • Small Virginia ISP (Score:5, Informative)

    by Jouster ( 144775 ) <slashdot@NOspaM.angelfaq.com> on Monday March 03, 2003 @07:15AM (#5423052) Homepage Journal
    Just to clarify: the small, Virginia-based ISP was "MAI Network Services". It took quite a bit of Googling to locate that, so I figured I'd save everyone else the trouble.

    Jouster

    • Re:Small Virginia ISP (Score:2, Interesting)

      by chipach ( 228559 )
      AS 7007, to be precise. It is listed with ARIN as "Florida Internet Exchange" for reasons which I don't recall. I find it amusing that it is still being discussed. (I even see a reference to it in a mailing list last November.)

      For those interested, an archived copy of the apology issued after this incident is here [archive.org]

      The owner of the AS happens to be a close friend. I'm waiting for him to start advertising a block with it just to see how many routers still have an AS7007 filter up.

      Geesh, now I feel like an old-timer.

  • That is why we need open source software people!!! (Score:4, Funny)

    by Dot.Com.CEO ( 624226 ) on Monday March 03, 2003 @07:35AM (#5423077)
    Well, had the Internet been using open source, free software for its routing we wouldn't have this problem now, would we? Oh wait..

  • if a router is compromised, then your lost anyway (Score:5, Informative)

    by sabri ( 584428 ) on Monday March 03, 2003 @07:38AM (#5423087)
    I operate a network with multipe routers in DFZ (default free zone). The story of 'comprimised routers are a threat' returns every now and then. There are a couple of thing you should keep in mind. First of all, rule #1 of Operating A Router:

    Filter, filter and filter

    Do not accept announcements your peer should not announce. Second, using MD5 security is useless, as your router knows the password so if your router is being compromised, the password is known. MD5 security is only useful when it comes to macadress spoofing.

    Sending out 0.0.0.0/0? Sure, go ahead, but see that prefix filtered. Sending out 1000 prefixes instead of the 10 you usually send? Sure, hit my maxprefix counters and see your sessions terminated.

    In short: if you manage your router properly, you will have no problem if your neighbour is compromised.

  • Sigh (Score:2, Insightful)

    by arvindn ( 542080 )
    "We need to develop the technology before someone attacks the system. But until there is an attack, companies might not be willing to spend the money."

    Sounds familiar? Heard the following?

    • People need to backup their data before there is a disk crash. But until that happens, people are unwilling to put in the extra effort, and then it is too late.
    • Sysads need to patch the latest SSH/IIS hole before a worm hits. But until they are 0wned, sysads are not willing to spend time securing the system.
    How sad that people simply don't learn. True, in the case of the internet the change is much more costly, but you would expect companies/organizations running the major gateways to have a little more foresight. After all its for their own good.

    Y'know, if you read articles written by h4X0rz and warez d00dz, they often claim they do more good than harm by forcing people to create a better security infrastructure. When you read it it looks like a miserable attempt at satisfying their own conscience, but when I read something like this article I almost see their point.

  • Problem in Uni Halls (Score:3, Interesting)

    by cybergibbons ( 554352 ) on Monday March 03, 2003 @07:40AM (#5423093) Homepage

    When I was in halls last year, I discovered this as a problem. The routers and switches on the halls networks were badly configured and secured.

    It all started off with some fun with Ettercap, and it was clear that ARP spoofing worked.

    You could then easily pretend to be the gateway on the network. All the traffic on the same switch as me was coming through my box. Ettercap was limited, so a bit of hacking and scripting later, a combination of arpoison, fragrouter, and tcpdump was working on the network.

    Sniffing got a bit dull (porn, e-mail, p2p) until someone tried logging into one of the switches. They had been connected badly, using 10Mb/s upstreams to chain lots of switches together, rather than using the proper backplane, so I think it meant I could see any traffic destined for switches further along the chain.

    From this I got the password (no username required). It was an easy job changing my port to 100Mb/s, which removed some of the bottleneck when I was forwarding traffic when pretending to be the gateway.

    However, each switch and router trusted the next. The whole network was like this. Although I didn't get far with my experimentation, it should have been possible to re-route traffic.

    Thing was, they had slow connections. Unless you went onto JANET or the uni systems. You could use the uni proxy to speed it up a bit, but only with web traffic. It would have been interesting to try getting all traffic to take a faster route, but I would have got busted.

  • Only the 'leet script kiddies' would try this (Score:3, Insightful)

    by sdwyer ( 654764 ) on Monday March 03, 2003 @07:41AM (#5423095)
    As for the reasons pointed out by others here, due to measures already taken to only accept feeds from certain 'trusted' hosts etc, It's unlikely that this will ever have any effect unless an upstream router was compromised. Even then, it'd only effect down stream clients, who would complain like shit until it was fixed.

    Luckily, the only people who would want to do this sort of DOS are the imature script kiddies who would only be following instructions from the current equivelant of rootshell.org (what happened to this site?). Responsible people, who would have the complete understanding of how it all worked, would not do this anyway. :)

    Just my 2c.
    --Shaun
  • A lot of this FUD; There are security issues, but more recently Verisign and other CA's have been injecting this sort of stuff into the mass media to try to push for more authenticated services, which means more certificates, and more money for their corporations.

    We can't replace BGP anymore than we can replace the VHS tape. It's become too integrated into the operations of the Internet, and it's simply too hard to change (just like IPv6 vs v4. It's not going away anytime soon.)

    • Re:Fear the FUD (Score:2, Insightful)

      by ckuhtz ( 87644 )
      > We can't replace BGP anymore than we can replace the VHS tape. It's become too integrated into the operations of the Internet, and it's simply too hard to change (just like IPv6 vs v4. It's not going away anytime soon.)

      Bull*cough*shit. Sure you can. BGP-4 is a replacement. Sure it can be replaced.

      And, oh, btw, IPv6 is being deployed quite actively outside the U.S. And your assumption about IPv6 replacing all of IPv4 is fundamentally flawed. They're not mutually exclusive.

      Moronic FUD postings on /. reign supreme.

  • A compromised device can cause havoc? Wow, news flash! I guess this means its up to the administrator to make sure its not compromised, huh? Another huge surprise...
    • Indeed. As others have noted this article seems to be network Nazi propaganda encouraging everyone to register and identify.

      Protocols will always have holes The solution is proper maintenance.
  • ZDNet must just have a quota of scare articles to pub every week.
    Screwed up BGP configs used to raise havoc once in a while. I don't know if they still do but it used to happen several times a year. This has been known since the inception of BGP, the guard against it has always been "well, keep control of your routers, and know what you're doing before you touch the config."

  • OK lets get real (Score:4, Informative)

    by silas_moeckel ( 234313 ) <silas.dsminc-corp@com> on Monday March 03, 2003 @08:32AM (#5423190) Homepage
    This is only an issue on badly configured routers. As for spoofing we have md5 sums and source address verification so that would require you to figure out the shared key while generating all sorts of logs on the end router. BGP works with low TTL's (generaly 1 or specified higher) so you can only get packets in never responces unless you share a subnet and most BGP links are on PtP lines. OK thats pretty much takes care of spoofing.

    Next router takeovers they can happen especialy as people arent using proper seperate management networks. This is a straight security thing. Next except between tier 1 is there a full trust relationship tier ones dont trust there clients they filter all prefixes not owned by the client general requiring the client to email them to allow out a new announcement. So you realy have to break into a tier ones routers to pop up a new announcement at best you can funnel traffic to that netblock from people that are relitivly close to that teir one. This will show up on just about everybodies radar screen as it's a netblock advertized by 2 AS numbers thats generaly a no no or som moron that insists they NEED to be redundant but isn't big enough to get there own IP block or AS (Joe corprate does not need there own AS for as much as they want one there are 65k of them to go around gets a good IPP to host your corp site and deal with multi directional NAT for the rest) Now you could take over the adversisement for a whole AS now this AS is going to start getting calles from perturbed individuals who cant get to here etc etc etc go visit a looking glass see the new advertisement and call up that ISP's noc to get things settled out. BGP has a lot of problems but we need out routing protocals doing crypto like a hole in the head. Oh yea anybody worth a grain of salt has started null routing all the bogons (addresses that shouldent be advertised the spammers used to love those) it's clean it's easy and you can do it automaticaly via a slew of services or by hand new /8's dont go out that often and some of the services are even working on non alocated sections of /8's as well.
  • has there been a single case of a hacker comprising a BGP-speaking router on the Internet? I am not sure. I am sure though that there have been MANY cases of misconfigured routers. I believe it is much more common for backbone providers (Sprint, AT&T, etc) to filter routes from customers (small ISPs), than from other backbone providers. Therefore even with filtering, misconfiguration of backbone routers is still a huge issue. While it is a story that probably won't make it on ZDNet, I think the real need is to develop tools for network operators that will help insure that they haven't made a mistake when reconfiguring their routers.

  • I wonder... (Karma whores, over here) (Score:3, Informative)

    by Second_Derivative ( 257815 ) on Monday March 03, 2003 @08:40AM (#5423218)
    Are there any decent introductions to BGP and how it operates at the Core? routing only becomes really important with big-ass networks and this is pretty much the one thing you can't easily throw together and muck around with in your bedroom (that and for whatever reason everyone seems to use Cisco routers which you can't exactly download off apt-get). Net effect is I know a fair bit about systems administration on the single machine to local area network level, but really have no experience about how these things work on a large scale, or much of a clue about how routing works (NAT gateways don't count). And I suspect I'm not the only one either.

    Long story short are there any good resources around for elucidating this field somewhat?
  • I remember this happening back in 1995 when I was a network engineer at InternetMCI. An engineer, who will remain nameless (Neal), f*cked up the BGP in a SouthWestern USA router, effectivly routing all nearby (3-4 states?) into said router for a few hours.

    He barely lasted a month or so in our department.

    From that point forward, we refered to this as "black holing".

  • The bigger problem is... (Score:3, Insightful)

    by jafo ( 11982 ) on Monday March 03, 2003 @08:58AM (#5423275) Homepage
    As an ISP, I'm not as worried about my BGP boxen being compromised and sending out bad routes. The thing that is much more likely is that somebody running one of the BGP routers we talk to makes a mistake, or that we make a mistake ourselves... That happens much more frequently.

    This is why people so heavily filter what announcements they will take. This filtering is why there haven't been more problems with bad routes being advertised by the malicious.

    So, forget trying to get the whole net to switch over to BGPsec... Let's just put pressure on the people who still aren't doing appropriate filtering of routes they receive.

    Sean

  • Real risks (Score:5, Insightful)

    by petrilli ( 568256 ) on Monday March 03, 2003 @09:14AM (#5423346) Homepage
    This article is pretty much bunk, as everyone else has pointed out. The top ISPs in the world don't operate in a manner consistent with idiot security people's "guesses". Let's talk about some real risks to the routing fabric of the Internet:

    • Homogenous software. This doesn't sound like a huge problem, but it is. I'd say most Tier-1 ISPs run Juniper core routers, Cisco on the edge---long reasoning, but has to do with who does what best. This means that on the whole, most ISPs will be vulerable to the same attack. This is the same destructon issues that Microsoft presents. To give you an example, many moons ago, UUnet (before Worldcom) injected a bogus route entry accidentally, and it caused every Cisco router that heard it to reset the BGP session with that router. This continued forever until it it was identified. The only backbone not impacted was ANSnet, because they were using customer routers based on IBM hardware and gated.
    • Limited skill set distribution. The number of people who truly understand routing at the massive scale that the Tier-1s have to deal with is tiny. In any backbone, it's maybe 5-6 people, maybe less, that truly understand it in detail. At my old company we always argued that the fastest attack against the backbone was to puncture the tired of a car carrying the engineers to lunch.


    Those really are the two biggest issues from my perspective. BGPv4 is attackable, always has been. SecureBGP deals with some aspects of the problem, but certainly not DOS issues. Huge routing updates consume CPU resources, and even with route dampening and other tricks, you can artificially (though rarely naturally) kill a router through BGP.

    It's unfortunate that an article purporting to cover risks doesn't bother with the real ones and instead sticks to sensationalistic strategies.
    • --so far in the thread I have seen discussions only from the point of view of an "outsider" attempting a malicious attack, or just "mistakes being made due to ignorance" at these various large routers.

      My wondering is what IF a large politically motivated plan of action was contemplated and initiated. Perhaps these 5-6 serious brains at a few places were compromised, either blackmailed or bribed, or they were actual "true believers" of some large political factions ideologies? This could be a state sponsored event or a large private political faction. That to me looks more like the largest potential threat, short of just mass physical destruction of course. Your example of puncturing the tires of those gents to make them not be able to get to the shop reminded me of it, just turn it around to "the bad guys are in charge, on-site and are up to no good". What was the black hat geeks name in Jurassic Park? A deal like that but on steroids. Say I was "badguy" faction A and wanted to be able to conduct cyberwarefare at target country B. would it be a better bet and easier to accomplish remotely, or would it be easier for me to bide my time and get some few key ubergeek-personnel tagged in advance, compromised or "recruited" using a false flag approach? It would appear the latter plan has more chances of being more effective and easier to pull off. It's just a variant of script kiddies accumulating lower level zombie machines, it's just much bigger and uses various social engineering, which is nice because the preliminary work is not on the net for anyone to see indications it might be happening or being setup.

      Now the main question I would have, how many people need to be compromised for this to be a pretty viable plan, in how many places? And suppose your own hierarchy is factionalized, that "orders may be given" to create some serious havoc, this could be done in such a way as to both create the havoc, and also to make it appear someone else did it, at least in the initial stages of the attack. Shifting the blame is a common "spooky" type of thing to do. So, how many across a big nation like the US would it take, one hundred, a thousand, 50? I don't know but perhaps it's a low number depending how far up the routing/traffic food chain you can get to.
  • though I can't find a reference anywhere (It happened pre-web). Didn't someone in Japan advertise a global route to the entire Internet, bringing the whole net down?
  • I saw Batz speak at the Black Hat Briefings in 1999 about this. He described a host of attacks (no pun intended) including what he aptly termed a "Denial of Existence" attack, whereby an entire Autonomous System gets blackholed from its peers.

  • This is FUD (Score:2, Interesting)

    by slappy_guru ( 230776 )
    Policy Based Routing is applied by all ISP's to stop this. Basically if you are the Internet provider you only allow the customer's router or Peering ISP to update you with networks they are supposed to own. If you are running BGP and not doing this, then you are probably are the same person who has open SMTP relays...
  • BGP already has security capability in it with MD5 encryption, but many times that isn't enabled by network admins. Implementing it takes care of using spoofed IP addresses and makes it "a secure protocol". The only relevant point of the article is that there is implicit trust in the internet, there has to be.

    Someone can send me incorrect information that causes routing problems no matter whether the protocol is secure or not. You can encrypt, key it, whatever, but the data coming from it has to be correct. There's more chance of a mistake causing routing instability, I can think of more examples of that than the one in the article!

  • 130,000 (Score:3, Interesting)

    by zerocool^ ( 112121 ) on Monday March 03, 2003 @10:43AM (#5423846) Homepage Journal
    approximately 130,000 networks are currently using BGP.

    Hrm, imagine that... When I check my BGP tables, there are about... yeah, 116,000 routes.

    Of course, that is every network on the internet. Anywhere you need to go, you can go from your ISP router to the other person's ISP router via one of 116,000 routes.

  • Article is alarmist and misleading (Score:5, Informative)

    by iiioxx ( 610652 ) <iiioxx@gmail.com> on Monday March 03, 2003 @11:18AM (#5424074)
    I don't think this is as big a problem as the article lets on:

    1) BGP neighbor relationships are statically defined, permitting path information from specific autonomous systems advertised by specific peers.

    2) Any major ISP is going to be running stringent as-path filters on inbound updates, to prevent blatantly false path information from being accepted.

    3) BGP has internal controls that can be added to a config to specify preferred paths for outbound traffic, regardless of the inbound path preference information from a router's peers.

    4) Compromising a properly secured router is no simple feat. At that level, remote access is always restricted, passwords are always strong, terminal access to every device is always logged, and network monitoring is always employed. An attack on a core router is going to be detected rather quickly through either automated log analysis or network management alerts.

    All of that being said, if a router were compromised, ISP traffic is monitored in realtime. A sudden change in traffic will bring the immediate attention of an ISP's NOC, and the problem will either be corrected immediately, or the router will be taken offline, allowing traffic to fail over to another NAP until the problem can be solved. Barring a large-scale, coordinated attack (the logistics of which would be almost impossible to manage given the environment), the impact of such an attack would likely be minimal.


  • In the past I've managed peering with UUNet, Teleglobe, Level3, Concentric/XO, Genuity, Sprint, AT&T, and I currently manage a small AS that does provide transit for two peers.

    I'm not sure what they're getting at in this article - the ISPs that are small enough to have security problems are generally at the edge of the Tier 1 guys and they're filtered to death - I offer five prefixes to Sprint and that is all they'll accept - the same goes for the AT&T and UUNet connections I manage.

    I think the scenario of rogue network announcements could only happen between very large carriers - those who are so large (and disciplined) that they don't route filter between themselves.

Slashdot Top Deals

After a number of decimal places, nobody gives a damn.

Close