[connect-wg] Programmatic way to answer, "Who is sending me this stuff?"

Hi Steve,

There have been moves to unify IXP data in JSON format to describe
members at an IXP, and to a certain extent, VLANs and infrastructure.

https://ripe69.ripe.net/presentations/94-1411-ej-ixp-json-api.pdf

https://github.com/euro-ix/json-schemas

Many exchanges have already implemented this JSON schema.

Though the schema allows for MAC address, I am not sure how widely
implemented this is yet. For example, while we implement the JSON
schema, mac address doesn't show in there yet owing to limitations in
the back-end database, though this is hopefully going to be addressed.

The only other reliable ways would be to use the ARP table at each IXP
connection to map the MAC <-> Peering LAN IP and also ASN. (this can
usually be collected via SNMP, for example, though if you are using
route servers, may require more effort again.) Combining this with sflow
data is another possibility.

Rob


On Wed, Sep 09 at 11:19:44 AM, snash wrote:

> If I receive some traffic at an IX peering router interface, I might want to know how I got it.
> If it is a stream of bad traffic I might want to ask my upstream peer to help turn it off.
>   
> How do I find out who did send it to me? 
> If I capture a sample packet I could see the source MAC address.  Now
> I have to identify who owns the device with that MAC. 
>   
> Is there any guidance from the IX operators on how to do this? 
> I'm sure phone calls to Ops teams are not cost effective or time efficient for anyone.
> A common programmatic method across IXes would suit my use-case admirably.
>   
> I'd like to hear from anybody who either has a method in an IX, or who would like a method to exist.




--
Rob Lister
rob at lonap.net
LONAP Ltd