Hacker News Reader

Comment by boondongle | Hacker News Reader

I wouldn't say you're mistaken, but it's a simplification. In the network world, the capability exists to restrict what BGP advertisements are accepted via RPKI/a peer. Internet providers usually don't because the premium is placed on uptime/connectivity.

If tomorrow, everyone said "we don't want IP's from Frankfurt showing up somewhere in Dubai", you'd have a massive technical problem and rearranging to start with but once that was sorted you could geo-lock. IANA and Network providers simply haven't been doing that.

The reason it doesn't happen is Devs/Stakeholders want uptime from ISPs/Networks and not something they can't abstract. Basically its just a status quo much like the entire internet reverse-proxying through CDNs is a status quo. It wasn't always like that, and it may not always be like that in the future - just depends which way the winds blow over time.

View on HN

> we don't want IP's from Frankfurt showing up somewhere in Dubai

what do you mean, IPs from Frankfurt?

IP addresses are just IP addresses, they know no geographical boundaries. In RIR DBs you can geolocate them to wherever you want. Which is the entire reason why Geo IP DBs even exist - they triangulate.

> "we don't want IP's from Frankfurt showing up somewhere in Dubai"

From a network perspective statements like that make no sense. IP addresses don't have any sort of physicality,

They have registration data. Someone could declare they don't want IPs registered to companies from Frankfurt with geofeeds in Frankfurt to be advertised in Dubai.

It’s not how any of it works.

How do you determine to whom an IP is even registered to? They get sub-leased all the time.

The best you can do is check who has administrative control over the prefixes RIR info, but that doesn’t mean that anyone with control is the factual user of the IPs.

You could check the IRR for the ASN and base it on that, but still.

There's also no way to actually know _where_ an IP actually originates from. Only its AS path.

The DFZ contains all prefixes announced everywhere, for the internet is completely decentralized.

> How do you determine to whom an IP is even registered to?

You check the RIR's records.

> They get sub-leased all the time.

With records updated. If not, any consequences from wrong information fall on the lessor and lessee.

> There's also no way to actually know _where_ an IP actually originates from. Only its AS path.

Ping time from different locations on their upstream AS gives a good guess.

> With records updated. If not, any consequences from wrong information fall on the lessor and lessee.

Not always + there are no consequences whatsoever.

Plenty of leasing services will just provide you with IRR & RPKI, without ever touching the actual records.

> Ping time from different locations on their upstream AS gives a good guess.

Upstream AS is meaningless if it's a T1 carrier. Ping AS6939. They are everywhere.

Ping a specific address of AS6939 and find out where it is.

https://bgp.tools/as/6939#prefixes

They are everywhere. It's a global carrier. Carriers also know no geographic boundaries.

ns1.he.net - 216.218.130.2, is simultaneously in

Texas (measured from Texas):

  8  port-channel13.core4.dal1.he.net (184.104.196.170)  1.830 ms  1.969 ms *
  9  ns1.he.net (216.218.130.2)  1.539 ms  1.560 ms  1.555 ms

Virginia (measured from Maryland):

  11  port-channel2.core1.ash1.he.net (184.105.222.174)  19.666 ms 24.395 ms *
  12  ns1.he.net (216.218.130.2)  16.748 ms  17.268 ms  20.507 ms

And California (measured from California):

  8  port-channel13.core1.fmt2.he.net (184.104.188.144)  3.830 ms be7.core1.sjc1.he.net (72.52.92.132)  5.197 ms port-channel13.core1.fmt2.he.net (184.104.188.144)  3.901 ms
  9  ns1.he.net (216.218.130.2)  2.600 ms  2.435 ms  2.728 ms

The speed of light doesn't lie, IP addresses don't have any sort of physicality.

Reply on news.ycombinator.com