Internet2 Network Security SIG

[Andrew Gallo <>]

There were a couple of questions either in our WG meeting, in the RPKI 
session, or from other conversations that I can provide at least some 
updates on.

Memory footprint of RPKI:
On a Juniper router, I have one session each to two RIPE Validators. 
The memory usage is about 14MB for just under 90,000 records.  Specifically:
> show validation statistics
> Total RV records: 89795
> Total Replication RV records: 89795
>   Prefix entries: 42157
>   Origin-AS entries: 44898
> Memory utilization: 14401823 bytes
> Policy origin-validation requests: 1206555751
>   Valid: 39673371
>   Invalid: 8373274
>   Unknown: 1158509106
> BGP import policy reevaluation notifications: 535201
>   inet.0, 499503
>   inet6.0, 35698

I've asked Juniper for more details.  I have not heard back.




rsync vs rrdp (RPKI Repository Delta Protocol):
Currently, ROAs are collected primarily through rsync, which may not be 
the best method.  There is an RFC (https://tools.ietf.org/html/rfc8182) 
describing using HTTP as a distribution method.

The RIPE validator we have deployed uses rsync by default, but that can 
be changed via this line in the config file:
> prefer.rrdp = true

After making that change, and looking at the traffic, very few TALs 
support rrdp.  Some statistics from a full update of all the TALs:
63 TCP connections
5 used port 443, 58 used 873 (rsync)
23 used IPv4, 40 used IPv6
of the sites using 443, all were IPv4


Thank you.




--
________________________________
Andrew Gallo
The George Washington University

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature