Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Google Went Offline Today and a Bit about How the Internet Works

blog.cloudflare.com

Post reply on HN
Print view View original

71–80 of 158 posts

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#71

Post by btilly »

runn1ng wrote: post #51

Can I ask a pretty newbie question - how is BGP connected to IP, TCP and DNS protocols? Is it sitting "below" them, "on top" of them, or is it somewhere else?

Rather than considering them as a meaningful stack, I think it helps to know what each does.

IP is a protocol for taking a chunk of data, slapping some addressing information on it, and then having it be sent, like an electronic letter, from one computer to another by whatever route the network thinks is best. More precisely every computer sends it to a computer it is directly connected to that it thinks is closer. Eventually, hopefully, it gets to the right place.

If you just want to send chunks of data over IP and hope that they get there, you have UDP.

TCP is a more advanced protocol where one computer contacts another, and then a stream of data starts to flow between them through a connection. Under the hood the stream is broken into chunks that are put in IP packets. And there are extra packets for things like, "Hello, trying to connect here" "I got these packets" "I'm done" and so on. Obviously TCP sits on top of IP.

DNS is a protocol for turning a human readable name like news.ycombinator.com into an IP address like 174.132.225.106. Under the hood DNS uses both UDP and TCP.

BGP is a protocol that is used between routers to advertise how to route packets. BGP uses TCP to work, so it is above TCP. But that routing information is used at the IP level, so bad routes can stop IP from working. Which is what happened here. Someone advertised that they were how to get to a lot of Google addresses, so routers began sending Google traffic there. When the packets arrived, they had no idea what to do with them and dropped them. The result is that the IP layer to Google stopped working for a lot of people.

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#73

Post by sp332 »

highace wrote: post #62
stingraycharles wrote: post #4

For what it's worth, this is quite a vulnerability in the internet's routing system. It's also the reason Youtube went offline after Pakistan was deliberately announcing the wrong routes a few years ago because it didn't agree with some videos being broadcasted by Youtube. http://www.ripe.net/internet-coordination/news/industry-deve... http://news.cnet.com/8301-10784_3-9878655-7.html

This worries me. Am I right in saying a malicious party could actually take down the internet with this?

Yes, but you'd have to con a lot of big players into trusting your BGP routes first. And the effect would only last as long as it took to change some configurations and write you back out of the internet.

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#74

Post by sp332 »

ErikD wrote: post #36
JohnLBevan wrote: post #30

Earlier quoted context omitted.

Would it be possible to claim to own Google's IP, then on receiving the packets intended for Google forward them on to the real IP (without accidentally forwarding them back to yourself)? That way someone could hijack & interrogate these packets without being spotted (at least without causing service outage / only adding slight delay). Alternatively could they route these requests to a clone as an advanced phishing s…

That's what https is for. It should prevent them from doing anything useful with the packets.

Maybe you can't read the data in the packets, but HTTPS doesn't do a thing about SIGINT (signals intelligence) which, on such a large scale, could give you a lot of valuable information.

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#75

Post by vegardx »

ErikD wrote: post #36
JohnLBevan wrote: post #30

Earlier quoted context omitted.

Would it be possible to claim to own Google's IP, then on receiving the packets intended for Google forward them on to the real IP (without accidentally forwarding them back to yourself)? That way someone could hijack & interrogate these packets without being spotted (at least without causing service outage / only adding slight delay). Alternatively could they route these requests to a clone as an advanced phishing s…

That's what https is for. It should prevent them from doing anything useful with the packets.

Not unless you manage to forge a certificate at the same time. It has been done before, as SSL is based on more or less the same level of trust as BGP.

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#76

Post by sp332 »

kami8845 wrote: post #58
precisioncoder wrote: post #24

Earlier quoted context omitted.

I would say the resilience is what impresses me here. The fact that it's decentralized means that anyone can fix the internet. The fact that this one specific problem was fixed within 26 min by individuals realizing the problem and acting to fix it gives me a warm feeling.

I think what you mean is that anyone can break the internet (in this case a random ISP from Indonesia) and that in that case only very specific people could fix it (probably at least a senior network engineer at said ISP).

Only specific routers that you trust (or are trusted by routers you trust) can break your internet. You can fix your internet by un-trusting those routers.

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#77

Post by pilom »

lini wrote: post #5

And nothing will change. At least not until someone does this with malicious intent - script kiddie A knocks out big site, or a censoring state decides that it should block a free speech site from the entire Internet.

A much more useful thing to do than take out a big site is use BGP to create your own "section of the internet" to do your malicious deeds from, then afterwards remove the BGP routes and your addresses will no longer exist on the internet. So it will be as if you sent packets from a phantom network.

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#78

Post by stanleydrew »

Ecio78 wrote: post #31
ojii wrote: post #20

Earlier quoted context omitted.

There's a trend to use VoIP on cellphones too (see LTE). So in the future this will not help at all.

@JohnLBevan this was not a DNS problem, but a BGP problem NB Cannot reply under his post

Even when there's no "reply" link next to the poster's name, I think you can usually reply if you click the "link" link in the same area.

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#79

Post by parfe »

jhull wrote: post #6

Couldn't a rogue government easily take down the internet this way? Seems like if one guy in Indonesia can take out Google by accident, a government entity could do the same.

This exactly thing happened a few years ago. China rerouted about 10% of internet traffic, presumably by accident. http://www.theregister.co.uk/2010/04/09/china_bgp_interweb_s...

Re: Why Google Went Offline Today and a Bit about How the Internet Works

#80

Post by pilom »

ef4 wrote: post #53
runn1ng wrote: post #51

Can I ask a pretty newbie question - how is BGP connected to IP, TCP and DNS protocols? Is it sitting "below" them, "on top" of them, or is it somewhere else?

BGP runs on top of TCP, which runs on top of IP. DNS runs on top of UDP (or sometimes TCP), which runs on top of IP. Edited to elaborate: most computers on the internet don't need to know anything about BGP. It's not directly involved when you establish connections. Think of it as an automatic configuration system running on the various routers.

Saying BGP runs on top of IP is true but doesn't tell you what BGP does or how Global scale IP doesn't work without BGP.

BGP is the protocol Internet Routers (i.e. not your home router) use to figure out how to route IP addresses to particular routers.

So your home router connects to an internet router at comcast (or your ISP). The Comcast router announces to the rest of the world "Dear world, if you want to connect to any of the IP addresses at X.X.X.X sent those packets to me and I'll deal with them."

Post reply on HN