Small but Interesting Things

650 views

Published on

presented by Robert Kisteleki in RIPE NCC Services Workgroup at RIPE 60, Prague

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
650
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
3
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Small but Interesting Things

  1. 1. RIPE Network Coordination Centre “Small but interesting things” Three lightning talks in a row Róbert Kisteleki RIPE NCC Róbert Kisteleki RIPE60 http://www.ripe.net 1
  2. 2. RIPE Network Coordination Centre PI usage trends Analysis: René Wilhelm Róbert Kisteleki RIPE60 http://www.ripe.net 2
  3. 3. RIPE Network Coordination Centre PI usage trends Initial questions: •  Identify typical usage scenarios of PI resources with particular emphasis on LIRs that hold the largest numbers of these resources. •  Identify changes and new trends since introduction of 2007-01. •  Identify and quantify substitution of PI for PA resources. Identify the drivers of such substitution. •  If there’s a trend: identify revenue consequences for the RIPE NCC. Róbert Kisteleki RIPE60 http://www.ripe.net 3
  4. 4. RIPE Network Coordination Centre PI usage trends Róbert Kisteleki RIPE60 http://www.ripe.net 4
  5. 5. RIPE Network Coordination Centre PI usage trends Róbert Kisteleki RIPE60 http://www.ripe.net 5
  6. 6. RIPE Network Coordination Centre PI usage trends Róbert Kisteleki RIPE60 http://www.ripe.net 6
  7. 7. RIPE Network Coordination Centre PI usage trends Róbert Kisteleki RIPE60 http://www.ripe.net 7
  8. 8. RIPE Network Coordination Centre PI usage trends Róbert Kisteleki RIPE60 http://www.ripe.net 8
  9. 9. RIPE Network Coordination Centre PI usage trends LIRs and PI assignments: Róbert Kisteleki RIPE60 http://www.ripe.net 9
  10. 10. RIPE Network Coordination Centre PI usage trends Róbert Kisteleki RIPE60 http://www.ripe.net 10
  11. 11. RIPE Network Coordination Centre PI usage trends Stories for PA to PI substitution we’ve found: •  Looking at examples where PA decreased, PI increased: •  LIR1: new PI to end user, 1 of LIR’s own PAs returned •  LIR2 and LIR3: part of reclamation process, a fraction of the original PA was morphed into and kept as PI •  LIR4: part of business (subsidiary) is sold, PA went with it, new end user acquired •  LIR5: was split, the part that had PA was closed. •  IPRA story: •  LIR wants to convert PA to PI “just because” So far there are no visible trends for this! Róbert Kisteleki RIPE60 http://www.ripe.net 11
  12. 12. RIPE Network Coordination Centre IPv4 “dirtyness” Róbert Kisteleki RIPE60 http://www.ripe.net 12
  13. 13. RIPE Network Coordination Centre IPv4 “dirtyness” Starting point: We have noticed an increase in returns of “dirty” prefixes in the holy name of aggregation. (Where “dirty” means it’s partly or completely listed in one or more spamlists, do-not-route lists, etc.) Róbert Kisteleki RIPE60 http://www.ripe.net 13
  14. 14. RIPE Network Coordination Centre IPv4 “dirtyness” This made us wonder: •  How often does it happen that an address block becomes “dirty” soon after we assign/allocate it? •  Is it significant in terms of address space consumption? •  Are there any LIRs that are more prone to this? •  How often do they come back to exchange the “dirty” block for another (preferably clean) block? We do have historical data for allocations/assignments and for some blacklists, we can check! Róbert Kisteleki RIPE60 http://www.ripe.net 14
  15. 15. RIPE Network Coordination Centre IPv4 “dirtyness” Methodology: •  Look at recent allocations/assignments •  Gather basic data (LIR, date, type, …) •  Check resource in RIS and in various blacklists •  Weeks and months after assignment/allocation •  Weeks/months before assignment/allocation Look at cases where the resource was “clean” before the handout, but less so after it. Play with thresholds. Róbert Kisteleki RIPE60 http://www.ripe.net 15
  16. 16. RIPE Network Coordination Centre IPv4 “dirtyness” Caveats: •  Spamlists / blacklists have their own semantics •  And they can be wrong too! •  Having a small number of addresses marked can happen to anyone •  Anyone can have hacked clients •  Having a larger number of addresses marked is still no proof of ISP wrongdoing However: significant differences can serve as indicators to pay more attention! Róbert Kisteleki RIPE60 http://www.ripe.net 16
  17. 17. RIPE Network Coordination Centre IPv4 “dirtyness” Results – relaxed approach (some dirtiness is OK) Number of prefixes Address space (/16s) LIR 5 0.25 ru.LIR1 4 0.4 ua.LIR2 2 0.015 ua.LIR3 2 2 ru.LIR4 2 0.75 ru.LIR5 2 0.27 ru.LIR6 2 0.14 ru.LIR7 2 2 pl.LIR8 2 12 it.LIR9 2 0.625 hr.LIRA 2 8 de.LIRB 2 10 de.LIRC Total: 128 blocks from 111 LIRs, 106 /16s of address space. Róbert Kisteleki RIPE60 http://www.ripe.net 17
  18. 18. RIPE Network Coordination Centre IPv4 “dirtyness” Results – strict approach (any dirtiness counts) Number of prefixes Address space (/16s) LIR 41 0.875 ru.LIR1 30 0.645 cz.LIR2 28 0.875 ua.LIR3 19 0.551 cz.LIR4 11 8.07 ro.LIR5 8 0.328 ru.LIR6 7 0.109 ua.LIR7 6 0.176 ru.LIR8 6 0.516 rs.LIR9 5 0.203 pl.LIRA 5 0.766 pl.LIRB Total: 704 blocks from 494 LIRs, 258 /16s of address space. Róbert Kisteleki RIPE60 http://www.ripe.net 18
  19. 19. RIPE Network Coordination Centre IPv4 “dirtyness” Summary: •  Depending on level of paranoia, one can draw different conclusions •  In any case, Registration Services is aware of this phenomenon and takes it into account •  Once IPv4 runs out, reassignment / reallocation will very likely happen more often. •  Should the RIPE NCC think about this aspect? Róbert Kisteleki RIPE60 http://www.ripe.net 19
  20. 20. RIPE Network Coordination Centre Historical BGPlay Thesis work of Claudio Squarcella Róbert Kisteleki RIPE60 http://www.ripe.net 20
  21. 21. RIPE Network Coordination Centre Historical BGPlay Starting points: •  We have a long history of BGP recorded in RIS •  We also have an efficient (prototype) mechanism to dig deep into this (INRDB) •  There are nice tools to visualize this kind of data – BGPlay from Roma Tre Uni being one of them Let’s combine these components into something more useful! Róbert Kisteleki RIPE60 http://www.ripe.net 21
  22. 22. RIPE Network Coordination Centre Historical BGPlay Results: •  A new tool that anyone can try out •  Very similar to BGPlay •  It starts from RIS table dumps, not updates •  So it doesn’t capture the fine details •  But it does show the interruptions to stability and major changes •  It lets you check the “long term” view of a IPv4/IPv6 prefix and/or ASN •  You can filter temporary events, where you can define what “temporary” means in the order of days-weeks Check it out – details are on RIPE Labs! Róbert Kisteleki RIPE60 http://www.ripe.net 22
  23. 23. RIPE Network Coordination Centre Historical BGPlay DEMO Róbert Kisteleki RIPE60 http://www.ripe.net 23
  24. 24. RIPE Network Coordination Centre Questions? Róbert Kisteleki RIPE60 http://www.ripe.net 24

×