Rayhaan JaufeerallyandClaude Fable 5.1
1399cbd39f
- Title is now "Hands-on BGP"; the AS-path diagram is gone from the cover. - Sections: IPv6 addresses and prefixes; where AS numbers and prefixes come from (IANA, RIRs, the RIPE database, IRR vs RPKI); BGP and the bytes of an UPDATE; IP transit vs Internet exchanges (the peering LAN as an Ethernet segment, route servers); the lab (ferrix, pr01.rue, SwissIX, NL-ix, France-IX, DE-CIX, transit). - The UPDATE walked through in section 3 is a real 94-byte capture from ferrix for 2a0d:d741:1::/48. Vertical slides light up one part at a time with its decode; the generator asserted every quoted number against the capture. Session counts come from the tracked bird.conf, the route6 object from the RPSL file, SwissIX's LAN from PeeringDB. - New components: focusable bytes, decode table, prefix bits, and SVG diagrams drawn in the theme's colours. - Opening index.html straight from disk used to give a title and empty panels, because browsers block the module and the section files there. The page now explains that, and also reports a failed reveal.js load. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
5.0 KiB
The lab
Notes: Section 5. What the students are about to touch, and what stands between a typo and the Internet.
What you are connected to
Notes: ferrix is a small BGP daemon written for this course; it runs on the same machine as the router. Both dashed hops are real BGP sessions. Everything to the right of pr01 is the actual Internet.
Your prefix
2a0d:d741:<n>::/48
<n>is your number in hex: student 10 is2a0d:d741:a::/48- Put your name in owner: only the owner can withdraw a route
- One prefix each
Notes: Put the URL and the class password on the board. The page is a snapshot by default; turn on auto-refresh at the top right to watch things change.
What happens when you press Announce
- ferrix builds an UPDATE. Click bytes to see it, hover to decode it
- pr01 checks it against its import filter
- pr01 decides, per neighbour, whether to pass it on
- Within a minute or so, the Internet can see your prefix
ping 2a0d:d741:<n>::1answers, from anywhere
Notes: Step 5: pr01 answers for every address in the lab space, so reachability of your prefix depends only on whether your announcement got out.
What stands between you and an outage
filter ferrix_import {
if !(net ~ [ 2a0d:d741::/40{48,48} ]) then reject; # only lab /48s
if bgp_path.first != 4200000001 then reject; # only from ferrix
bgp_community.filter([ (65535, 65281), (65535, 65282) ]);
bgp_large_community.filter([ (42476, *, *), (210036, 0..3, *) ]);
bgp_ext_community.empty; # drop what we did not offer
dest = RTD_UNREACHABLE; # announce-only
accept;
}
Notes: This is the router's real import filter. ferrix refuses anything outside the lab /40 before it gets this far, and pr01 takes at most 130 routes from it. Two independent nets, because the web form has no idea who you are.
Steering your route
| You add | Who acts | Effect |
|---|---|---|
| nothing | announced everywhere | |
210036:0:0 |
pr01 | announced nowhere |
210036:0:0 210036:1:42476 |
pr01 | only to the SwissIX route servers |
+ 42476:0:0 42476:1:559 |
SwissIX | …and from there only to SWITCH |
NO_EXPORT |
pr01 | accepted, never passed on |
Same idea at two hops: never there, only there, nowhere.
Notes: 210036:0: never to that AS, 210036:1: to that AS, 210036:2/3: the same by exchange (1 SwissIX, 2 NL-ix, 3 France-IX, 4 DE-CIX). A "never" always wins. The preset menu next to the field has all of these.
Your turn
- Announce your prefix with no options. Find it on a looking glass
- Read the bytes: where is your AS number? Where is your prefix?
- Restrict it to the SwissIX route servers. Who still sees it?
- Narrow it to SWITCH. Can you reach it from the ETH network? From your phone?
- Withdraw it and watch it disappear
Notes: Looking glasses: bgp.tools, RIPEstat, and the exchange's own. Global visibility takes a minute or two to settle after each change.