I'm a little hazy on the technical details of BGP routing - am I correct in thinking that if you're a first-class BGP citizen, you can just advertise yourself as handling others' traffic and that's it, it just comes?
Edit (clarification):
- BGP has no authentication so anyone can advertise 'anything' (still has to be a valid address).
- "it just comes" isn't entirely accurate as the changes propagate outwards through your peers (in p2p fashion). I'm not sure what happens technically when two networks are advertising themselves as serving a particular IP though (I have a fuzzy idea, but don't know how the edge-cases would be resolved).
From the perspective of a router trying to route packets, you basically make choices based on what your peer networks are advertising that they can (directly or indirectly -- e.g. route through) service.
[Disclaimer: This is all stuff that I "know" but I've never worked directly with BGP so I'm open to correction.]
Edit: I guess you could use IPSec. It's not perfect, but it's pretty cool that we could have end-to-end crypto at the IP layer. https://en.wikipedia.org/wiki/IPsec#Security_architecture
Of course most of this is mitigated by end-to-end crypto but given that we see all too frequently how fallible that can be, this topic remains of interest. I mean if crypto fails and leaks your private key (a la heartbleed) and it falls into the hands of an attacker who can hijack some BGP routes then that attacker is potentially in a very powerful position. We've seen BGP hijacking by spammers needing clean IPs in the past, so this isn't a totally implausible situation.
It is useful to remember that IP is connectionless protocol. The role if IP is just to shuffle packets around from node to node (where many of the nodes are not the source or final intended destination of the packets) in a fairly simplistic way.
> ... to some machine with an interface configured to that address
Technically, the other endpoint does not even need to have an interface configured with that address. You can quite easily configure a box to send replies for any packets that happen to end up to it.
> Oh dear.
There is a good reason why IPsec (etc) was invented.
If an ISP in Los Angeles transits five autonomous systems to reach an ISP in New York, but four to reach an ISP in London, and the London ISP suddenly starts advertising the New York ISP's IP addresses, oops, your packets are now headed to the UK.
Great care is taken to avoid bizarre physical routes for packets, but it still happens constantly. One DSL connection I used in Santa Clara had a propensity for routing packets through Seattle to get to Dallas for a while.
if an isp in india advertises all of amazons AWS ranges as /24 or even smaller the routes will go there even if the bigger ranges are closer.
http://www.dasblinkenlichten.com/bgp-route-filtering-access-... http://blog.ine.com/2008/01/08/using-extended-acls-for-bgp-f...
It's common for one AS to advertise routes for locations not within their network. It's called transit.
http://blog.cloudflare.com/why-google-went-offline-today-and...
It's hard to be comfortable when this is true of systems as important as those which route the internet or PKI, for example, because it's impossible to know what might happen next. Perhaps it's erroneous to take the "structure" in "infrastructure" literally but in the context of the internet that word is becoming increasingly misnomered in my mind.