openPenny: Developing an Open-Source Tool for Detecting Non-Spoofed Traffic
• 12 min read
In this article, we introduce openPenny, an open-source traffic checker currently under development as part of the RIPE NCC Community Projects Fund. The goal of openPenny is to help network operators identify non-spoofed traffic arriving at unexpected entry points: this offers a new primitive to de…
“Hi Jared, thanks for your comment. In the case of a hypergiant (e.g., Facebook), moving infrastructure from an ISP to Akamai, our methodology will consider Akamai as a Facebook off-net only if the HTTP(S) headers and TLS certificate match Facebook. On the other hand, if the HTTP(S) headers are not Facebook, we consider that Facebook operates a service in the Akamai network, but not an off-net server. In comparison with previous works, we can measure Akamai's backbone and router deployment in cases where Akamai operates servers/routers with IP addresses that are not part of the address space that Akamai advertises. Off-net servers typically use IP addresses announced by the hosting network (by ISPs rather than by the Hypergiant), making it impossible to identify the server as belonging to the Hypergiant, by using traditional techniques such as inspecting BGP feeds. In Section 6.3 of the paper, we explored the growth by network type and observed that Akamai moved from stub to small, and Medium ASes during this seven years period.”
In case Akamai moves a server from ISP address space to Akamai address space, our approach would consider it as an off-net server leaving that ISP. (Some of) the reduction that we see in the size of Akamai’s deployment could be just a renumbering since our paper focused on servers hosted in ISP address space. Our paper only focuses on these, but our methodology (and in fact our data analysis) also identifies servers in hypergiant address space, so such a renumbering could show up as new Akamai addresses showing up as hosting Akamai web servers. Once again thank you for raising these interesting points!
“Hello, I suspect you are measuring a few interesting Akamai artifacts indirectly here namely: Moving more infrastructure to Akamai IP space vs ISP space Akamai backbone deployment and expansion Akamai router deployment”
Hi Jared, thanks for your comment. In the case of a hypergiant (e.g., Facebook), moving infrastructure from an ISP to Akamai, our methodology will consider Akamai as a Facebook off-net only if the HTTP(S) headers and TLS certificate match Facebook. On the other hand, if the HTTP(S) headers are not Facebook, we consider that Facebook operates a service in the Akamai network, but not an off-net server. In comparison with previous works, we can measure Akamai's backbone and router deployment in cases where Akamai operates servers/routers with IP addresses that are not part of the address space that Akamai advertises. Off-net servers typically use IP addresses announced by the hosting network (by ISPs rather than by the Hypergiant), making it impossible to identify the server as belonging to the Hypergiant, by using traditional techniques such as inspecting BGP feeds. In Section 6.3 of the paper, we explored the growth by network type and observed that Akamai moved from stub to small, and Medium ASes during this seven years period.
“Is Artemis (the code) availabe as download? I would be intetested to set it up to monitor our prefixes.”
Hi Klaus, We released the first version of the tool at the following git repository. https://github.com/FORTH-ICS-INSPIRE/artemis
Showing 3 comment(s)