@Benjojo12 / ben@benjojo.co.uk / $whois as206924 Measuring ... · ben@eshwil:~$ dig...

Measuring RPKI Adoptionusing the data-plane

@Benjojo12 / ben@benjojo.co.uk / $whois as206924

Ben Cartwright-Coxdac3cda3f35eb6f2ff99d5ed174d6204

RPKI adoption is growing

Even better in RIPE

This is not good

So far so good

This shouldn't route

0.0.0.0/0

Fixing this is hard to justify

0.0.0.0/0

This is still a lot of traffic

Assumptions

● Lots of people have default routes

● Lots of people are signing but not validating

Testing rig

All 0.0.0.0/0 responses collected

ARINARIN RIPE

What means what?

ARINARIN RIPE

Then they are validating and dropping(!)

ARINARIN RIPE

Then they are using a popular ROA validator setup with defaults

ARINARIN RIPE

Then they are not validating anything

Wait, what?!Not all ROA's are equal?

ARINARIN RIPE

Total counts

ARINARIN RIPE

130 Mil

ARINARIN RIPE

130 Mil 128.2 Mil

ARINARIN RIPE

130 Mil 128.2 Mil128.3 Mil

ARINARIN RIPE

130 Mil 128.2 Mil128.3 Mil

127.9 Mil

128.1 Mil

AFRINIC

128.1 Mil

AS57598AS15426AS34968AS35470AS34762AS28878AS39647AS8455AS21155AS197902AS24679AS20559AS8608AS200831AS30870AS29028AS24586AS34756AS8312AS202955AS201975AS41480AS201290AS39637AS8587AS50554AS61349AS58075AS59980AS24730AS60820AS202916AS28747

AS34215AS42812AS48729AS199456AS60950AS202016AS61429AS35027AS21073AS41153AS49627AS61147AS42585AS15703AS15879AS35260AS62353AS202947AS34141AS41960AS20495AS52144AS42755

91% 3%

This amounts to a /15 protected

But waitWhat about those who take

default routes?

--- 139.138.224.4 ping statistics --- 100 packets transmitted, 100 received, 0% packet loss, time 19887ms rtt min/avg/max/mdev = 243.039/243.758/251.173/1.088 ms, pipe 2

--- 139.138.224.4 ping statistics ---100 packets transmitted, 100 received, 0% packet loss, time 19877msrtt min/avg/max/mdev = 245.384/246.097/248.497/0.608 ms, pipe 2

Invalid

--- 139.138.224.4 ping statistics --- 100 packets transmitted, 100 received, 0% packet loss, time 19887ms rtt min/avg/max/mdev = 243.039/243.758/251.173/1.088 ms, pipe 2

--- 139.138.224.4 ping statistics ---100 packets transmitted, 100 received, 0% packet loss, time 19877msrtt min/avg/max/mdev = 245.384/246.097/248.497/0.608 ms, pipe 2

Reliably a 3ms~ difference

Invalid

But waitMaybe services do a better

ben@eshwil:~$ dig ripe.playfeniks.com

ben@eshwil:~$ dig arin.playfeniks.com

ben@eshwil:~$ dig apnic.playfeniks.com

ben@eshwil:~$ dig jpnic.playfeniks.com

* These are likely not going to work that much longer after the talk

Try it??

Are you validating?

[15:02:03] ben@metropolis:~$ dig @1.1.1.1 ripe.playfeniks.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> @1.1.1.1 ripe.playfeniks.com; (1 server found);; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25737;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 1452;; QUESTION SECTION:;ripe.playfeniks.com. IN A

;; ANSWER SECTION:ripe.playfeniks.com. 10193 IN A 1.3.3.7

;; Query time: 1 msec;; SERVER: 1.1.1.1#53(1.1.1.1);; WHEN: Thu Sep 06 15:02:11 BST 2018;; MSG SIZE rcvd: 64

excluding one probe, out of the 1k sample all worked

Lessons

Please, if you are going to do RPKI:

● Sign your prefixes● Validate your inbound prefixes● Consider not having your default route

if you take a full table● Configure your RPKI validator

correctly (aka, add ARIN)

Shout outs● Huge thanks to Job for the 10GBE server and the helping with prefixes

○ Even though later on a qemu limitation ment I could barely do 150mbps :(● Nepal Research and Education Network (NREN)

○ For the APNIC prefix to test with● Japan Network Information Center / PPP-EXP

○ For the JPNIC prefix● NTT Communications

○ For the ARIN and RIPE prefix● LARUS Cloud Service Ltd

○ For the AFRINIC prefix

Shout outs● Huge thanks to Job for the 10GBE server and the helping with prefixes

○ Even though later on a qemu limitation ment I could barely do 150mbps :(● Nepal Research and Education Network (NREN)

○ For the APNIC prefix to test with● Japan Network Information Center / PPP-EXP

○ For the JPNIC prefix● NTT Communications

○ For the ARIN and RIPE prefix● LARUS Cloud Service Ltd

○ For the AFRINIC prefix

Questions? ( if I have time )

https://docs.google.com/spreadsheets/d/14gwdinxXAq-G3XBqJOxQfsrMpmfDAgaRK0z05TBq6UY/edit

https://drive.google.com/drive/folders/1j9XoapFo4vO4DFZ2o2htopZgcJ0uL3_b?usp=sharing

<- Spreadsheet Raw Data ->

@Benjojo12 / ben@benjojo.co.uk / $whois as206924 Measuring ... · ben@eshwil:~$ dig...

Documents

Whois - Addressing the Asia Pacifc

New WHOIS Studies Update - ICANN GNSO · 2018. 4. 17. · WHOIS Studies Update Liz Gasster. WHOIS Topics ... WHOIS service that reflect not only known deficiencies in the current

ICANN 52: All Things WHOIS

open resolvers whois - WikiLeaks

Is the WHOIS service a source for email addresses for ... · Is the WHOIS service a source for email addresses for spammers? ... WHOIS is a contributor to the receipt of spam,

Whois ipnetinfo

· # iostat 2 # tail -n 500 /var ... # Watch changeable data continuously 4-USERS -g admin -m sam -m sam ... # whois domain # dig domain # dig -x host # host google.com

Improving APNIC Whois Data Quality

APNIC WHOIS · 2018. 1. 23. · WHOIS eMail ARMS Master Database Source: APNIC NRTM . NRTM APNIC Master WHOIS NRTM feed NIR IRR . Query NRTM feed Server Pool Load Balancers IPv4 IPv6

ICANN GDPR and WHOIS Users Survey · 6/4/2018 · WHOIS has become an unreliable or less meaningful source of threat intelligence. The WHOIS contact data that is most relevant to

ICANN’s Whois Policy: Registry Obligations A “What is ICANN’s Whois Policy” Subteam Presentation By Kathy Kleiman

Whois-RWS: A RESTful Web Service for WHOIS Andy Newton, Chief Engineer

DigRight Park-n-Dig DIG STRONG. DIG FAST. DIG RIGHT. DIG

RIPE whois Database

WHOIS Task Force Report

WHOIS Policy Review Team - ICANN · WHOIS Policy Review Team . ... Issues in the WHOIS debate are varied. ... the words accuracy, privacy, anonymity, cost, policing, and SPAM

WHOIS Selling All the Pills

Text #ICANN49 Whois Studies Update. Text #ICANN49 Recent Developments Final two GNSO-commissioned Whois Studies just completed – on Whois Privacy & Proxy

Whois Whoin Diapers

WHOIS Misuse Study...WHOIS data, identified in a Task Force Report on WHOIS Services (GNSO, 2007) the possibility of misuse of WHOIS data for phishing and identity theft, among others