1

I don't understand when it said organization like IANA 'assign' block of IP address to RIRs. I mean did they just write this block belong to this RIR, this other block belong to that RIR, etc... and RIRs like "Yeah, when we send packages to other RIR server, we won't send if its source IP (the IP that send this packages) not within our IP block assigned by IANA and we definitely won't break that law". Or IANA have RIRs connect to IANA's servers and won't send packages to other RIR if their packages not follow the rule and assigned block range.

4

There are a number of misunderstandings in your question:

Did they just write this block belong to this RIR, this other block belong to that RIR, etc...

That is all that the IANA does (at least in respect of IP blocks), it does not have servers or routers that manage transfer of data to or from said IP blocks.

and RIRs like "Yeah, when we send packages to other RIR server, we won't send if its source IP (the IP that send this packages) not within our IP block assigned by IANA and we definitely won't break that law". Or IANA have RIRs connect to IANA's servers and won't send packages to other RIR if their packages not follow the rule and assigned block range.

RIRs just sub-divide the blocks and hand them out, they also don't have equipment on those blocks. So the whole question is a complete fallacy, neither IANA nor the RIRs facilitate data transfer, and are not directly responsible for route publication.

By the way, the term is packets, not packages, when referring to data moving on an IP network.


But let us assume what you actually mean, is "what stops anyone attempting to publicize IP ranges that don't belong to them over BGP?" BGP being the mechanism widely used to pass routes between different autonomous networks (ASNs).

The answer is lies in turning the question on its head: what allows them to publish routes in the first place?

Routes to IP blocks are published over BGP from your border routers (the ones that connect to other networks). The routes need to be passed over existing BGP sessions, so you already need to have sessions with other routers. This will typically be paid-transit ISPs or free-peering networks.

For them to accept your routes, you will have contractual obligations that say what you can and cannot do. They will then set up their routers to accept a BGP session. The other network will typically have some kind of filtering in place (for example RPKI) to prevent route spoofing.

If the other network does not have filtering mechanisms in place, then there is nothing to stop anyone publicizing a route for anyone else's IP ranges. This is called BGP hijacking, and is something that has been done accidentally and maliciously in the past, and something which networks are trying to prevent.

1

The assignment means "you may use addresses from this block/prefix on the open Internet".

Your ISP may require you to provide proof of assignment before announcing the prefix. Then that block prefix is announced on the open Internet, informing the other routers where your packets should be routed to.

If you're peering yourself with your own ASN and BGP routers, there's no further checking and you can announce the prefix on your border gateways. Of course, there may be filtering by your peers, so they may or may not accept a prefix announced by you.

If there are conflicting announcements/routes, routing will break - and only then will the delegation chain be checked.

Source addresses aren't that commonly screened, but you won't be able to receive replies for packets sent with a spoofed/non-assigned source address.

2
  • What prevent RIRs faking IP address?
    – ab ab
    Jun 18 at 17:02
  • 1
    Contractual obligations.
    – Zac67
    Jun 18 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.