Mailing List Archive: NANOG: users

Prefix Hijack Tool Comaprision

Index | Next | Previous | View Threaded

surfer at mauigateway

Nov 13, 2008, 10:28 AM

Post #1 of 13 (684 views)
Permalink

Prefix Hijack Tool Comaprision

With this last hijack, we see the comparison between PHAS and BGPmon. Does anyone use other hijack tools who would be willing to compare to these two tools wrt time to alert, number of alerts, etc. during this event?

How do folks find the extent of the damage? Using BGPlay only or are their other good tools for assessing damage?

scott

hank at efes

Nov 13, 2008, 10:57 AM

Post #2 of 13 (642 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

At 10:28 AM 13-11-08 -0800, Scott Weeks wrote:

>With this last hijack, we see the comparison between PHAS and
>BGPmon. Does anyone use other hijack tools who would be willing to
>compare to these two tools wrt time to alert, number of alerts, etc.
>during this event?
>
>How do folks find the extent of the damage? Using BGPlay only or are
>their other good tools for assessing damage?
>
>scott

I use all 4 - BGPmon, RIPE, PHAS, and Watchmy.net.

BGPMon kicks ass on all of them. RIPE showed up 5-6 hours later. PHAS and
Watchmy were nowhere to be seen.

-Hank

todd at renesys

Nov 13, 2008, 11:32 AM

Post #3 of 13 (646 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

hank, all,

On Thu, Nov 13, 2008 at 08:57:35PM +0200, Hank Nussbacher wrote:

> I use all 4 - BGPmon, RIPE, PHAS, and Watchmy.net.
>
> BGPMon kicks ass on all of them. RIPE showed up 5-6 hours later. PHAS and
> Watchmy were nowhere to be seen.

is that a bug or a feature?

this was a non-event in a tiny corner of the internet. it's
interesting, but it's not operationally significant. i would not
consider the fact that PHAS and Watchmy didn't alert any particular
criticism of them.

but perhaps there was something else to which you were referring.

t.

--
_____________________________________________________________________
todd underwood +1 603 643 9300 x101
renesys corporation
todd[at]renesys.com http://www.renesys.com/blog

surfer at mauigateway

Nov 13, 2008, 11:41 AM

Post #4 of 13 (644 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

--- todd[at]renesys.com wrote:
From: Todd Underwood <todd[at]renesys.com>

interesting, but it's not operationally significant. i would not
consider the fact that PHAS and Watchmy didn't alert any particular
criticism of them.

but perhaps there was something else to which you were referring.
----------------------------------

I think he was just referring to and answering my question. I hope to see how these tools work in 'small' incidents as well as large-scale incidents. Knowing the tool's capabilities increases one's ability to assess the damage while troubleshooting.

scott

a.harrowell at gmail

Nov 13, 2008, 11:56 AM

Post #5 of 13 (646 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

It may be the North American NOG, but it's been said before that it functions as a GNOG, G for Global. I don't think Brazil is insignificant. I respect Todd's work greatly, but I think he's wrong on this point.

- original message -
Subject: Re: Prefix Hijack Tool Comaprision
From: "Scott Weeks" <surfer[at]mauigateway.com>
Date: 13/11/2008 7:42 pm

--- todd[at]renesys.com wrote:
From: Todd Underwood <todd[at]renesys.com>

interesting, but it's not operationally significant. i would not
consider the fact that PHAS and Watchmy didn't alert any particular
criticism of them.

but perhaps there was something else to which you were referring.
----------------------------------

I think he was just referring to and answering my question. I hope to see how these tools work in 'small' incidents as well as large-scale incidents. Knowing the tool's capabilities increases one's ability to assess the damage while troubleshooting.

scott

todd at renesys

Nov 13, 2008, 12:05 PM

Post #6 of 13 (645 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

alexander, all,

On Thu, Nov 13, 2008 at 07:56:26PM +0000, Alexander Harrowell wrote:
> It may be the North American NOG, but it's been said before that it
> functions as a GNOG, G for Global. I don't think Brazil is
> insignificant. I respect Todd's work greatly, but I think he's wrong
> on this point.

you misread me.

i did not say that brazil was insignificant. it's not. it has some of
the fastest growing internet in latin america.

i said that *this* hijacking took place in an insignificant corner of
the internet. i mean this AS-map wise rather than geographically.
this hijacking didn't even spread beyond one or two ASes, one of whom
just happened to be a RIPE RIS peer.

real hijackings leak into dozens or hundreds or thousands of ASNs.
they spread far and wide. that's why people carry them out, when they
do. this one was stopped in its tracks in a very small portion of one
corner of the AS graph.

as such, i don't count it as a hijacking or leak of any great
significance and wouldn't want to alert anyone about it. that's why i
recommend that prefix hijacking detection systems do thresholding of
peers to prevent a single, rogue, unrepresentative peer from reporting
a hijacking when none is really happening. others may have a
different approach, but without thresholding prefix alert systems can
be noisy and more trouble than they are worth.

sorry if it appears that i was denegrating .br . i was not.

t.

--
_____________________________________________________________________
todd underwood +1 603 643 9300 x101
renesys corporation
todd[at]renesys.com http://www.renesys.com/blog

a.harrowell at gmail

Nov 13, 2008, 12:27 PM

Post #7 of 13 (636 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay is great.

- original message -
Subject: Re: Prefix Hijack Tool Comaprision
From: Todd Underwood <todd[at]renesys.com>
Date: 13/11/2008 8:05 pm

alexander, all,

On Thu, Nov 13, 2008 at 07:56:26PM +0000, Alexander Harrowell wrote:
> It may be the North American NOG, but it's been said before that it
> functions as a GNOG, G for Global. I don't think Brazil is
> insignificant. I respect Todd's work greatly, but I think he's wrong
> on this point.

you misread me.

i did not say that brazil was insignificant. it's not. it has some of
the fastest growing internet in latin america.

i said that *this* hijacking took place in an insignificant corner of
the internet. i mean this AS-map wise rather than geographically.
this hijacking didn't even spread beyond one or two ASes, one of whom
just happened to be a RIPE RIS peer.

real hijackings leak into dozens or hundreds or thousands of ASNs.
they spread far and wide. that's why people carry them out, when they
do. this one was stopped in its tracks in a very small portion of one
corner of the AS graph.

as such, i don't count it as a hijacking or leak of any great
significance and wouldn't want to alert anyone about it. that's why i
recommend that prefix hijacking detection systems do thresholding of
peers to prevent a single, rogue, unrepresentative peer from reporting
a hijacking when none is really happening. others may have a
different approach, but without thresholding prefix alert systems can
be noisy and more trouble than they are worth.

sorry if it appears that i was denegrating .br . i was not.

t.

--
_____________________________________________________________________
todd underwood +1 603 643 9300 x101
renesys corporation
todd[at]renesys.com http://www.renesys.com/blog

jbates at brightok

Nov 13, 2008, 12:33 PM

Post #8 of 13 (640 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

Todd Underwood wrote:
> i said that *this* hijacking took place in an insignificant corner of
> the internet. i mean this AS-map wise rather than geographically.
> this hijacking didn't even spread beyond one or two ASes, one of whom
> just happened to be a RIPE RIS peer.
>

Yet for someone monitoring from their own perspective, what matters to
them is what their own AS is seeing. If a hijacking makes it to their
AS, they want to be concerned.

> real hijackings leak into dozens or hundreds or thousands of ASNs.
> they spread far and wide. that's why people carry them out, when they
> do. this one was stopped in its tracks in a very small portion of one
> corner of the AS graph.
>

Wasn't there a dns hijack not long ago that only had the scope of one
ISP (who just happened to be extremely large and carried a bunch of cell
phones)? Just because a hijack only covers a small portion of the net
doesn't make it any less effective. This is why we push to get as many
access controls as far out to the edge as possible. If it only effects
the person who tries it, then it has no bearing.

> as such, i don't count it as a hijacking or leak of any great
> significance and wouldn't want to alert anyone about it. that's why i
> recommend that prefix hijacking detection systems do thresholding of
> peers to prevent a single, rogue, unrepresentative peer from reporting
> a hijacking when none is really happening. others may have a
> different approach, but without thresholding prefix alert systems can
> be noisy and more trouble than they are worth.

Thresholds might be important, but different mileage, yada yada.

Jack

martin at airwire

Nov 13, 2008, 1:06 PM

Post #9 of 13 (636 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

Alexander Harrowell wrote:
> OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay is great.
>

It is not a flaw in RIPE RIS. One of the RIPE RIS servers was just
within the AS'es that where affected, so it will show up. What BGPplay
og BGPmon do with that data afterwards is an entire different story.

RIPE RIS just collects data from various viewpoints. It's the users,
that have to create the threshoulds or to decide how significant that
data is.

Kind regards,
Martin List-Petersen
Airwire, Galway, Eire

> - original message -
> Subject: Re: Prefix Hijack Tool Comaprision
> From: Todd Underwood <todd[at]renesys.com>
> Date: 13/11/2008 8:05 pm
>
> alexander, all,
>
> On Thu, Nov 13, 2008 at 07:56:26PM +0000, Alexander Harrowell wrote:
>
>> It may be the North American NOG, but it's been said before that it
>> functions as a GNOG, G for Global. I don't think Brazil is
>> insignificant. I respect Todd's work greatly, but I think he's wrong
>> on this point.
>>
>
> you misread me.
>
> i did not say that brazil was insignificant. it's not. it has some of
> the fastest growing internet in latin america.
>
> i said that *this* hijacking took place in an insignificant corner of
> the internet. i mean this AS-map wise rather than geographically.
> this hijacking didn't even spread beyond one or two ASes, one of whom
> just happened to be a RIPE RIS peer.
>
> real hijackings leak into dozens or hundreds or thousands of ASNs.
> they spread far and wide. that's why people carry them out, when they
> do. this one was stopped in its tracks in a very small portion of one
> corner of the AS graph.
>
> as such, i don't count it as a hijacking or leak of any great
> significance and wouldn't want to alert anyone about it. that's why i
> recommend that prefix hijacking detection systems do thresholding of
> peers to prevent a single, rogue, unrepresentative peer from reporting
> a hijacking when none is really happening. others may have a
> different approach, but without thresholding prefix alert systems can
> be noisy and more trouble than they are worth.
>
> sorry if it appears that i was denegrating .br . i was not.
>
> t.
>
>

--
Airwire - Ag Nascadh Pobal an Iarthar
http://www.airwire.ie
Phone: 091-865 968

danny at tcb

Nov 13, 2008, 1:09 PM

Post #10 of 13 (639 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

On Nov 13, 2008, at 1:05 PM, Todd Underwood wrote:
>
> as such, i don't count it as a hijacking or leak of any great
> significance and wouldn't want to alert anyone about it. that's why i
> recommend that prefix hijacking detection systems do thresholding of
> peers to prevent a single, rogue, unrepresentative peer from reporting
> a hijacking when none is really happening. others may have a
> different approach, but without thresholding prefix alert systems can
> be noisy and more trouble than they are worth.

While I agree that this incident didn't appear to much impact
anyone beyond CTBC and their customers (where we very clearly
impacted considerably), I would contend that ANY time anyone
asserts reachability of another ASNs address space the owner
of that space should be alerted.

IMO, if an actual intentional targeted attack were to be launched,
versus, say, the slew of accidental leaks we mostly see, then it
may very well be scoped to some insignificant corner of the Internet,
as close to the targets as possible - that's precisely what I'd do
if I were to launch such an attack....

Now, if the goal is denial of service or a leak, sure, it'll
likely propagate much wider - and be detected much quicker.

-danny

mohitlad at gmail

Nov 13, 2008, 1:31 PM

Post #11 of 13 (639 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

Sorry for the subject line in the previous message :-)

Since this thread started as comparison of the tools, there are two issues
1. Which BGP feeds the tools use? RIPE, RouteViews, other private feeds.
2. How they decide what to send and what not to send?

In this case, BGPMon detected an event that was not detected by others, and
there might be other hijacks that were local in scope where PHAS or Watchmy
might catch something that BGPMon does not. But that does not make one tool
better than the other, unless this pattern is repeated.
Eventually all tools will catch up with each other on the feeds (or so is
the hope), so the difference will then lie in "the decision of what to send
and what to drop".

Mohit

Date: Thu, 13 Nov 2008 20:27:32 +0000
> From: "Alexander Harrowell" <a.harrowell[at]gmail.com>
> Subject: Re: Prefix Hijack Tool Comaprision
> To: Todd Underwood <todd[at]renesys.com>
> Cc: nanog[at]nanog.org
>
> OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay is great.
>
> - original message -
> Subject: Re: Prefix Hijack Tool Comaprision
> From: Todd Underwood <todd[at]renesys.com>
> Date: 13/11/2008 8:05 pm
>
> alexander, all,
>
> On Thu, Nov 13, 2008 at 07:56:26PM +0000, Alexander Harrowell wrote:
> > It may be the North American NOG, but it's been said before that it
> > functions as a GNOG, G for Global. I don't think Brazil is
> > insignificant. I respect Todd's work greatly, but I think he's wrong
> > on this point.
>
> you misread me.
>
> i did not say that brazil was insignificant. it's not. it has some of
> the fastest growing internet in latin america.
>
> i said that *this* hijacking took place in an insignificant corner of
> the internet. i mean this AS-map wise rather than geographically.
> this hijacking didn't even spread beyond one or two ASes, one of whom
> just happened to be a RIPE RIS peer.
>
> real hijackings leak into dozens or hundreds or thousands of ASNs.
> they spread far and wide. that's why people carry them out, when they
> do. this one was stopped in its tracks in a very small portion of one
> corner of the AS graph.
>
> as such, i don't count it as a hijacking or leak of any great
> significance and wouldn't want to alert anyone about it. that's why i
> recommend that prefix hijacking detection systems do thresholding of
> peers to prevent a single, rogue, unrepresentative peer from reporting
> a hijacking when none is really happening. others may have a
> different approach, but without thresholding prefix alert systems can
> be noisy and more trouble than they are worth.
>
> sorry if it appears that i was denegrating .br . i was not.
>
> t.
>
> --
> _____________________________________________________________________
> todd underwood +1 603 643 9300 x101
> renesys corporation
> todd[at]renesys.com http://www.renesys.com/blog
>
>
>
>

karlinjf at cs

Nov 13, 2008, 4:21 PM

Post #12 of 13 (629 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

Agreed. The Internet Alert Registry ( http://iar.cs.unm.edu ) has switched
from monitoring RIPE and Routeviews to direct connections with our PGBGP
enabled router. This means the IAR has less data, but immediate response
times. Some of the prefixes were detected as hijacked by the IAR but most
of the hijacked prefixes never reached the IAR's neighbors. If anyone would
like to add their feed to the IAR we would appreciate it!

Josh

On Thu, Nov 13, 2008 at 2:31 PM, Mohit Lad <mohitlad[at]gmail.com> wrote:

> Sorry for the subject line in the previous message :-)
>
> Since this thread started as comparison of the tools, there are two issues
> 1. Which BGP feeds the tools use? RIPE, RouteViews, other private feeds.
> 2. How they decide what to send and what not to send?
>
> In this case, BGPMon detected an event that was not detected by others, and
> there might be other hijacks that were local in scope where PHAS or Watchmy
> might catch something that BGPMon does not. But that does not make one tool
> better than the other, unless this pattern is repeated.
> Eventually all tools will catch up with each other on the feeds (or so is
> the hope), so the difference will then lie in "the decision of what to send
> and what to drop".
>
> Mohit
>
> Date: Thu, 13 Nov 2008 20:27:32 +0000
> > From: "Alexander Harrowell" <a.harrowell[at]gmail.com>
> > Subject: Re: Prefix Hijack Tool Comaprision
> > To: Todd Underwood <todd[at]renesys.com>
> > Cc: nanog[at]nanog.org
> >
> > OK. This seems to be a flaw in RIPE RIS, a pity because BGPlay is great.
> >
> > - original message -
> > Subject: Re: Prefix Hijack Tool Comaprision
> > From: Todd Underwood <todd[at]renesys.com>
> > Date: 13/11/2008 8:05 pm
> >
> > alexander, all,
> >
> > On Thu, Nov 13, 2008 at 07:56:26PM +0000, Alexander Harrowell wrote:
> > > It may be the North American NOG, but it's been said before that it
> > > functions as a GNOG, G for Global. I don't think Brazil is
> > > insignificant. I respect Todd's work greatly, but I think he's wrong
> > > on this point.
> >
> > you misread me.
> >
> > i did not say that brazil was insignificant. it's not. it has some of
> > the fastest growing internet in latin america.
> >
> > i said that *this* hijacking took place in an insignificant corner of
> > the internet. i mean this AS-map wise rather than geographically.
> > this hijacking didn't even spread beyond one or two ASes, one of whom
> > just happened to be a RIPE RIS peer.
> >
> > real hijackings leak into dozens or hundreds or thousands of ASNs.
> > they spread far and wide. that's why people carry them out, when they
> > do. this one was stopped in its tracks in a very small portion of one
> > corner of the AS graph.
> >
> > as such, i don't count it as a hijacking or leak of any great
> > significance and wouldn't want to alert anyone about it. that's why i
> > recommend that prefix hijacking detection systems do thresholding of
> > peers to prevent a single, rogue, unrepresentative peer from reporting
> > a hijacking when none is really happening. others may have a
> > different approach, but without thresholding prefix alert systems can
> > be noisy and more trouble than they are worth.
> >
> > sorry if it appears that i was denegrating .br . i was not.
> >
> > t.
> >
> > --
> > _____________________________________________________________________
> > todd underwood +1 603 643 9300 x101
> > renesys corporation
> > todd[at]renesys.com
> http://www.renesys.com/blog
> >
> >
> >
> >
>

andree+nanog at toonk

Nov 17, 2008, 8:31 AM

Post #13 of 13 (585 views)
Permalink

Re: Prefix Hijack Tool Comaprision [In reply to]

Hi all,

.-- My secret spy satellite informs me that at Thu, 13 Nov 2008, Todd Underwood wrote:

> that's why i recommend that prefix hijacking detection systems do thresholding of
> peers to prevent a single, rogue, unrepresentative peer from reporting
> a hijacking when none is really happening. others may have a
> different approach, but without thresholding prefix alert systems can
> be noisy and more trouble than they are worth.

For those who like to use a peer threshold, BGPmon.net now has minimum peer
threshold support.
For more information see: http://bgpmon.net/blog/?p=88

Cheers,
Andree

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com