rayhaan/ferrix
0
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

handout finalized

Browse Source
This commit is contained in:
Rayhaan Jaufeerally committed 2026-09-24 10:33:45 +02:00
1 parent b607058650
commit 597941a70a
2 files changed
+36 -51
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/lab/handout/handout.pdf
BIN
View File
Binary file not shown.
docs/lab/handout/handout.tex
+36 -51
View File
@@ -10,6 +10,7 @@
\usepackage{amssymb}
\usepackage{listings}
\usepackage{tikz}
\usepackage[bitstream-charter]{mathdesign}
\usetikzlibrary{positioning,arrows.meta}
\PassOptionsToPackage{hyphens}{url}
\usepackage[hidelinks]{hyperref}
@@ -21,12 +22,11 @@
\setlength{\belowcaptionskip}{0pt}
% ---- things to change per class -------------------------------------------
\newcommand{\laburl}{https://bgplab.rayhaan.net/statusz}
\newcommand{\laburl}{https://bgplab.rayhaan.net/}
\newcommand{\myprefix}{\texttt{2a0d:d741:}\underline{\texttt{\,n\,}}\texttt{::/48}}
% ---- exercise machinery ------------------------------------------------------
\lstset{basicstyle=\ttfamily\small,columns=fullflexible,keepspaces=true,
frame=single,framerule=0.3pt,xleftmargin=1.2em,xrightmargin=0.4em,
aboveskip=0.5em,belowskip=0.3em}
\newcounter{task}[section]
\renewcommand{\thetask}{\thesection.\arabic{task}}
@@ -34,55 +34,52 @@
\textbf{Task \thetask}\enspace\textit{#1}\enspace\ignorespaces}
\newcommand{\answer}[1][1]{\par\nobreak
\foreach \i in {1,...,#1}{\vspace{1.0em}\noindent\makebox[\linewidth]{\dotfill}\par}\smallskip}
\newcommand{\fillintwo}[2]{\par\nopagebreak\smallskip\noindent
\parbox[t]{0.485\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.485\linewidth}{#2~\dotfill}\par\vspace{0.4em}}
\newcommand{\fillinthree}[3]{\par\nopagebreak\smallskip\noindent
\parbox[t]{0.32\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.32\linewidth}{#2~\dotfill}\hfill\parbox[t]{0.32\linewidth}{#3~\dotfill}\par\vspace{0.4em}}
% A labelled answer box: the label on its own line, then #1 dotted lines to
% write on (default 2). Used side by side by \fillintwo and \fillinthree.
\newcommand{\writelines}[1]{\foreach \i in {1,...,#1}{\vspace{1.0em}\makebox[\linewidth]{\dotfill}\par}}
\newcommand{\fillbox}[3][2]{\parbox[t]{#2}{#3\par\nopagebreak\writelines{#1}}}
\newcommand{\fillintwo}[3][2]{\par\nopagebreak\smallskip\noindent
\fillbox[#1]{0.485\linewidth}{#2}\hfill\fillbox[#1]{0.485\linewidth}{#3}\par\vspace{0.4em}}
\newcommand{\fillinthree}[4][2]{\par\nopagebreak\smallskip\noindent
\fillbox[#1]{0.32\linewidth}{#2}\hfill\fillbox[#1]{0.32\linewidth}{#3}\hfill\fillbox[#1]{0.32\linewidth}{#4}\par\vspace{0.4em}}
\newcommand{\cbox}{$\square$\;}
\newcommand{\reach}{\par\nopagebreak\smallskip\noindent
Reachable from:\hspace{1.2em}\cbox laptop on the university network\hspace{2em}\cbox phone on mobile data\par\smallskip}
\begin{document}
\title{Hands-on BGP: Announcing and Steering a Prefix}
\title{Hands on BGP: Announcing and Steering an IPv6 Prefix}
\author{Rayhaan Jaufeerally}
\institute{Network Security, ETH Z\"urich \qquad Lab page: \url{\laburl}}
\institute{Network Security, ETHZ\\ Lab page: \url{\laburl} (username ``netsec'', password ``perrig'')}
\maketitle
\begin{abstract}
You look up who announces the address you are using right now, announce an
IPv6 prefix of your own to the real Internet with BGP, and then use BGP
communities to decide which networks may learn it. By the end your prefix
should be reachable from the university network and from nowhere else.
\end{abstract}
\medskip\noindent
\parbox[t]{0.44\linewidth}{Name:~\dotfill}\hfill
\parbox[t]{0.24\linewidth}{Student no.\ $n$:~\dotfill}\hfill
\parbox[t]{0.27\linewidth}{Prefix: \myprefix}
\smallskip\noindent
Your prefix is \myprefix, where \texttt{n} is your student number \emph{in
hexadecimal}: student 10 has \texttt{2a0d:d741:a::/48}, student 26 has
Your prefix is \myprefix, where \texttt{n} is your number \emph{in
hexadecimal}.\par\noindent
Student 10 has \texttt{2a0d:d741:a::/48} and student 26 has
\texttt{2a0d:d741:1a::/48}.
% ==============================================================================
\section{Who Announces the Address You Are Using?}
\task{Find your address.}
Open \texttt{bgp.tools} in a browser: the top of the page shows the address
\task{Find your IPv6 address.}
Open \texttt{https://bgp.tools} in a browser: the top of the page shows the address
you are connecting from, the prefix it belongs to, and the network that
announces that prefix.
\fillinthree{Your address:}{its prefix:}{announced by AS:}
\fillinthree{Your IPv6 address:}{its prefix:}{announced by AS:}
\task{Ask the registry.}
The RIPE database~\cite{ripedb} records who holds address space
The RIPE database records who holds address space
(\texttt{inet6num}, or \texttt{inetnum} for IPv4) and who may announce it
(\texttt{route6}, \texttt{route}). Look up your address, then your lab prefix:
(\texttt{route6}, \texttt{route}). Look up your IPv6 address, then your lab prefix:
\begin{lstlisting}
whois -h whois.ripe.net <your address> whois -h whois.ripe.net 2a0d:d741:<n>::/48
whois <your IPv6 address> whois 2a0d:d741:<n>::/48
\end{lstlisting}
\fillintwo{Your address: held by (\texttt{netname})}{\texttt{origin} AS:}
\fillintwo{Your IPv6 address: held by (\texttt{netname})}{\texttt{origin} AS:}
\fillintwo{Your lab prefix: \texttt{origin} AS}{is it announced right now?}
% ==============================================================================
@@ -105,26 +102,24 @@ whois -h whois.ripe.net <your address> whois -h whois.ripe.net 2a0d:d741:
\draw[bgp] (rs) -- (sw);
\draw[bgp] (pr) |- (other);
\end{tikzpicture}
\caption{The lab. Dashed arrows are BGP sessions~\cite{rfc4271}; everything right of
\caption{The lab. Dashed arrows are BGP sessions; everything right of
\texttt{pr01.rue} is the real Internet.}
\label{fig:lab}
\end{figure}
\task{Announce.}
Open \url{\laburl} (credentials are given in class). Enter your name as
\emph{owner} and your prefix, leave everything else untouched, and press
\emph{Announce}. Only the owner can withdraw a route, so spell your name the
same way each time.
Open \url{\laburl} (username ``netsec'' password ``perrig''). Enter your name as
\emph{owner} and your prefix, and press \emph{Announce}.
\task{Read what you sent.}
Click \emph{bytes} next to your route and hover over the coloured segments.
\fillintwo{AS number(s) in \texttt{AS\_PATH}:}{attribute carrying your prefix:}
\task{See it from outside.}
Wait two minutes, then look your prefix up on \texttt{bgp.tools}.
Wait a moment, then look your prefix up on \texttt{bgp.tools}.
\fillintwo{Origin AS the world sees:}{an AS path you found:}
\noindent The lab daemon's AS4200000001 is missing from that path. Where did it go, and why?
\answer[1]
\answer[2]
\task{Reach it.}
The router answers for every address in the lab space, so your prefix is
@@ -133,13 +128,11 @@ reachable exactly when your announcement got out:\quad
\reach
% ==============================================================================
\section{Steering Your Prefix with Communities}
\section{Steering Your Prefix with Large Communities}
A community is a tag on a route; it means whatever the network reading it has
decided it means~\cite{rfc8092}. Two networks act on yours in turn: first our
router \texttt{pr01.rue}, then the SwissIX route servers~\cite{swissix}, which
pass routes between the members of the exchange. The page's preset menu has
all of the communities below.
A Large Community is a tag added to a route. It can have any meaning that the network
which issued it decides. In BGP large communities, the first part is the AS number
and the subsequent two integers are up to the interpretation of that network.
\begin{table}[h]
\centering
@@ -160,11 +153,11 @@ Large community & Read by & Effect \\
Announce your prefix again with \texttt{210036:0:0} and
\texttt{210036:1:42476}; announcing a prefix you own replaces it. Before you
look: who do you expect to still see it?
\answer[1]
\noindent Wait two minutes, then check on \texttt{bgp.tools} and with \texttt{ping}.
\answer[2]
\noindent Wait a moment, then check on \texttt{bgp.tools} and with \texttt{ping}.
\reach
\task{The university only.}
\task{To SWITCH only.}
Add \texttt{42476:0:0} and \texttt{42476:1:559} to the two you already have and
announce again. Our router now tells only the route servers, and they tell
only SWITCH.
@@ -172,20 +165,12 @@ only SWITCH.
\noindent Is your prefix still visible on \texttt{bgp.tools}? Explain what you see.
\answer[2]
\task{Think.}
\task{Use of large communities.}
You steered routing in two networks you do not operate, using nothing but
numbers attached to a route. What stops you from attaching a community that
one of \emph{their} upstreams acts on?
\answer[2]
\task{Clean up.} Withdraw your prefix and watch it disappear.
\begin{thebibliography}{4}
\small
\bibitem{rfc4271} Rekhter, Y., Li, T., Hares, S.: A Border Gateway Protocol 4 (BGP-4). RFC 4271 (2006)
\bibitem{rfc8092} Heitz, J., Snijders, J., Patel, K., Bagdonas, I., Hilliard, N.: BGP Large Communities Attribute. RFC 8092 (2017)
\bibitem{ripedb} RIPE NCC: RIPE Database Query, \url{https://apps.db.ripe.net/db-web-ui/query}
\bibitem{swissix} SwissIX: Action BGP Communities, \url{https://www.swissix.ch/resources/action-bgp-communities/}
\end{thebibliography}
\task{Clean up.} Withdraw your prefix and see how long it takes to go away.
\end{document}