Projet

Général

Profil

BGP » Historique » Version 187

Matthieu Herrb, 17/02/2017 22:47
bortz sur RFC1997

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 175 Laurent GUERBY
h2. Liens
6 175 Laurent GUERBY
7 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
8 1 Laurent GUERBY
9 1 Laurent GUERBY
http://bird.network.cz/
10 1 Laurent GUERBY
11 184 Laurent GUERBY
simulation de l'internet
12 184 Laurent GUERBY
https://www.nsec.io/
13 184 Laurent GUERBY
https://github.com/nsec/the-internet
14 184 Laurent GUERBY
15 185 Laurent GUERBY
https://www.franceix.net/fr/technical/blackholing/
16 185 Laurent GUERBY
BLACKHOLE Community https://tools.ietf.org/html/rfc7999
17 185 Laurent GUERBY
18 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
19 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
20 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
21 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
22 65 Laurent GUERBY
https://stat.ripe.net/widget/announced-prefixes
23 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
24 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
25 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
26 52 Laurent GUERBY
http://tools.ietf.org/html/draft-lapukhov-bgp-routing-large-dc-02
27 14 Laurent GUERBY
28 43 Laurent GUERBY
http://inside.godaddy.com/inside-story-happened-godaddy-com-sept-10-2012/
29 43 Laurent GUERBY
30 67 Laurent GUERBY
liste des communautés des opérateurs http://onesc.net/communities/ via http://www.bortzmeyer.org/7153.html
31 66 Laurent GUERBY
32 55 Laurent GUERBY
http://tools.ietf.org/html/rfc4271#section-9.1 BGP route decision process
33 55 Laurent GUERBY
34 29 Laurent GUERBY
http://www.ipbcop.org/
35 29 Laurent GUERBY
IP Best Current Operational Practices Documented best practices for Engineers by Engineers
36 29 Laurent GUERBY
37 30 Laurent GUERBY
BGP best practices ANSSI
38 30 Laurent GUERBY
https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Article-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf_2.pdf
39 62 Laurent GUERBY
http://www.ssi.gouv.fr/fr/bonnes-pratiques/recommandations-et-guides/securite-des-reseaux/le-guide-des-bonnes-pratiques-de-configuration-de-bgp.html
40 64 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-opsec-bgp-security-01
41 179 Laurent GUERBY
http://www.ssi.gouv.fr/uploads/2014/10/rapport_observatoire_2015.pdf
42 30 Laurent GUERBY
43 37 Laurent GUERBY
https://www.ams-ix.net/technical/specifications-descriptions/ams-ix-route-servers
44 37 Laurent GUERBY
45 39 Laurent GUERBY
these LAAS BGP http://www.laas.fr/1-31360-Detail-Soutenance-de-these.php?id=600
46 41 Laurent GUERBY
http://www.laas.fr/1-31706-Publications.php?author=7738
47 1 Laurent GUERBY
http://www.net.t-labs.tu-berlin.de/papers/OMUPMO-OOSICP-11.pdf
48 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/60/53/83/PDF/dVirt-virtual_platform.pdf
49 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/48/70/74/PDF/Poster_SIGCOMM2010_philippe.pdf
50 40 Laurent GUERBY
51 44 Laurent GUERBY
Le monde sur BGP http://reseaux.blog.lemonde.fr/2012/11/04/routage-enjeu-cyberstrategie/
52 44 Laurent GUERBY
53 45 Laurent GUERBY
coupure free wanadoo http://www.journaldunet.com/solutions/0301/030122_freeft.shtml
54 45 Laurent GUERBY
55 46 Laurent GUERBY
tsunami Japon 2011 et BGP : http://archive.psg.com/111206.conext-quake.pdf
56 46 Laurent GUERBY
57 47 Laurent GUERBY
Session is up on telnet:route-views.routeviews.org username rviews
58 47 Laurent GUERBY
59 48 Laurent GUERBY
BGP book http://www.bortzmeyer.org/files/bgp.html
60 48 Laurent GUERBY
61 49 Laurent GUERBY
Cyclops is able to detect several forms of route hijack attacks http://cyclops.cs.ucla.edu/
62 50 Laurent GUERBY
BGPmon monitors the routing of your prefixes and alerts you in case of an 'interesting' path chang http://www.bgpmon.net/
63 49 Laurent GUERBY
64 53 Laurent GUERBY
http://jointtransit.nl/prices.html
65 53 Laurent GUERBY
66 54 Laurent GUERBY
http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho
67 54 Laurent GUERBY
68 51 Laurent GUERBY
* taille table de routage http://bgp.potaroo.net/
69 1 Laurent GUERBY
70 65 Laurent GUERBY
* BGP	in	2011	 Geoff	Huston	 APNIC http://iepg.org/2011-11-ietf82/2011-11-13-bgp2011.pdf
71 56 Laurent GUERBY
72 57 Laurent GUERBY
* http://pages.cs.wisc.edu/~plonka/netgear-sntp/
73 57 Laurent GUERBY
74 58 Laurent GUERBY
* http://www.afnic.fr/fr/l-afnic-en-bref/actualites/actualites-generales/7114/show/l-observatoire-sur-la-resilience-de-l-internet-francais-publie-son-rapport-2012.html
75 58 Laurent GUERBY
76 59 Laurent GUERBY
* http://www.ris.ripe.net/dashboard/2a01:6600:8000::/40
77 59 Laurent GUERBY
78 60 Laurent GUERBY
* http://www.bortzmeyer.org/6996.html
79 60 Laurent GUERBY
** RFC 6996 : Autonomous System (AS) Reservation for Private Use
80 60 Laurent GUERBY
** http://www.iana.org/assignments/as-numbers
81 60 Laurent GUERBY
82 61 Laurent GUERBY
* Look for TRACEROUTE by SRCGUARDIAN in the Play Store.   It needs network access only...  Doesn't do TCP but does ICMP and UDP traceroutes and displays ASN as well ...
83 61 Laurent GUERBY
84 63 Laurent GUERBY
* http://www.team-cymru.org/Services/Bogons/bgp.html
85 63 Laurent GUERBY
** http://www.team-cymru.org/Services/Bogons/bgp-examples.html#bird-full
86 175 Laurent GUERBY
87 175 Laurent GUERBY
* 3D looking glass  http://as2914.net/#/
88 63 Laurent GUERBY
89 177 Laurent GUERBY
* https://labs.ripe.net/Members/emileaben/has-the-routability-of-longer-than-24-prefixes-changed
90 177 Laurent GUERBY
91 183 Laurent GUERBY
* https://github.com/pavel-odintsov/fastnetmon
92 183 Laurent GUERBY
** FastNetMon - A high performance DoS/DDoS load analyzer built on top of multiple packet capture engines (NetFlow, IPFIX, sFLOW, SnabbSwitch, netmap, PF_RING, PCAP).
93 183 Laurent GUERBY
** What can we do? We can detect hosts in our networks sending or receiving large volumes of packets/bytes/flows per second. We can call an external script to notify you, switch off a server, or blackhole the client.
94 183 Laurent GUERBY
95 186 Laurent GUERBY
* https://www.redpill-linpro.com/sysadvent/2016/12/09/slimming-routing-table.html
96 186 Laurent GUERBY
97 187 Matthieu Herrb
* http://www.bortzmeyer.org/1997.html sur les communautés BGP
98 187 Matthieu Herrb
99 182 Laurent GUERBY
h2. Baker-s Dozen
100 182 Laurent GUERBY
101 181 Laurent GUERBY
* Baker's Dozen BGP transit players
102 181 Laurent GUERBY
** http://research.dyn.com/2008/12/winners-and-losers-for-2008/
103 181 Laurent GUERBY
** http://research.dyn.com/2009/12/a-bakers-dozen-in-2009/
104 181 Laurent GUERBY
** http://research.dyn.com/2011/01/a-bakers-dozen-2010-edition/
105 181 Laurent GUERBY
** http://research.dyn.com/2012/02/a-bakers-dozen-2011-edition/
106 181 Laurent GUERBY
** http://research.dyn.com/2012/02/a-bakers-dozen-2012-edition/
107 181 Laurent GUERBY
** http://research.dyn.com/2012/02/a-bakers-dozen-2013-edition/
108 181 Laurent GUERBY
** http://research.dyn.com/2012/02/a-bakers-dozen-2014-edition/
109 181 Laurent GUERBY
** http://research.dyn.com/2016/04/a-bakers-dozen-2015-edition/
110 182 Laurent GUERBY
*** https://cdn.vpls.com/wp-content/uploads/WP033-Bakers-Dozen-2015.pdf
111 180 Laurent GUERBY
112 171 Laurent GUERBY
h1. Bird
113 171 Laurent GUERBY
114 171 Laurent GUERBY
h2. Link local IPv6 static route
115 171 Laurent GUERBY
116 171 Laurent GUERBY
<pre>
117 171 Laurent GUERBY
    protocol direct {
118 171 Laurent GUERBY
      interface "eth0";
119 171 Laurent GUERBY
    }
120 171 Laurent GUERBY
121 171 Laurent GUERBY
    protocol static {
122 171 Laurent GUERBY
      route 2001:db8::/32 via fe80::1%eth0;
123 171 Laurent GUERBY
    }
124 171 Laurent GUERBY
</pre>
125 171 Laurent GUERBY
126 172 Laurent GUERBY
h2. Gitoyen BIRD config
127 172 Laurent GUERBY
128 172 Laurent GUERBY
https://code.ffdn.org/gitoyen/bird-config/
129 171 Laurent GUERBY
130 176 Laurent GUERBY
Et autres outils dont le blackholing automatique : https://code.ffdn.org/org/gitoyen
131 176 Laurent GUERBY
132 173 Laurent GUERBY
h2. Misc BIRD Links
133 173 Laurent GUERBY
134 173 Laurent GUERBY
* zeromq integration https://github.com/samrussell/bird/tree/zmqintegration
135 174 Laurent GUERBY
* https://www.netdev01.org/docs/prabhu-linux_ipv4_ipv6_inconsistencies_talk_slides.pdf
136 173 Laurent GUERBY
137 178 Baptiste Jonglez
h1. mrtdump
138 178 Baptiste Jonglez
139 178 Baptiste Jonglez
mrtdump est un format standard pour représenter et stocker des données BGP (table de routage, messages BGP) : https://tools.ietf.org/html/rfc6396
140 178 Baptiste Jonglez
141 178 Baptiste Jonglez
h2. Dump mrtdump avec Bird
142 178 Baptiste Jonglez
143 178 Baptiste Jonglez
h3. Dump de tous les messages BGP échangés avec les pairs
144 178 Baptiste Jonglez
145 178 Baptiste Jonglez
<pre>
146 178 Baptiste Jonglez
mrtdump "/tmp/mrtdump-messages";
147 178 Baptiste Jonglez
mrtdump protocols {messages};
148 178 Baptiste Jonglez
</pre>
149 178 Baptiste Jonglez
150 178 Baptiste Jonglez
Cf. doc bird : http://bird.network.cz/?get_doc&f=bird-3.html#ss3.2
151 178 Baptiste Jonglez
152 178 Baptiste Jonglez
Pour "rotate" le fichier de dump, changer le nom du fichier dans la configuration bird et faire `birdc configure`.
153 178 Baptiste Jonglez
154 178 Baptiste Jonglez
h3. Dump de la table de routage BGP
155 178 Baptiste Jonglez
156 178 Baptiste Jonglez
Ce n'est pas encore possible mais en développement dans Bird, cf. branche *mrtdump* upstream.
157 178 Baptiste Jonglez
158 178 Baptiste Jonglez
Doc : https://gitlab.labs.nic.cz/labs/bird/commit/11fabd2d6b8bc3d6ca86acd3b62fe4deeb4b91b7
159 178 Baptiste Jonglez
160 178 Baptiste Jonglez
h2. Sources de données mrtdump publiques
161 178 Baptiste Jonglez
162 178 Baptiste Jonglez
* RIS (Routing Information Service) :
163 178 Baptiste Jonglez
164 178 Baptiste Jonglez
  * routes BGP collectées par le RIPE depuis plusieurs points d'échanges (16 collecteurs en tout)
165 178 Baptiste Jonglez
  * données collectées et archivées depuis 2001
166 178 Baptiste Jonglez
  * https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/routing-information-service-ris
167 178 Baptiste Jonglez
  * données en libre accès https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/ris-raw-data
168 178 Baptiste Jonglez
169 178 Baptiste Jonglez
* Routeviews :
170 178 Baptiste Jonglez
171 178 Baptiste Jonglez
  * même idée, mais moins centré sur l'Europe (projet mené par des américains)
172 178 Baptiste Jonglez
  * http://www.routeviews.org/
173 178 Baptiste Jonglez
  * données en libre accès ftp://archive.routeviews.org/
174 178 Baptiste Jonglez
175 178 Baptiste Jonglez
h2. Exploitation des données mrtdump
176 178 Baptiste Jonglez
177 178 Baptiste Jonglez
* outil historique : *bgpdump* https://bitbucket.org/ripencc/bgpdump/wiki/Home
178 178 Baptiste Jonglez
* plus récent : *bgpstream* https://bgpstream.caida.org/  https://github.com/CAIDA/bgpstream https://pypi.python.org/pypi/pybgpstream
179 178 Baptiste Jonglez
180 178 Baptiste Jonglez
bgpstream est plutôt fait pour récupérer automatiquement les données de RIS et Routeviews (d'ailleurs parfois ça ne marche pas super bien...).  C'est aussi possible de lire des fichiers mrtdump locaux, par exemple avec les bindings python :
181 178 Baptiste Jonglez
182 178 Baptiste Jonglez
<pre>
183 178 Baptiste Jonglez
from _pybgpstream import BGPStream, BGPRecord, BGPElem
184 178 Baptiste Jonglez
record = BGPRecord()
185 178 Baptiste Jonglez
stream = BGPStream()
186 178 Baptiste Jonglez
stream.set_data_interface("singlefile")
187 178 Baptiste Jonglez
stream.set_data_interface_option("singlefile", "rib-file", myfilename)
188 178 Baptiste Jonglez
# Add additional filters here
189 178 Baptiste Jonglez
stream.start()
190 178 Baptiste Jonglez
# etc (cf. tutorial bgpstream)
191 178 Baptiste Jonglez
</pre>
192 178 Baptiste Jonglez
193 178 Baptiste Jonglez
194 38 Laurent GUERBY
h1. TouIX et GIX
195 38 Laurent GUERBY
196 38 Laurent GUERBY
http://touix.net
197 38 Laurent GUERBY
http://wikilulu.net/doku.php?id=articles:gix-howto
198 38 Laurent GUERBY
199 3 Laurent GUERBY
h1. Evolutions de la conf BGP
200 3 Laurent GUERBY
201 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
202 3 Laurent GUERBY
203 5 Laurent GUERBY
TODO: 
204 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
205 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
206 5 Laurent GUERBY
* Atelier ?
207 7 Laurent GUERBY
** Laurent GUERBY
208 9 Raphaël Durand
** Solarus
209 10 Raphaël Durand
** Ajouter son nom...
210 4 Laurent GUERBY
211 13 Laurent GUERBY
Alternative a MP BGP
212 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
213 13 Laurent GUERBY
214 31 Laurent GUERBY
Add Path
215 31 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-add-paths-07
216 31 Laurent GUERBY
support in bird ? http://marc.info/?l=bird-users&m=134409996129466&w=2
217 31 Laurent GUERBY
218 2 Laurent GUERBY
h1. Liens
219 2 Laurent GUERBY
220 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
221 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
222 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
223 19 Laurent GUERBY
* bonnes pratiques incidents BGP
224 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
225 35 Laurent GUERBY
* test ping plus UDP http://www.broadband-forum.org/technical/download/TR-143.pdf
226 2 Laurent GUERBY
227 1 Laurent GUERBY
h1. Configuration Toulouse
228 1 Laurent GUERBY
229 1 Laurent GUERBY
<pre>
230 1 Laurent GUERBY
router id 91.224.148.2;
231 1 Laurent GUERBY
define myas = 197422;
232 1 Laurent GUERBY
233 1 Laurent GUERBY
234 1 Laurent GUERBY
protocol device {
235 1 Laurent GUERBY
	scan time 10;
236 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
237 1 Laurent GUERBY
}
238 1 Laurent GUERBY
239 1 Laurent GUERBY
protocol static static_bgp {
240 1 Laurent GUERBY
	import all;
241 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
242 1 Laurent GUERBY
}
243 1 Laurent GUERBY
244 1 Laurent GUERBY
245 1 Laurent GUERBY
protocol kernel{
246 1 Laurent GUERBY
	import all;
247 1 Laurent GUERBY
	export all;
248 1 Laurent GUERBY
}
249 1 Laurent GUERBY
250 1 Laurent GUERBY
251 1 Laurent GUERBY
function avoid_martians()
252 1 Laurent GUERBY
prefix set martians;
253 1 Laurent GUERBY
{
254 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
255 1 Laurent GUERBY
256 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
257 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
258 1 Laurent GUERBY
259 1 Laurent GUERBY
  # Avoid too short and too long prefixes
260 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
261 1 Laurent GUERBY
262 1 Laurent GUERBY
  # Avoid RFC1918 networks
263 1 Laurent GUERBY
  if net ~ martians then return false;
264 1 Laurent GUERBY
  return true;
265 1 Laurent GUERBY
}
266 1 Laurent GUERBY
267 1 Laurent GUERBY
filter bgp_OUT {
268 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
269 1 Laurent GUERBY
	else reject;
270 1 Laurent GUERBY
}
271 1 Laurent GUERBY
272 1 Laurent GUERBY
273 1 Laurent GUERBY
protocol bgp TOUIX {
274 1 Laurent GUERBY
        local as myas;
275 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
276 1 Laurent GUERBY
        preference 200;
277 1 Laurent GUERBY
        import where avoid_martians();
278 1 Laurent GUERBY
        export filter bgp_OUT;
279 1 Laurent GUERBY
}
280 1 Laurent GUERBY
281 1 Laurent GUERBY
protocol bgp JAGUAR {
282 1 Laurent GUERBY
	 local as myas;
283 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
284 1 Laurent GUERBY
	 preference 50;
285 1 Laurent GUERBY
         import where avoid_martians();
286 1 Laurent GUERBY
         export filter bgp_OUT;
287 1 Laurent GUERBY
}
288 1 Laurent GUERBY
289 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
290 1 Laurent GUERBY
	local as myas;
291 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
292 1 Laurent GUERBY
	preference 100;
293 1 Laurent GUERBY
	import where avoid_martians();
294 1 Laurent GUERBY
	export all;
295 1 Laurent GUERBY
}
296 1 Laurent GUERBY
</pre>
297 20 Laurent GUERBY
298 33 Laurent GUERBY
h1. IRR
299 33 Laurent GUERBY
300 33 Laurent GUERBY
* From nanog:
301 33 Laurent GUERBY
http://www.clarksys.com/blog/2009/09/02/using-irr-with-level3/
302 33 Laurent GUERBY
whois -h filtergen.level3.net "RIPE::YOUR-AS-SET  -searchpath=RIPE;ARIN;RADB -recurseok -warnonly"
303 33 Laurent GUERBY
304 20 Laurent GUERBY
h1. Blackholing
305 20 Laurent GUERBY
306 160 Laurent GUERBY
h2. DECIX
307 160 Laurent GUERBY
308 160 Laurent GUERBY
http://de-cix.net/products-services/de-cix-frankfurt/blackholing/
309 160 Laurent GUERBY
310 24 Laurent GUERBY
h2. Attaques
311 24 Laurent GUERBY
312 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
313 36 Laurent GUERBY
* http://blog.cloudflare.com/65gbps-ddos-no-problem
314 24 Laurent GUERBY
315 1 Laurent GUERBY
h2. URPF
316 34 Laurent GUERBY
317 65 Laurent GUERBY
blacklister une/plusieures sources est relativement complexe à mettre en place sur une petite infrastructure car nécessite la mise en place de l'URPF (Unicast Reverse Path Forwarding).
318 34 Laurent GUERBY
319 34 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/ipv6_rtbh.html
320 34 Laurent GUERBY
321 20 Laurent GUERBY
h2. RFC3882 
322 1 Laurent GUERBY
323 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
324 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
325 1 Laurent GUERBY
326 22 Laurent GUERBY
* doc CISCO
327 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
328 22 Laurent GUERBY
329 28 Laurent GUERBY
h2. RFC1997
330 28 Laurent GUERBY
331 28 Laurent GUERBY
* http://www.ietf.org/rfc/rfc1997.txt
332 28 Laurent GUERBY
BGP Communities Attribute
333 28 Laurent GUERBY
334 28 Laurent GUERBY
* doc CISCO
335 28 Laurent GUERBY
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_6-2/bgp_communities.html
336 28 Laurent GUERBY
337 22 Laurent GUERBY
h2. BIRD
338 22 Laurent GUERBY
339 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
340 1 Laurent GUERBY
341 24 Laurent GUERBY
h2. Absolight
342 24 Laurent GUERBY
343 65 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
344 65 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
345 24 Laurent GUERBY
346 22 Laurent GUERBY
h2. GIXE
347 1 Laurent GUERBY
348 65 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
349 65 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
350 1 Laurent GUERBY
351 1 Laurent GUERBY
h2. Jaguar 
352 22 Laurent GUERBY
353 24 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
354 65 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
355 65 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
356 22 Laurent GUERBY
357 27 Laurent GUERBY
h2. Gitoyen
358 27 Laurent GUERBY
359 65 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
360 28 Laurent GUERBY
* Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
361 65 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
362 28 Laurent GUERBY
* Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
363 32 Laurent GUERBY
* https://pad.ilico.org/p/cleanup-bgp-gitoyen
364 22 Laurent GUERBY
365 22 Laurent GUERBY
h2. France-IX
366 22 Laurent GUERBY
367 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
368 26 Laurent GUERBY
* TODO tester
369 22 Laurent GUERBY
370 22 Laurent GUERBY
h2. Equinix-IX
371 1 Laurent GUERBY
372 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
373 26 Laurent GUERBY
* TODO tester
374 22 Laurent GUERBY
375 1 Laurent GUERBY
h2. TouIX
376 22 Laurent GUERBY
377 26 Laurent GUERBY
* demande acces switch et route server 20120702
378 22 Laurent GUERBY
* TODO
379 1 Laurent GUERBY
380 1 Laurent GUERBY
h2. Hurricane Electric
381 1 Laurent GUERBY
382 26 Laurent GUERBY
* http://www.he.net/adm/
383 1 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
384 1 Laurent GUERBY
* TODO tester
385 28 Laurent GUERBY
386 28 Laurent GUERBY
h2. Sfinx
387 28 Laurent GUERBY
388 28 Laurent GUERBY
* http://www.renater.fr/route-servers-bgp?lang=fr
389 28 Laurent GUERBY
* whois  AS1304 =>
390 28 Laurent GUERBY
remarks:        1304:65281 = Apply NO-EXPORT community
391 28 Laurent GUERBY
remarks:        1304:65282 = Apply NO-ADVERTISE community
392 161 Laurent GUERBY
393 161 Laurent GUERBY
h2. Cogent
394 161 Laurent GUERBY
395 166 Laurent GUERBY
h3. Docs
396 166 Laurent GUERBY
397 161 Laurent GUERBY
* http://www.cogentco.com/files/docs/customer_service/guide/global_cogent_customer_user_guide.pdf
398 162 Laurent GUERBY
** communautés page 21-22
399 169 Laurent GUERBY
* http://www.onesc.net/communities/as174/
400 170 Laurent GUERBY
* https://www.nanog.org/mailinglist/mailarchives/old_archive/2005-03/msg00465.html
401 166 Laurent GUERBY
* https://www.nanog.org/meetings/nanog45/presentations/Sunday/RAS_traceroute_N45.pdf
402 1 Laurent GUERBY
403 162 Laurent GUERBY
France / Benelux:
404 162 Laurent GUERBY
+33 1 49 03 1818 (Hotline)
405 162 Laurent GUERBY
+33 1 49 03 1803 (fax)
406 162 Laurent GUERBY
fr-support@cogentco.com (maintenance and repair)
407 162 Laurent GUERBY
bnl-support@cogentco.com (maintenance and repair))
408 162 Laurent GUERBY
billingeu@cogentco.com (billing, customer care)
409 162 Laurent GUERBY
All Customers in Europe can also contact the European Cogent Customer Support team
410 162 Laurent GUERBY
using the generic email address for Europe: eu-support@cogentco.com 
411 162 Laurent GUERBY
412 164 Laurent GUERBY
Livré comme demandé sur rocade optique Fullsave :
413 164 Laurent GUERBY
Livré sur TLS01.CB.KD-05/A.To02.03&04 (tiroir optique N°2, fibre 03&04).
414 165 Laurent GUERBY
Cogent physical port te0/0/2/3-rcr11.tls01
415 164 Laurent GUERBY
416 163 Laurent GUERBY
Order ID/Service ID: 1-166108500
417 163 Laurent GUERBY
Service Type: EU_L3_ON_10GE_BURST
418 163 Laurent GUERBY
Commitment: 1000.0 MBps
419 163 Laurent GUERBY
Service Address: 125 bis ch du Sang de Serp
420 163 Laurent GUERBY
livraison dans baie Fullsave / salle LAP Te0/0/2/3 rcr01.tls01 -- > TLS01.CB.KD-05/A.To02.03&04
421 163 Laurent GUERBY
Toulouse, FR France 31000
422 163 Laurent GUERBY
Your service acceptance date is 27-May-2014 and your billing start date is 27-May-2014
423 163 Laurent GUERBY
424 163 Laurent GUERBY
Order ID/Service ID: 1-166108524
425 163 Laurent GUERBY
Service Type: EU_L3_ON_IPV6DSTACK_FLAT
426 163 Laurent GUERBY
Commitment: 0.0 MBps
427 163 Laurent GUERBY
Service Address: 125 bis ch du Sang de Serp
428 163 Laurent GUERBY
IPv6s fort port order 1-166108500
429 163 Laurent GUERBY
Toulouse, FR France 31000
430 163 Laurent GUERBY
Your service acceptance date is 27-May-2014 and your billing start date is 27-May-2014
431 163 Laurent GUERBY
432 163 Laurent GUERBY
Order ID/Service ID: 1-166108512
433 163 Laurent GUERBY
Service Type: EU_L0_ON_XCFIBER_FLAT
434 163 Laurent GUERBY
Commitment: 0.0 MBps
435 163 Laurent GUERBY
Service Address: 125 bis ch du Sang de Serp
436 163 Laurent GUERBY
Te0/0/2/3 rcr01.tls01 -- > TLS01.CB.KD-05/A.To02.03&04 port order 1-166108500
437 163 Laurent GUERBY
Toulouse, FR France 31000
438 163 Laurent GUERBY
Your service acceptance date is 27-May-2014 and your billing start date is 27-May-2014
439 162 Laurent GUERBY
440 162 Laurent GUERBY
h3. Config initiale BGP Cogent
441 162 Laurent GUERBY
442 161 Laurent GUERBY
<pre>
443 161 Laurent GUERBY
root@h7:~# cat /etc/bird/bird.conf
444 161 Laurent GUERBY
router id 149.11.58.74;
445 161 Laurent GUERBY
446 161 Laurent GUERBY
define myas = 197422;
447 161 Laurent GUERBY
448 161 Laurent GUERBY
timeformat base     iso long;
449 161 Laurent GUERBY
timeformat log      iso long;
450 161 Laurent GUERBY
timeformat protocol iso long;
451 161 Laurent GUERBY
timeformat route    iso long;
452 161 Laurent GUERBY
453 161 Laurent GUERBY
log "/var/log/bird/bird-20140527.log" all;
454 161 Laurent GUERBY
455 161 Laurent GUERBY
debug commands 2;
456 161 Laurent GUERBY
457 161 Laurent GUERBY
debug protocols { states, events };
458 161 Laurent GUERBY
459 161 Laurent GUERBY
protocol device {
460 161 Laurent GUERBY
        scan time 10;
461 161 Laurent GUERBY
}
462 161 Laurent GUERBY
463 161 Laurent GUERBY
protocol kernel {
464 161 Laurent GUERBY
        import all;
465 161 Laurent GUERBY
        export all;
466 161 Laurent GUERBY
        learn;
467 161 Laurent GUERBY
}
468 161 Laurent GUERBY
469 161 Laurent GUERBY
filter bgp_OUT {
470 167 Laurent GUERBY
        if (net ~ [91.224.148.0/23, 80.67.182.0/24, 89.234.156.0/23]) then {
471 167 Laurent GUERBY
          accept;
472 167 Laurent GUERBY
        }
473 161 Laurent GUERBY
        reject;
474 161 Laurent GUERBY
}
475 161 Laurent GUERBY
476 161 Laurent GUERBY
filter bgp_IN_PEERING {
477 161 Laurent GUERBY
       accept;
478 161 Laurent GUERBY
}
479 161 Laurent GUERBY
480 161 Laurent GUERBY
protocol bgp COGENT_TLS00 {
481 161 Laurent GUERBY
        local as myas;
482 161 Laurent GUERBY
        neighbor 149.11.58.73 as 174;
483 161 Laurent GUERBY
        import filter bgp_IN_PEERING;
484 161 Laurent GUERBY
        export filter bgp_OUT;
485 161 Laurent GUERBY
}
486 161 Laurent GUERBY
root@h7:~# cat /etc/bird/bird6.conf
487 161 Laurent GUERBY
router id 149.11.58.74;
488 161 Laurent GUERBY
489 161 Laurent GUERBY
define myas = 197422;
490 161 Laurent GUERBY
491 161 Laurent GUERBY
timeformat base     iso long;
492 161 Laurent GUERBY
timeformat log      iso long;
493 161 Laurent GUERBY
timeformat protocol iso long;
494 161 Laurent GUERBY
timeformat route    iso long;
495 161 Laurent GUERBY
496 161 Laurent GUERBY
log "/var/log/bird/bird6-20140527.log" all;
497 161 Laurent GUERBY
498 161 Laurent GUERBY
debug commands 2;
499 161 Laurent GUERBY
500 161 Laurent GUERBY
debug protocols { states, events };
501 161 Laurent GUERBY
502 161 Laurent GUERBY
listen bgp v6only;
503 161 Laurent GUERBY
504 161 Laurent GUERBY
protocol device {
505 161 Laurent GUERBY
        scan time 10;
506 161 Laurent GUERBY
}
507 161 Laurent GUERBY
508 161 Laurent GUERBY
protocol kernel {
509 161 Laurent GUERBY
        import all;
510 161 Laurent GUERBY
        export all;
511 161 Laurent GUERBY
        learn;
512 161 Laurent GUERBY
}
513 161 Laurent GUERBY
514 161 Laurent GUERBY
filter bgp_OUT_6 {
515 168 Laurent GUERBY
        if (net ~ [2a01:6600:8000::/40]) then {
516 168 Laurent GUERBY
          accept;
517 168 Laurent GUERBY
        }
518 161 Laurent GUERBY
        reject;
519 161 Laurent GUERBY
}
520 161 Laurent GUERBY
521 161 Laurent GUERBY
filter bgp_IN_PEERING_6 {
522 161 Laurent GUERBY
       accept;
523 161 Laurent GUERBY
}
524 161 Laurent GUERBY
525 161 Laurent GUERBY
protocol bgp COGENT_TLS00_6 {
526 161 Laurent GUERBY
        local as myas;
527 161 Laurent GUERBY
        neighbor 2001:978:2:68::8:1 as 174;
528 161 Laurent GUERBY
        import filter bgp_IN_PEERING_6;
529 161 Laurent GUERBY
        export filter bgp_OUT_6;
530 161 Laurent GUERBY
}
531 161 Laurent GUERBY
</pre>