Rayhaan JaufeerallyandClaude Fable 5.1
f3bb8cc89e
One double-sided A4 sheet with 1in margins, still in the LNCS look. 1. Who announces the address you are using: find your current address and its prefix and origin AS, then whois it and your lab prefix. 2. Announce your prefix, read the bytes, find it from outside, ping it. 3. Announce with communities: only the SwissIX route servers, then only SWITCH, with reachability checkboxes, one discussion question, clean up. Sections 1 and 2 fill page one; section 3 has page two. Dropped the ETH lookup, the long registry comparison, NO_EXPORT, the byte-decoding task, the reference appendix and most of the bibliography. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
192 lines
8.3 KiB
TeX
192 lines
8.3 KiB
TeX
% Exercise sheet for the "Hands-on BGP" lecture: two A4 pages, one sheet.
|
|
% Springer LNCS class (llncs.cls ships with TeX Live). Build: latexmk -pdf handout.tex
|
|
\documentclass[a4paper]{llncs}
|
|
|
|
\usepackage[a4paper,margin=1in]{geometry}
|
|
\usepackage[T1]{fontenc}
|
|
\usepackage[utf8]{inputenc}
|
|
\usepackage{microtype}
|
|
\usepackage{booktabs}
|
|
\usepackage{amssymb}
|
|
\usepackage{listings}
|
|
\usepackage{tikz}
|
|
\usetikzlibrary{positioning,arrows.meta}
|
|
\PassOptionsToPackage{hyphens}{url}
|
|
\usepackage[hidelinks]{hyperref}
|
|
\renewcommand\UrlFont{\ttfamily\small}
|
|
\pagestyle{empty}
|
|
% Floats sit in the text here, so they need less air than in a paper.
|
|
\setlength{\intextsep}{7pt}
|
|
\setlength{\abovecaptionskip}{4pt}
|
|
\setlength{\belowcaptionskip}{0pt}
|
|
|
|
% ---- things to change per class -------------------------------------------
|
|
\newcommand{\laburl}{https://bgplab.rayhaan.net/statusz}
|
|
\newcommand{\myprefix}{\texttt{2a0d:d741:}\underline{\texttt{\,n\,}}\texttt{::/48}}
|
|
|
|
% ---- exercise machinery ------------------------------------------------------
|
|
\lstset{basicstyle=\ttfamily\small,columns=fullflexible,keepspaces=true,
|
|
frame=single,framerule=0.3pt,xleftmargin=1.2em,xrightmargin=0.4em,
|
|
aboveskip=0.5em,belowskip=0.3em}
|
|
\newcounter{task}[section]
|
|
\renewcommand{\thetask}{\thesection.\arabic{task}}
|
|
\newcommand{\task}[1]{\refstepcounter{task}\smallskip\noindent
|
|
\textbf{Task \thetask}\enspace\textit{#1}\enspace\ignorespaces}
|
|
\newcommand{\answer}[1][1]{\par\nobreak
|
|
\foreach \i in {1,...,#1}{\vspace{1.0em}\noindent\makebox[\linewidth]{\dotfill}\par}\smallskip}
|
|
\newcommand{\fillintwo}[2]{\par\nopagebreak\smallskip\noindent
|
|
\parbox[t]{0.485\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.485\linewidth}{#2~\dotfill}\par\vspace{0.4em}}
|
|
\newcommand{\fillinthree}[3]{\par\nopagebreak\smallskip\noindent
|
|
\parbox[t]{0.32\linewidth}{#1~\dotfill}\hfill\parbox[t]{0.32\linewidth}{#2~\dotfill}\hfill\parbox[t]{0.32\linewidth}{#3~\dotfill}\par\vspace{0.4em}}
|
|
\newcommand{\cbox}{$\square$\;}
|
|
\newcommand{\reach}{\par\nopagebreak\smallskip\noindent
|
|
Reachable from:\hspace{1.2em}\cbox laptop on the university network\hspace{2em}\cbox phone on mobile data\par\smallskip}
|
|
|
|
\begin{document}
|
|
|
|
\title{Hands-on BGP: Announcing and Steering a Prefix}
|
|
\author{Rayhaan Jaufeerally}
|
|
\institute{Network Security, ETH Z\"urich \qquad Lab page: \url{\laburl}}
|
|
\maketitle
|
|
|
|
\begin{abstract}
|
|
You look up who announces the address you are using right now, announce an
|
|
IPv6 prefix of your own to the real Internet with BGP, and then use BGP
|
|
communities to decide which networks may learn it. By the end your prefix
|
|
should be reachable from the university network and from nowhere else.
|
|
\end{abstract}
|
|
|
|
\medskip\noindent
|
|
\parbox[t]{0.44\linewidth}{Name:~\dotfill}\hfill
|
|
\parbox[t]{0.24\linewidth}{Student no.\ $n$:~\dotfill}\hfill
|
|
\parbox[t]{0.27\linewidth}{Prefix: \myprefix}
|
|
|
|
\smallskip\noindent
|
|
Your prefix is \myprefix, where \texttt{n} is your student number \emph{in
|
|
hexadecimal}: student 10 has \texttt{2a0d:d741:a::/48}, student 26 has
|
|
\texttt{2a0d:d741:1a::/48}.
|
|
|
|
% ==============================================================================
|
|
\section{Who Announces the Address You Are Using?}
|
|
|
|
\task{Find your address.}
|
|
Open \texttt{bgp.tools} in a browser: the top of the page shows the address
|
|
you are connecting from, the prefix it belongs to, and the network that
|
|
announces that prefix.
|
|
\fillinthree{Your address:}{its prefix:}{announced by AS:}
|
|
|
|
\task{Ask the registry.}
|
|
The RIPE database~\cite{ripedb} records who holds address space
|
|
(\texttt{inet6num}, or \texttt{inetnum} for IPv4) and who may announce it
|
|
(\texttt{route6}, \texttt{route}). Look up your address, then your lab prefix:
|
|
\begin{lstlisting}
|
|
whois -h whois.ripe.net <your address> whois -h whois.ripe.net 2a0d:d741:<n>::/48
|
|
\end{lstlisting}
|
|
\fillintwo{Your address: held by (\texttt{netname})}{\texttt{origin} AS:}
|
|
\fillintwo{Your lab prefix: \texttt{origin} AS}{is it announced right now?}
|
|
|
|
% ==============================================================================
|
|
\section{Announcing Your Prefix}
|
|
|
|
\begin{figure}[h]
|
|
\centering
|
|
\begin{tikzpicture}[font=\footnotesize, node distance=5mm and 11mm,
|
|
box/.style={draw, rounded corners=1.5pt, minimum height=7.5mm, inner xsep=4pt, align=center},
|
|
bgp/.style={-{Stealth[length=2mm]}, dashed}, web/.style={-{Stealth[length=2mm]}}]
|
|
\node[box] (you) {you\\[-1pt]\scriptsize browser};
|
|
\node[box, right=of you] (ferrix) {lab daemon\\[-1pt]\scriptsize AS4200000001};
|
|
\node[box, right=of ferrix] (pr) {\texttt{pr01.rue}\\[-1pt]\scriptsize AS210036};
|
|
\node[box, right=of pr] (rs) {SwissIX route servers\\[-1pt]\scriptsize AS42476};
|
|
\node[box, right=of rs] (sw) {SWITCH (ETH)\\[-1pt]\scriptsize AS559};
|
|
\node[box, below=4mm of rs] (other) {other exchanges, transit};
|
|
\draw[web] (you) -- node[above, inner sep=1.5pt]{\tiny HTTPS} (ferrix);
|
|
\draw[bgp] (ferrix) -- node[above, inner sep=1.5pt]{\tiny BGP} (pr);
|
|
\draw[bgp] (pr) -- (rs);
|
|
\draw[bgp] (rs) -- (sw);
|
|
\draw[bgp] (pr) |- (other);
|
|
\end{tikzpicture}
|
|
\caption{The lab. Dashed arrows are BGP sessions~\cite{rfc4271}; everything right of
|
|
\texttt{pr01.rue} is the real Internet.}
|
|
\label{fig:lab}
|
|
\end{figure}
|
|
|
|
\task{Announce.}
|
|
Open \url{\laburl} (credentials are given in class). Enter your name as
|
|
\emph{owner} and your prefix, leave everything else untouched, and press
|
|
\emph{Announce}. Only the owner can withdraw a route, so spell your name the
|
|
same way each time.
|
|
|
|
\task{Read what you sent.}
|
|
Click \emph{bytes} next to your route and hover over the coloured segments.
|
|
\fillintwo{AS number(s) in \texttt{AS\_PATH}:}{attribute carrying your prefix:}
|
|
|
|
\task{See it from outside.}
|
|
Wait two minutes, then look your prefix up on \texttt{bgp.tools}.
|
|
\fillintwo{Origin AS the world sees:}{an AS path you found:}
|
|
\noindent The lab daemon's AS4200000001 is missing from that path. Where did it go, and why?
|
|
\answer[1]
|
|
|
|
\task{Reach it.}
|
|
The router answers for every address in the lab space, so your prefix is
|
|
reachable exactly when your announcement got out:\quad
|
|
\texttt{ping -6 2a0d:d741:<n>::1}
|
|
\reach
|
|
|
|
% ==============================================================================
|
|
\section{Steering Your Prefix with Communities}
|
|
|
|
A community is a tag on a route; it means whatever the network reading it has
|
|
decided it means~\cite{rfc8092}. Two networks act on yours in turn: first our
|
|
router \texttt{pr01.rue}, then the SwissIX route servers~\cite{swissix}, which
|
|
pass routes between the members of the exchange. The page's preset menu has
|
|
all of the communities below.
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\begin{tabular}{@{}l@{\hspace{1.6em}}l@{\hspace{1.6em}}l@{}}
|
|
\toprule
|
|
Large community & Read by & Effect \\
|
|
\midrule
|
|
\texttt{210036:0:0} & \texttt{pr01.rue} & announce nowhere \ldots \\
|
|
\texttt{210036:1:42476} & \texttt{pr01.rue} & \ldots except to AS42476, the SwissIX route servers \\
|
|
\midrule
|
|
\texttt{42476:0:0} & SwissIX & send to no member \ldots \\
|
|
\texttt{42476:1:559} & SwissIX & \ldots except AS559, SWITCH, the network ETH is part of \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\task{One exchange only.}
|
|
Announce your prefix again with \texttt{210036:0:0} and
|
|
\texttt{210036:1:42476}; announcing a prefix you own replaces it. Before you
|
|
look: who do you expect to still see it?
|
|
\answer[1]
|
|
\noindent Wait two minutes, then check on \texttt{bgp.tools} and with \texttt{ping}.
|
|
\reach
|
|
|
|
\task{The university only.}
|
|
Add \texttt{42476:0:0} and \texttt{42476:1:559} to the two you already have and
|
|
announce again. Our router now tells only the route servers, and they tell
|
|
only SWITCH.
|
|
\reach
|
|
\noindent Is your prefix still visible on \texttt{bgp.tools}? Explain what you see.
|
|
\answer[2]
|
|
|
|
\task{Think.}
|
|
You steered routing in two networks you do not operate, using nothing but
|
|
numbers attached to a route. What stops you from attaching a community that
|
|
one of \emph{their} upstreams acts on?
|
|
\answer[2]
|
|
|
|
\task{Clean up.} Withdraw your prefix and watch it disappear.
|
|
|
|
\begin{thebibliography}{4}
|
|
\small
|
|
\bibitem{rfc4271} Rekhter, Y., Li, T., Hares, S.: A Border Gateway Protocol 4 (BGP-4). RFC 4271 (2006)
|
|
\bibitem{rfc8092} Heitz, J., Snijders, J., Patel, K., Bagdonas, I., Hilliard, N.: BGP Large Communities Attribute. RFC 8092 (2017)
|
|
\bibitem{ripedb} RIPE NCC: RIPE Database Query, \url{https://apps.db.ripe.net/db-web-ui/query}
|
|
\bibitem{swissix} SwissIX: Action BGP Communities, \url{https://www.swissix.ch/resources/action-bgp-communities/}
|
|
\end{thebibliography}
|
|
|
|
\end{document}
|