1

I've read that ICANN is the authority dedicated to assigning IP addresses to individual entities, so that no two separate entities are using the same IP address on the internet. It is my understanding that when assigning an IP address, an autonomous system number is also given to the entity. These autonomous system numbers are used by routers in some way to advertise that they have a route to an IP address.

My question is, how does a router know that a route and autonomous system number that they receive from a BGP peer is authentic? Is there a certificate chain of some kind used to prove that the route does indeed go to the entity that ICANN did assign the IP address to? Since an IP address can be multi homed with two or more routes to it, just because there are two routes known by a router doesn't mean that one of them is not real.

Does ICANN regularly publish a list of autonomous system numbers that routers cache?

Can routers choose to ignore ICANN's assignment of IP addresses, in the event that ICANN goes rogue? What's stopping an alt_ICANN from being created and the internet choosing to trust it instead?

Improve this question
0

1 Answer 1

Reset to default
1

I've read that ICANN is the authority dedicated to assigning IP addresses to individual entities

ICANN's IANA department only assigns large blocks to five RIRs and doesn't deal with individual users directly. (See the current assignments for IPv4 and IPv6.) Each RIR then implements its own registry and policies.

My question is, how does a router know that a route and autonomous system number that they receive from a BGP peer is authentic?

It doesn't.

Though, there are various attempts to improve it, in particular routing registries (IRRs) – they have a database of route entries (binding a prefix to an AS), can use RPKI to digitally sign those, and RPSL for describing what an AS is supposed to export and import.

Unfortunately, few routers support using an IRR directly. (The upcoming BIRD 2.x will have native support via rtrlib, although prefix filtering only – not full RPKI.)

More often, a separate tool such as bgpq3 is used to interpret IRR data, build a prefix list for a specific AS, which the admin copy-pastes into the router's configuration.

Finally some BGP sessions just have filters built by hand...

Can routers choose to ignore ICANN's assignment of IP addresses, in the event that ICANN goes rogue?

Routers absolutely do not care about ICANN.

Improve this answer
3
  • When you say routers absolutely do not care about ICANN, do you also mean they don't care about the five RIRs?
    – user1748155
    Jan 12, 2017 at 6:00
  • 1
    I'm surprised that RPKI or something like it hasn't taken off. Sounds like the current system is fairly fragile, mainly based on fear of being blacklisted rather than a more systematic solution.
    – user1748155
    Jan 12, 2017 at 6:04
  • If most RIRs have a database or route entries using RPSL, why are there more routing registries (irr.net/docs/list.html) in the IRR than the RIRs? How does one decide to use their RIR's registry versus another one?
    – user1748155
    Jan 20, 2017 at 6:05

Not the answer you're looking for? Browse other questions tagged .