Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

After 3072 hours of manipulating BGP, a Nyancat was drawn on this RIPE interface

stat.ripe.net

Post reply on HN
Print view View original

71–80 of 114 posts

Re: After 3072 hours of manipulating BGP, a Nyancat was drawn on this RIPE interface

#72

Post by __jal »

job wrote: post #34
rcarmo wrote: post #13

OMG. The ingenuity (and geek level) of achieving this with something that is essentially invisible to 99.99999% of the human race (even most network admins) and planning ahead to do this is... indescribable. (the AS holder is http://instituut.net/~job/ , to those uninitiated - I had to double check my comment) Sir, I take my many virtual hats off to you.

Thank you for the kind words :-)

Just to chime in, that made my day. Utterly brilliant.

Re: After 3072 hours of manipulating BGP, a Nyancat was drawn on this RIPE interface

#73

Post by pas »

dsl wrote: post #70
job wrote: post #49

Earlier quoted context omitted.

The starting point is a BMP file of the Nyan cat which is read into a simple two dimensional array by a small python script. The script looks at the current time and maps that to a column of pixels in the BMP. Each row of pixels in the BMP is represented by one IPv4 /24. If the pixel is "on" a BGP route announcement is generated, if the pixel is "off" the route is withdrawn. Each pixel in the BMP file represents 8 ho…

I'm curious how you handled the justification for the IP space to pull this off. ;)

The prefixes are probably announced in aggregated form anyhow further upstream. The announcements and deannouncements are/were therefore redundant.

At least't that's my hunch. We could check the same monitor though :)

Re: After 3072 hours of manipulating BGP, a Nyancat was drawn on this RIPE interface

#77

Post by corysama »

okreallywtf wrote: post #35
na85 wrote: post #4

Earlier quoted context omitted.

A cursory Google search would have revealed that BGP is Border Gateway Protocol.

Why did people downvote a pretty appropriate snark while not downvoting a question that took longer to ask than the google search would have taken?

Hacker News discourages snark in general.

Re: After 3072 hours of manipulating BGP, a Nyancat was drawn on this RIPE interface

#79

Post by jgg7 »

pas wrote: post #73
dsl wrote: post #70

Earlier quoted context omitted.

I'm curious how you handled the justification for the IP space to pull this off. ;)

The prefixes are probably announced in aggregated form anyhow further upstream. The announcements and deannouncements are/were therefore redundant. At least't that's my hunch. We could check the same monitor though :)

AS15562 appears to be an employee of NTT out of the Netherlands. I can't tell if AS15562 is for personal or work, maybe both: http://bgp.he.net/AS15562

I couldn't care less about the IPv6 prefixes, but the IPv4 ones are all /24s made from 209.24.0.0/16, which is registered to NTT (AS2914). 209.24/16 is publicly announced (and has been for a very long time), and is routed through NTT Amsterdam routers.

I haven't looked at BGPlay to review all the data, but it looks like many of the /24s that make up that /16 were individually announced through AS15562, then later withdrawn, gradually over 4 months, to make said graph. I would hope this would be unused v4 space. That AS announced almost 98% of a /16 (probably 209.24/16): https://stat.ripe.net/AS15562#tabId=routing

Another user voiced their concerns, particularly if it was actively used: https://news.ycombinator.com/item?id=14621859 -- there's no way any of us could know this; NTT would be authoritative, and jwhois -h rwhois.gtt.net.net -p 4321 209.24.0.0/16 doesn't give any clues.

While the antic made me smirk, it doesn't (publicly) "look good" when we're living in a world that lacks (or has greatly limited) v4 space. What this says is: "NTT has a /16 they're fooling around with publicly", even though it (presumably) is harmless.

Re: After 3072 hours of manipulating BGP, a Nyancat was drawn on this RIPE interface

#80

Post by jgg7 »

whoopdedo wrote: post #20
feld wrote: post #11

There's 28,000 IP addresses that could be used for something worthwhile instead of hoarded by clowns playing games with BGP to draw internet cats.

Correct me if my understanding of internet routing is wrong, but the IP blocks were not out of service during the experiment. Only that a router(s) was advertising that it would accept traffic for those addresses. It would cause traffic to be sent through AS15562 during the time, which may have been suboptimal at times, but eventually would have reached the destination without visitors being aware of the game being p…

Your understanding is mostly correct. Whether or not traffic directed to any of the /24s involved "would have eventually reached the destination" is undetermined (and possibly irrelevant), meaning it's both possible and not possible. We simply don't know. Speaking strictly about "internet routing" (BGP in this case), it is 100% possible for an announcement to send traffic through an AS which literally dumps it on the floor -- it's happened many times over the years (the Pakistan/Youtube one was noticed by many): https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents

The question is whether or not the /16 (of which most of the advertised/withdrawn /24s make up) was used by actual devices, or if it's address space NTT has yet to use. If it is assigned to NTT but unused space, then effectively no harm done. If it's actually used IP space, then that would be very inappropriate.

Post reply on HN