Elektrine lite

← Feed

@Jhaas@infosec.exchange

2026-08-01 16:39 UTC

There's been some recent discussion covering #bgp routing about the ORIGIN attribute. Pointers to a few items for that discussion follow in the replies, but let's lead with the nice Cloudflare post.[1] One track follows the fact that RFC 4271 says you SHOULD NOT be changed after it's been originated.[2] But, clearly, that's happening. Another track has been "we should deprecate this!"[3][4] Good luck with that. Much of the headache for BGP is dealing with incremental deployment. This is baked deep enough into the core protocol that any effort to remove it either at the PDU level or the route selection level sufficient to make a difference isn't something I find likely to happen before I retire. The missing bit of the conversation is why we're seeing this manipulation at all. The simple answer is that when all you have are hammers, every problem resembles a nail. Service providers have a very small number of tools in their toolbox to light-handedly shape in-AS traffic. The toolbox to change how traffic is attracted to their AS is just as clumsy. The subset of BGP's route selection tools available is shown in my very Crayola palette.

Replies (2)

  • @Jhaas@infosec.exchange 2026-08-01 16:39

    AS_PATH Length is the tool everyone is used to using to impact attracted traffic: You prepend your own AS to make a path less preferable. Unfortunately the efficacy of this practice is clumsy. Depending on where you sit in the Internet and who your providers are, you end up playing with the number of prepends to see how well you can influence the incoming traffic. Excessive prepending opens you up to easier route hijack. (https://datatracker.ietf.org/doc/draft-ietf-grow-as-path-prepending/) When you're not lucky, traffic load balancing seems fine and then all of a sudden may shift. Often this is how a provider discovers BGP Wedgies where the "state machine that is the Internet" has latched temporally on your advertised routes... and then it moved. (https://datatracker.ietf.org/doc/html/rfc4264) On an incoming basis, providers may proxy prepend incoming routes to locally bias their traffic. However, that also impacts downstream traffic attraction and thus you have to be careful about that.

    Open ##5311550

  • @overunderlay@bsd.network 2026-08-01 20:00

    @Jhaas@infosec.exchange if we're gonna be updating stuff, ORIGIN (Type Code 1) has a whole octet to itself but only 3 currently defined values. Couldn't we do more with this? I propose: 0: IGP: default 1: EGP : "I know what I'm doing" 2: INCOMPLETE (or "?"): "I don't know what I'm doing" 3: "pick meeeee!" 4: "my transit set this for me so you don't have to" 5: "I deaggregated a bunch of crap that you'll want to filter" 6: applied automatically in cases of more than 2 AS_PATH prepends 7: "prefix flaps so often it's effectively useless"

    Open ##5311553