Projet

Général

Profil

BGP » Historique » Version 191

Matthieu Herrb, 17/10/2018 14:39
pres RIPE77

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 175 Laurent GUERBY
h2. Liens
6 175 Laurent GUERBY
7 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
8 1 Laurent GUERBY
9 1 Laurent GUERBY
http://bird.network.cz/
10 1 Laurent GUERBY
11 184 Laurent GUERBY
simulation de l'internet
12 184 Laurent GUERBY
https://www.nsec.io/
13 184 Laurent GUERBY
https://github.com/nsec/the-internet
14 184 Laurent GUERBY
15 190 Laurent GUERBY
https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf
16 190 Laurent GUERBY
17 185 Laurent GUERBY
https://www.franceix.net/fr/technical/blackholing/
18 185 Laurent GUERBY
BLACKHOLE Community https://tools.ietf.org/html/rfc7999
19 185 Laurent GUERBY
20 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
21 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
22 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
23 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
24 65 Laurent GUERBY
https://stat.ripe.net/widget/announced-prefixes
25 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
26 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
27 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
28 52 Laurent GUERBY
http://tools.ietf.org/html/draft-lapukhov-bgp-routing-large-dc-02
29 14 Laurent GUERBY
30 43 Laurent GUERBY
http://inside.godaddy.com/inside-story-happened-godaddy-com-sept-10-2012/
31 43 Laurent GUERBY
32 67 Laurent GUERBY
liste des communautés des opérateurs http://onesc.net/communities/ via http://www.bortzmeyer.org/7153.html
33 66 Laurent GUERBY
34 55 Laurent GUERBY
http://tools.ietf.org/html/rfc4271#section-9.1 BGP route decision process
35 55 Laurent GUERBY
36 29 Laurent GUERBY
http://www.ipbcop.org/
37 29 Laurent GUERBY
IP Best Current Operational Practices Documented best practices for Engineers by Engineers
38 29 Laurent GUERBY
39 30 Laurent GUERBY
BGP best practices ANSSI
40 30 Laurent GUERBY
https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Article-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf_2.pdf
41 62 Laurent GUERBY
http://www.ssi.gouv.fr/fr/bonnes-pratiques/recommandations-et-guides/securite-des-reseaux/le-guide-des-bonnes-pratiques-de-configuration-de-bgp.html
42 64 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-opsec-bgp-security-01
43 179 Laurent GUERBY
http://www.ssi.gouv.fr/uploads/2014/10/rapport_observatoire_2015.pdf
44 30 Laurent GUERBY
45 37 Laurent GUERBY
https://www.ams-ix.net/technical/specifications-descriptions/ams-ix-route-servers
46 37 Laurent GUERBY
47 39 Laurent GUERBY
these LAAS BGP http://www.laas.fr/1-31360-Detail-Soutenance-de-these.php?id=600
48 41 Laurent GUERBY
http://www.laas.fr/1-31706-Publications.php?author=7738
49 1 Laurent GUERBY
http://www.net.t-labs.tu-berlin.de/papers/OMUPMO-OOSICP-11.pdf
50 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/60/53/83/PDF/dVirt-virtual_platform.pdf
51 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/48/70/74/PDF/Poster_SIGCOMM2010_philippe.pdf
52 40 Laurent GUERBY
53 44 Laurent GUERBY
Le monde sur BGP http://reseaux.blog.lemonde.fr/2012/11/04/routage-enjeu-cyberstrategie/
54 44 Laurent GUERBY
55 45 Laurent GUERBY
coupure free wanadoo http://www.journaldunet.com/solutions/0301/030122_freeft.shtml
56 45 Laurent GUERBY
57 46 Laurent GUERBY
tsunami Japon 2011 et BGP : http://archive.psg.com/111206.conext-quake.pdf
58 46 Laurent GUERBY
59 47 Laurent GUERBY
Session is up on telnet:route-views.routeviews.org username rviews
60 47 Laurent GUERBY
61 48 Laurent GUERBY
BGP book http://www.bortzmeyer.org/files/bgp.html
62 48 Laurent GUERBY
63 49 Laurent GUERBY
Cyclops is able to detect several forms of route hijack attacks http://cyclops.cs.ucla.edu/
64 50 Laurent GUERBY
BGPmon monitors the routing of your prefixes and alerts you in case of an 'interesting' path chang http://www.bgpmon.net/
65 49 Laurent GUERBY
66 53 Laurent GUERBY
http://jointtransit.nl/prices.html
67 53 Laurent GUERBY
68 54 Laurent GUERBY
http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho
69 54 Laurent GUERBY
70 51 Laurent GUERBY
* taille table de routage http://bgp.potaroo.net/
71 1 Laurent GUERBY
72 65 Laurent GUERBY
* BGP	in	2011	 Geoff	Huston	 APNIC http://iepg.org/2011-11-ietf82/2011-11-13-bgp2011.pdf
73 56 Laurent GUERBY
74 57 Laurent GUERBY
* http://pages.cs.wisc.edu/~plonka/netgear-sntp/
75 57 Laurent GUERBY
76 58 Laurent GUERBY
* http://www.afnic.fr/fr/l-afnic-en-bref/actualites/actualites-generales/7114/show/l-observatoire-sur-la-resilience-de-l-internet-francais-publie-son-rapport-2012.html
77 58 Laurent GUERBY
78 59 Laurent GUERBY
* http://www.ris.ripe.net/dashboard/2a01:6600:8000::/40
79 59 Laurent GUERBY
80 60 Laurent GUERBY
* http://www.bortzmeyer.org/6996.html
81 60 Laurent GUERBY
** RFC 6996 : Autonomous System (AS) Reservation for Private Use
82 60 Laurent GUERBY
** http://www.iana.org/assignments/as-numbers
83 60 Laurent GUERBY
84 61 Laurent GUERBY
* Look for TRACEROUTE by SRCGUARDIAN in the Play Store.   It needs network access only...  Doesn't do TCP but does ICMP and UDP traceroutes and displays ASN as well ...
85 61 Laurent GUERBY
86 63 Laurent GUERBY
* http://www.team-cymru.org/Services/Bogons/bgp.html
87 63 Laurent GUERBY
** http://www.team-cymru.org/Services/Bogons/bgp-examples.html#bird-full
88 175 Laurent GUERBY
89 175 Laurent GUERBY
* 3D looking glass  http://as2914.net/#/
90 63 Laurent GUERBY
91 177 Laurent GUERBY
* https://labs.ripe.net/Members/emileaben/has-the-routability-of-longer-than-24-prefixes-changed
92 177 Laurent GUERBY
93 183 Laurent GUERBY
* https://github.com/pavel-odintsov/fastnetmon
94 183 Laurent GUERBY
** FastNetMon - A high performance DoS/DDoS load analyzer built on top of multiple packet capture engines (NetFlow, IPFIX, sFLOW, SnabbSwitch, netmap, PF_RING, PCAP).
95 183 Laurent GUERBY
** What can we do? We can detect hosts in our networks sending or receiving large volumes of packets/bytes/flows per second. We can call an external script to notify you, switch off a server, or blackhole the client.
96 183 Laurent GUERBY
97 186 Laurent GUERBY
* https://www.redpill-linpro.com/sysadvent/2016/12/09/slimming-routing-table.html
98 186 Laurent GUERBY
99 187 Matthieu Herrb
* http://www.bortzmeyer.org/1997.html sur les communautés BGP
100 187 Matthieu Herrb
101 188 Laurent GUERBY
* https://radar.qrator.net/as-rating#connectivity/1
102 188 Laurent GUERBY
** https://radar.qrator.net/as197422
103 188 Laurent GUERBY
104 191 Matthieu Herrb
* Robust Routing Policy Architecture
105 191 Matthieu Herrb
** https://ripe77.ripe.net/presentations/59-RIPE77_Snijders_Routing_Policy_Architecture.pdf
106 191 Matthieu Herrb
107 182 Laurent GUERBY
h2. Baker-s Dozen
108 182 Laurent GUERBY
109 181 Laurent GUERBY
* Baker's Dozen BGP transit players
110 181 Laurent GUERBY
** http://research.dyn.com/2008/12/winners-and-losers-for-2008/
111 181 Laurent GUERBY
** http://research.dyn.com/2009/12/a-bakers-dozen-in-2009/
112 181 Laurent GUERBY
** http://research.dyn.com/2011/01/a-bakers-dozen-2010-edition/
113 181 Laurent GUERBY
** http://research.dyn.com/2012/02/a-bakers-dozen-2011-edition/
114 181 Laurent GUERBY
** http://research.dyn.com/2012/02/a-bakers-dozen-2012-edition/
115 181 Laurent GUERBY
** http://research.dyn.com/2012/02/a-bakers-dozen-2013-edition/
116 181 Laurent GUERBY
** http://research.dyn.com/2012/02/a-bakers-dozen-2014-edition/
117 181 Laurent GUERBY
** http://research.dyn.com/2016/04/a-bakers-dozen-2015-edition/
118 182 Laurent GUERBY
*** https://cdn.vpls.com/wp-content/uploads/WP033-Bakers-Dozen-2015.pdf
119 189 Laurent GUERBY
 
120 189 Laurent GUERBY
* https://www.princeton.edu/~pmittal/publications/bgp-tls-hotpets17
121 189 Laurent GUERBY
** Using BGP to Acquire Bogus TLS Certificates
122 189 Laurent GUERBY
123 180 Laurent GUERBY
124 171 Laurent GUERBY
h1. Bird
125 171 Laurent GUERBY
126 171 Laurent GUERBY
h2. Link local IPv6 static route
127 171 Laurent GUERBY
128 171 Laurent GUERBY
<pre>
129 171 Laurent GUERBY
    protocol direct {
130 171 Laurent GUERBY
      interface "eth0";
131 171 Laurent GUERBY
    }
132 171 Laurent GUERBY
133 171 Laurent GUERBY
    protocol static {
134 171 Laurent GUERBY
      route 2001:db8::/32 via fe80::1%eth0;
135 171 Laurent GUERBY
    }
136 171 Laurent GUERBY
</pre>
137 171 Laurent GUERBY
138 172 Laurent GUERBY
h2. Gitoyen BIRD config
139 172 Laurent GUERBY
140 172 Laurent GUERBY
https://code.ffdn.org/gitoyen/bird-config/
141 171 Laurent GUERBY
142 176 Laurent GUERBY
Et autres outils dont le blackholing automatique : https://code.ffdn.org/org/gitoyen
143 176 Laurent GUERBY
144 173 Laurent GUERBY
h2. Misc BIRD Links
145 173 Laurent GUERBY
146 173 Laurent GUERBY
* zeromq integration https://github.com/samrussell/bird/tree/zmqintegration
147 174 Laurent GUERBY
* https://www.netdev01.org/docs/prabhu-linux_ipv4_ipv6_inconsistencies_talk_slides.pdf
148 173 Laurent GUERBY
149 178 Baptiste Jonglez
h1. mrtdump
150 178 Baptiste Jonglez
151 178 Baptiste Jonglez
mrtdump est un format standard pour représenter et stocker des données BGP (table de routage, messages BGP) : https://tools.ietf.org/html/rfc6396
152 178 Baptiste Jonglez
153 178 Baptiste Jonglez
h2. Dump mrtdump avec Bird
154 178 Baptiste Jonglez
155 178 Baptiste Jonglez
h3. Dump de tous les messages BGP échangés avec les pairs
156 178 Baptiste Jonglez
157 178 Baptiste Jonglez
<pre>
158 178 Baptiste Jonglez
mrtdump "/tmp/mrtdump-messages";
159 178 Baptiste Jonglez
mrtdump protocols {messages};
160 178 Baptiste Jonglez
</pre>
161 178 Baptiste Jonglez
162 178 Baptiste Jonglez
Cf. doc bird : http://bird.network.cz/?get_doc&f=bird-3.html#ss3.2
163 178 Baptiste Jonglez
164 178 Baptiste Jonglez
Pour "rotate" le fichier de dump, changer le nom du fichier dans la configuration bird et faire `birdc configure`.
165 178 Baptiste Jonglez
166 178 Baptiste Jonglez
h3. Dump de la table de routage BGP
167 178 Baptiste Jonglez
168 178 Baptiste Jonglez
Ce n'est pas encore possible mais en développement dans Bird, cf. branche *mrtdump* upstream.
169 178 Baptiste Jonglez
170 178 Baptiste Jonglez
Doc : https://gitlab.labs.nic.cz/labs/bird/commit/11fabd2d6b8bc3d6ca86acd3b62fe4deeb4b91b7
171 178 Baptiste Jonglez
172 178 Baptiste Jonglez
h2. Sources de données mrtdump publiques
173 178 Baptiste Jonglez
174 178 Baptiste Jonglez
* RIS (Routing Information Service) :
175 178 Baptiste Jonglez
176 178 Baptiste Jonglez
  * routes BGP collectées par le RIPE depuis plusieurs points d'échanges (16 collecteurs en tout)
177 178 Baptiste Jonglez
  * données collectées et archivées depuis 2001
178 178 Baptiste Jonglez
  * https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/routing-information-service-ris
179 178 Baptiste Jonglez
  * données en libre accès https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/ris-raw-data
180 178 Baptiste Jonglez
181 178 Baptiste Jonglez
* Routeviews :
182 178 Baptiste Jonglez
183 178 Baptiste Jonglez
  * même idée, mais moins centré sur l'Europe (projet mené par des américains)
184 178 Baptiste Jonglez
  * http://www.routeviews.org/
185 178 Baptiste Jonglez
  * données en libre accès ftp://archive.routeviews.org/
186 178 Baptiste Jonglez
187 178 Baptiste Jonglez
h2. Exploitation des données mrtdump
188 178 Baptiste Jonglez
189 178 Baptiste Jonglez
* outil historique : *bgpdump* https://bitbucket.org/ripencc/bgpdump/wiki/Home
190 178 Baptiste Jonglez
* plus récent : *bgpstream* https://bgpstream.caida.org/  https://github.com/CAIDA/bgpstream https://pypi.python.org/pypi/pybgpstream
191 178 Baptiste Jonglez
192 178 Baptiste Jonglez
bgpstream est plutôt fait pour récupérer automatiquement les données de RIS et Routeviews (d'ailleurs parfois ça ne marche pas super bien...).  C'est aussi possible de lire des fichiers mrtdump locaux, par exemple avec les bindings python :
193 178 Baptiste Jonglez
194 178 Baptiste Jonglez
<pre>
195 178 Baptiste Jonglez
from _pybgpstream import BGPStream, BGPRecord, BGPElem
196 178 Baptiste Jonglez
record = BGPRecord()
197 178 Baptiste Jonglez
stream = BGPStream()
198 178 Baptiste Jonglez
stream.set_data_interface("singlefile")
199 178 Baptiste Jonglez
stream.set_data_interface_option("singlefile", "rib-file", myfilename)
200 178 Baptiste Jonglez
# Add additional filters here
201 178 Baptiste Jonglez
stream.start()
202 178 Baptiste Jonglez
# etc (cf. tutorial bgpstream)
203 178 Baptiste Jonglez
</pre>
204 178 Baptiste Jonglez
205 178 Baptiste Jonglez
206 38 Laurent GUERBY
h1. TouIX et GIX
207 38 Laurent GUERBY
208 38 Laurent GUERBY
http://touix.net
209 38 Laurent GUERBY
http://wikilulu.net/doku.php?id=articles:gix-howto
210 38 Laurent GUERBY
211 3 Laurent GUERBY
h1. Evolutions de la conf BGP
212 3 Laurent GUERBY
213 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
214 3 Laurent GUERBY
215 5 Laurent GUERBY
TODO: 
216 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
217 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
218 5 Laurent GUERBY
* Atelier ?
219 7 Laurent GUERBY
** Laurent GUERBY
220 9 Raphaël Durand
** Solarus
221 10 Raphaël Durand
** Ajouter son nom...
222 4 Laurent GUERBY
223 13 Laurent GUERBY
Alternative a MP BGP
224 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
225 13 Laurent GUERBY
226 31 Laurent GUERBY
Add Path
227 31 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-add-paths-07
228 31 Laurent GUERBY
support in bird ? http://marc.info/?l=bird-users&m=134409996129466&w=2
229 31 Laurent GUERBY
230 2 Laurent GUERBY
h1. Liens
231 2 Laurent GUERBY
232 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
233 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
234 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
235 19 Laurent GUERBY
* bonnes pratiques incidents BGP
236 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
237 35 Laurent GUERBY
* test ping plus UDP http://www.broadband-forum.org/technical/download/TR-143.pdf
238 2 Laurent GUERBY
239 1 Laurent GUERBY
h1. Configuration Toulouse
240 1 Laurent GUERBY
241 1 Laurent GUERBY
<pre>
242 1 Laurent GUERBY
router id 91.224.148.2;
243 1 Laurent GUERBY
define myas = 197422;
244 1 Laurent GUERBY
245 1 Laurent GUERBY
246 1 Laurent GUERBY
protocol device {
247 1 Laurent GUERBY
	scan time 10;
248 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
249 1 Laurent GUERBY
}
250 1 Laurent GUERBY
251 1 Laurent GUERBY
protocol static static_bgp {
252 1 Laurent GUERBY
	import all;
253 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
254 1 Laurent GUERBY
}
255 1 Laurent GUERBY
256 1 Laurent GUERBY
257 1 Laurent GUERBY
protocol kernel{
258 1 Laurent GUERBY
	import all;
259 1 Laurent GUERBY
	export all;
260 1 Laurent GUERBY
}
261 1 Laurent GUERBY
262 1 Laurent GUERBY
263 1 Laurent GUERBY
function avoid_martians()
264 1 Laurent GUERBY
prefix set martians;
265 1 Laurent GUERBY
{
266 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
267 1 Laurent GUERBY
268 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
269 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
270 1 Laurent GUERBY
271 1 Laurent GUERBY
  # Avoid too short and too long prefixes
272 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
273 1 Laurent GUERBY
274 1 Laurent GUERBY
  # Avoid RFC1918 networks
275 1 Laurent GUERBY
  if net ~ martians then return false;
276 1 Laurent GUERBY
  return true;
277 1 Laurent GUERBY
}
278 1 Laurent GUERBY
279 1 Laurent GUERBY
filter bgp_OUT {
280 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
281 1 Laurent GUERBY
	else reject;
282 1 Laurent GUERBY
}
283 1 Laurent GUERBY
284 1 Laurent GUERBY
285 1 Laurent GUERBY
protocol bgp TOUIX {
286 1 Laurent GUERBY
        local as myas;
287 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
288 1 Laurent GUERBY
        preference 200;
289 1 Laurent GUERBY
        import where avoid_martians();
290 1 Laurent GUERBY
        export filter bgp_OUT;
291 1 Laurent GUERBY
}
292 1 Laurent GUERBY
293 1 Laurent GUERBY
protocol bgp JAGUAR {
294 1 Laurent GUERBY
	 local as myas;
295 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
296 1 Laurent GUERBY
	 preference 50;
297 1 Laurent GUERBY
         import where avoid_martians();
298 1 Laurent GUERBY
         export filter bgp_OUT;
299 1 Laurent GUERBY
}
300 1 Laurent GUERBY
301 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
302 1 Laurent GUERBY
	local as myas;
303 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
304 1 Laurent GUERBY
	preference 100;
305 1 Laurent GUERBY
	import where avoid_martians();
306 1 Laurent GUERBY
	export all;
307 1 Laurent GUERBY
}
308 1 Laurent GUERBY
</pre>
309 20 Laurent GUERBY
310 33 Laurent GUERBY
h1. IRR
311 33 Laurent GUERBY
312 33 Laurent GUERBY
* From nanog:
313 33 Laurent GUERBY
http://www.clarksys.com/blog/2009/09/02/using-irr-with-level3/
314 33 Laurent GUERBY
whois -h filtergen.level3.net "RIPE::YOUR-AS-SET  -searchpath=RIPE;ARIN;RADB -recurseok -warnonly"
315 33 Laurent GUERBY
316 20 Laurent GUERBY
h1. Blackholing
317 20 Laurent GUERBY
318 160 Laurent GUERBY
h2. DECIX
319 160 Laurent GUERBY
320 160 Laurent GUERBY
http://de-cix.net/products-services/de-cix-frankfurt/blackholing/
321 160 Laurent GUERBY
322 24 Laurent GUERBY
h2. Attaques
323 24 Laurent GUERBY
324 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
325 36 Laurent GUERBY
* http://blog.cloudflare.com/65gbps-ddos-no-problem
326 24 Laurent GUERBY
327 1 Laurent GUERBY
h2. URPF
328 34 Laurent GUERBY
329 65 Laurent GUERBY
blacklister une/plusieures sources est relativement complexe à mettre en place sur une petite infrastructure car nécessite la mise en place de l'URPF (Unicast Reverse Path Forwarding).
330 34 Laurent GUERBY
331 34 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/ipv6_rtbh.html
332 34 Laurent GUERBY
333 20 Laurent GUERBY
h2. RFC3882 
334 1 Laurent GUERBY
335 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
336 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
337 1 Laurent GUERBY
338 22 Laurent GUERBY
* doc CISCO
339 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
340 22 Laurent GUERBY
341 28 Laurent GUERBY
h2. RFC1997
342 28 Laurent GUERBY
343 28 Laurent GUERBY
* http://www.ietf.org/rfc/rfc1997.txt
344 28 Laurent GUERBY
BGP Communities Attribute
345 28 Laurent GUERBY
346 28 Laurent GUERBY
* doc CISCO
347 28 Laurent GUERBY
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_6-2/bgp_communities.html
348 28 Laurent GUERBY
349 22 Laurent GUERBY
h2. BIRD
350 22 Laurent GUERBY
351 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
352 1 Laurent GUERBY
353 24 Laurent GUERBY
h2. Absolight
354 24 Laurent GUERBY
355 65 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
356 65 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
357 24 Laurent GUERBY
358 22 Laurent GUERBY
h2. GIXE
359 1 Laurent GUERBY
360 65 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
361 65 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
362 1 Laurent GUERBY
363 1 Laurent GUERBY
h2. Jaguar 
364 22 Laurent GUERBY
365 24 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
366 65 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
367 65 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
368 22 Laurent GUERBY
369 27 Laurent GUERBY
h2. Gitoyen
370 27 Laurent GUERBY
371 65 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
372 28 Laurent GUERBY
* Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
373 65 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
374 28 Laurent GUERBY
* Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
375 32 Laurent GUERBY
* https://pad.ilico.org/p/cleanup-bgp-gitoyen
376 22 Laurent GUERBY
377 22 Laurent GUERBY
h2. France-IX
378 22 Laurent GUERBY
379 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
380 26 Laurent GUERBY
* TODO tester
381 22 Laurent GUERBY
382 22 Laurent GUERBY
h2. Equinix-IX
383 1 Laurent GUERBY
384 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
385 26 Laurent GUERBY
* TODO tester
386 22 Laurent GUERBY
387 1 Laurent GUERBY
h2. TouIX
388 22 Laurent GUERBY
389 26 Laurent GUERBY
* demande acces switch et route server 20120702
390 22 Laurent GUERBY
* TODO
391 1 Laurent GUERBY
392 1 Laurent GUERBY
h2. Hurricane Electric
393 1 Laurent GUERBY
394 26 Laurent GUERBY
* http://www.he.net/adm/
395 1 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
396 1 Laurent GUERBY
* TODO tester
397 28 Laurent GUERBY
398 28 Laurent GUERBY
h2. Sfinx
399 28 Laurent GUERBY
400 28 Laurent GUERBY
* http://www.renater.fr/route-servers-bgp?lang=fr
401 28 Laurent GUERBY
* whois  AS1304 =>
402 28 Laurent GUERBY
remarks:        1304:65281 = Apply NO-EXPORT community
403 28 Laurent GUERBY
remarks:        1304:65282 = Apply NO-ADVERTISE community
404 161 Laurent GUERBY
405 161 Laurent GUERBY
h2. Cogent
406 161 Laurent GUERBY
407 166 Laurent GUERBY
h3. Docs
408 166 Laurent GUERBY
409 161 Laurent GUERBY
* http://www.cogentco.com/files/docs/customer_service/guide/global_cogent_customer_user_guide.pdf
410 162 Laurent GUERBY
** communautés page 21-22
411 169 Laurent GUERBY
* http://www.onesc.net/communities/as174/
412 170 Laurent GUERBY
* https://www.nanog.org/mailinglist/mailarchives/old_archive/2005-03/msg00465.html
413 166 Laurent GUERBY
* https://www.nanog.org/meetings/nanog45/presentations/Sunday/RAS_traceroute_N45.pdf
414 1 Laurent GUERBY
415 162 Laurent GUERBY
France / Benelux:
416 162 Laurent GUERBY
+33 1 49 03 1818 (Hotline)
417 162 Laurent GUERBY
+33 1 49 03 1803 (fax)
418 162 Laurent GUERBY
fr-support@cogentco.com (maintenance and repair)
419 162 Laurent GUERBY
bnl-support@cogentco.com (maintenance and repair))
420 162 Laurent GUERBY
billingeu@cogentco.com (billing, customer care)
421 162 Laurent GUERBY
All Customers in Europe can also contact the European Cogent Customer Support team
422 162 Laurent GUERBY
using the generic email address for Europe: eu-support@cogentco.com 
423 162 Laurent GUERBY
424 164 Laurent GUERBY
Livré comme demandé sur rocade optique Fullsave :
425 164 Laurent GUERBY
Livré sur TLS01.CB.KD-05/A.To02.03&04 (tiroir optique N°2, fibre 03&04).
426 165 Laurent GUERBY
Cogent physical port te0/0/2/3-rcr11.tls01
427 164 Laurent GUERBY
428 163 Laurent GUERBY
Order ID/Service ID: 1-166108500
429 163 Laurent GUERBY
Service Type: EU_L3_ON_10GE_BURST
430 163 Laurent GUERBY
Commitment: 1000.0 MBps
431 163 Laurent GUERBY
Service Address: 125 bis ch du Sang de Serp
432 163 Laurent GUERBY
livraison dans baie Fullsave / salle LAP Te0/0/2/3 rcr01.tls01 -- > TLS01.CB.KD-05/A.To02.03&04
433 163 Laurent GUERBY
Toulouse, FR France 31000
434 163 Laurent GUERBY
Your service acceptance date is 27-May-2014 and your billing start date is 27-May-2014
435 163 Laurent GUERBY
436 163 Laurent GUERBY
Order ID/Service ID: 1-166108524
437 163 Laurent GUERBY
Service Type: EU_L3_ON_IPV6DSTACK_FLAT
438 163 Laurent GUERBY
Commitment: 0.0 MBps
439 163 Laurent GUERBY
Service Address: 125 bis ch du Sang de Serp
440 163 Laurent GUERBY
IPv6s fort port order 1-166108500
441 163 Laurent GUERBY
Toulouse, FR France 31000
442 163 Laurent GUERBY
Your service acceptance date is 27-May-2014 and your billing start date is 27-May-2014
443 163 Laurent GUERBY
444 163 Laurent GUERBY
Order ID/Service ID: 1-166108512
445 163 Laurent GUERBY
Service Type: EU_L0_ON_XCFIBER_FLAT
446 163 Laurent GUERBY
Commitment: 0.0 MBps
447 163 Laurent GUERBY
Service Address: 125 bis ch du Sang de Serp
448 163 Laurent GUERBY
Te0/0/2/3 rcr01.tls01 -- > TLS01.CB.KD-05/A.To02.03&04 port order 1-166108500
449 163 Laurent GUERBY
Toulouse, FR France 31000
450 163 Laurent GUERBY
Your service acceptance date is 27-May-2014 and your billing start date is 27-May-2014
451 162 Laurent GUERBY
452 162 Laurent GUERBY
h3. Config initiale BGP Cogent
453 162 Laurent GUERBY
454 161 Laurent GUERBY
<pre>
455 161 Laurent GUERBY
root@h7:~# cat /etc/bird/bird.conf
456 161 Laurent GUERBY
router id 149.11.58.74;
457 161 Laurent GUERBY
458 161 Laurent GUERBY
define myas = 197422;
459 161 Laurent GUERBY
460 161 Laurent GUERBY
timeformat base     iso long;
461 161 Laurent GUERBY
timeformat log      iso long;
462 161 Laurent GUERBY
timeformat protocol iso long;
463 161 Laurent GUERBY
timeformat route    iso long;
464 161 Laurent GUERBY
465 161 Laurent GUERBY
log "/var/log/bird/bird-20140527.log" all;
466 161 Laurent GUERBY
467 161 Laurent GUERBY
debug commands 2;
468 161 Laurent GUERBY
469 161 Laurent GUERBY
debug protocols { states, events };
470 161 Laurent GUERBY
471 161 Laurent GUERBY
protocol device {
472 161 Laurent GUERBY
        scan time 10;
473 161 Laurent GUERBY
}
474 161 Laurent GUERBY
475 161 Laurent GUERBY
protocol kernel {
476 161 Laurent GUERBY
        import all;
477 161 Laurent GUERBY
        export all;
478 161 Laurent GUERBY
        learn;
479 161 Laurent GUERBY
}
480 161 Laurent GUERBY
481 161 Laurent GUERBY
filter bgp_OUT {
482 167 Laurent GUERBY
        if (net ~ [91.224.148.0/23, 80.67.182.0/24, 89.234.156.0/23]) then {
483 167 Laurent GUERBY
          accept;
484 167 Laurent GUERBY
        }
485 161 Laurent GUERBY
        reject;
486 161 Laurent GUERBY
}
487 161 Laurent GUERBY
488 161 Laurent GUERBY
filter bgp_IN_PEERING {
489 161 Laurent GUERBY
       accept;
490 161 Laurent GUERBY
}
491 161 Laurent GUERBY
492 161 Laurent GUERBY
protocol bgp COGENT_TLS00 {
493 161 Laurent GUERBY
        local as myas;
494 161 Laurent GUERBY
        neighbor 149.11.58.73 as 174;
495 161 Laurent GUERBY
        import filter bgp_IN_PEERING;
496 161 Laurent GUERBY
        export filter bgp_OUT;
497 161 Laurent GUERBY
}
498 161 Laurent GUERBY
root@h7:~# cat /etc/bird/bird6.conf
499 161 Laurent GUERBY
router id 149.11.58.74;
500 161 Laurent GUERBY
501 161 Laurent GUERBY
define myas = 197422;
502 161 Laurent GUERBY
503 161 Laurent GUERBY
timeformat base     iso long;
504 161 Laurent GUERBY
timeformat log      iso long;
505 161 Laurent GUERBY
timeformat protocol iso long;
506 161 Laurent GUERBY
timeformat route    iso long;
507 161 Laurent GUERBY
508 161 Laurent GUERBY
log "/var/log/bird/bird6-20140527.log" all;
509 161 Laurent GUERBY
510 161 Laurent GUERBY
debug commands 2;
511 161 Laurent GUERBY
512 161 Laurent GUERBY
debug protocols { states, events };
513 161 Laurent GUERBY
514 161 Laurent GUERBY
listen bgp v6only;
515 161 Laurent GUERBY
516 161 Laurent GUERBY
protocol device {
517 161 Laurent GUERBY
        scan time 10;
518 161 Laurent GUERBY
}
519 161 Laurent GUERBY
520 161 Laurent GUERBY
protocol kernel {
521 161 Laurent GUERBY
        import all;
522 161 Laurent GUERBY
        export all;
523 161 Laurent GUERBY
        learn;
524 161 Laurent GUERBY
}
525 161 Laurent GUERBY
526 161 Laurent GUERBY
filter bgp_OUT_6 {
527 168 Laurent GUERBY
        if (net ~ [2a01:6600:8000::/40]) then {
528 168 Laurent GUERBY
          accept;
529 168 Laurent GUERBY
        }
530 161 Laurent GUERBY
        reject;
531 161 Laurent GUERBY
}
532 161 Laurent GUERBY
533 161 Laurent GUERBY
filter bgp_IN_PEERING_6 {
534 161 Laurent GUERBY
       accept;
535 161 Laurent GUERBY
}
536 161 Laurent GUERBY
537 161 Laurent GUERBY
protocol bgp COGENT_TLS00_6 {
538 161 Laurent GUERBY
        local as myas;
539 161 Laurent GUERBY
        neighbor 2001:978:2:68::8:1 as 174;
540 161 Laurent GUERBY
        import filter bgp_IN_PEERING_6;
541 161 Laurent GUERBY
        export filter bgp_OUT_6;
542 161 Laurent GUERBY
}
543 161 Laurent GUERBY
</pre>