0 Fork 0

Files

T

Rayhaan JaufeerallyandClaude Fable 5.1 9d6996c6c1 slides: no step-by-step reveals; UPDATE example is 2a0d:d740::/48 at SwissIX

- Removed every fragment and stepped code highlight: a slide now shows
  everything at once. Two code blocks keep a static highlight on one line.
- Dropped "What stands between you and an outage".
- The UPDATE walked through in section 3 is now 2a0d:d740::/48 as AS210036
  announces it to the SwissIX route servers: next hop 2001:7f8:24::c9
  (pr01's port on the peering LAN), AS path 210036, MED 0 and 210036:10:2,
  matching what pr01's export filter puts on routes to peers. Encoded with
  the packet crate and parsed back to the identical message; the slide
  generator asserted every quoted number, including the next hop, against
  the bytes. Adds a MULTI_EXIT_DISC slide to the walkthrough.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-20 21:48:12 +02:00

2.5 KiB

Raw Blame History

Where numbers come from

Notes: Section 2. Nobody "owns" addresses or AS numbers; they are registered to you.

A hierarchy of registries

IANA
the root

RIPE NCC
Europe, Middle East

ARIN

APNIC

LACNIC

AFRINIC

IANA hands large blocks to five regional registries. They hand smaller ones to members (LIRs), who assign to end users.

Notes: RIR = Regional Internet Registry. LIR = Local Internet Registry, a member of an RIR, typically an ISP. Our space comes from RIPE NCC via an LIR.

AS numbers

16 bits at first: 1 to 65535
32 bits since RFC 6793: up to 4294967295
Old routers see AS23456 (AS_TRANS) in place of a big one
Private use: 64512–65534 and 4200000000–4294967294

The lab daemon is AS4200000001. It is stripped before the Internet sees your route.

Notes: RFC 6996 reserves the private ranges. The upstream router removes the private AS from the path, so the origin everybody else sees is AS210036.

The RIPE database says who may announce what

route6:         2a0d:d741:1::/48
descr:          ETHZ Netsec 2026 BGP lab - student 1
origin:         AS210036
mnt-by:         mnt-ch-ray-1
source:         RIPE

One of these exists for every student prefix. Networks build their filters from them.

Notes: This is a real object; try the whois on the next slide. mnt-by names the maintainer: whoever holds its credentials can change the object. An inet6num object records the address block itself, a route6 object who may originate it.

Two ways to say "this origin is allowed"

	IRR (`route6`)	RPKI (ROA)
What it is	an entry in a database	a signed certificate
Who can create it	whoever holds the maintainer	only the holder of the addresses
Says	prefix + origin AS	prefix + origin AS + max length
Used for	building prefix filters	dropping "invalid" routes

Notes: Max length matters for us: a ROA for the /40 with max length 40 would make every student /48 RPKI-invalid, and many networks would drop it.

Look it up yourself

whois -h whois.ripe.net 2a0d:d741:1::/48
whois -h whois.ripe.net AS210036

Or in a browser: RIPEstat, bgp.tools, or a looking glass at an exchange.

2.5 KiB Raw Blame History Unescape Escape