PING

In this episode of PING, APNIC Chief Scientist Geoff Huston shares a story from the recent AusNOG in Melbourne and connects it to measurement work at APNIC Labs, exploring how modern IP flow control manages ‘fair shares’ of the network.At AusNOG 2025, Geoff attended a talk by Lincoln Dale of Amazon AWS titled “No Packet Left Behind: AWS’s Approach to Building and Operating Reliable Networks”. The presentation examined how AWS scales its data centre networks, highlighting massive investments in high-speed routers and switches to support both global internet services and the vast flows of traffic between servers and other Amazon resources.What AWS doesn’t do is rely on highly complex protocols like Segment Routing over IPv6 (SRv6), Resource Reservation Protocol (RSVP), or other modern traffic engineering techniques unless absolutely necessary. Instead, they use a radically simplified, on-chip model of data management, pushing as much processing as possible into a single VLSI circuit and minimizing the amount of ‘smart’ work in the network. The question is: How can simplifying the IP stack to this extent actually work?Geoff has long been sceptical of higher-layer protocols that try to manage bandwidth reservation and shaping. He recalls an earlier attempt by Digital Equipment Corporation (DEC) to signal congestion with Explicit Congestion Notification (ECN), a mechanism that still exists in the protocol stack and now underpins new bandwidth management approaches such as Apple and Comcast’s ‘L4S’.APNIC Labs has measured how the wider Internet responds to ECN signals using an advertising-based model, and the results suggest this approach struggles outside tightly controlled, ‘walled garden’ networks. He contrasts this with advances in flow control through Google’s BBR, now in its third version, which refines the aggressive, bandwidth-seeking behaviour of TCP window management.Read more about the story of IP, flow control and the modern Internet on the APNIC Blog, and the AusNOG website (video recordings of Lincon Dale’s talk and others should be released shortly)Measuring Explicit Congestion Notification (ECN) (Geoff Huston, APNIC Blog)Notes from AusNOG 2025 (Geoff Huston, APNIC Blog)The AusNOG 2025 program (AusNOG Website, videos to be released shortly)

In this episode of PING, Adli Wahid, APNIC's Security Specialist discusses the APNIC honeypot network, an investment in over 400 collectors distributed throughout the Asia Pacific, collecting data on who is trying to break into systems online and use them for malware, destributed denial of service, and command-and-control systems in the bad traffic economy.Adli discusses how APNIC Members can get access to the results of honeynet traffic capture coming from their network address ranges, and originated from their AS in BGP using the DASH system. and explores some work planned for the APNIC Honeynet systems to extend their systems coverage.As well as publishing reports on APNIC's Blog and presenting at NOG meetings and conferences, Adli has coordinated information sharing from this collector network with a range of international partners such as the Shadow Server Foundation. He continues to offer training and technical assistance in security to the APNIC community and works with the CERT, CSIRT and FIRST community at large.Read more about Honeypots, bad traffic and systems security on the APNIC Blog and the web:Blogs on the honeynet (APNIC Blog) Adli's posts on the APNIC Blog The APNIC Dashboard for AS Health (DASH) (requires an APNIC member account) The Shadow Server Foundation dashboard

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses the economic inevitability of centrality, in the modern Internet. Despite our best intentions, and a lot of long standing belief amongst the IETF technologists, no amount of open standards and end-to-end protocol design prevents large players at all levels of the network (from the physical infrastructure right up to the applications and the data centres which house them) from seeking to acquire smaller competitors, and avoid sharing the space with anyone else.Some of this is a consequence of the drive for efficiency. A part has been fuelled by the effects of Moore’s law, and the cost of capital investment against the time available to recover the costs. In an unexpected outcome, networking has become (to all intents and purposes) “free” and instead of end-to-end, we now routinely expect to get data through highly localised, replicated sources. The main cost these days is land, electric power and air-conditioning. This causes a tendency to concentration, and networks and protocols play very little part in the decision about who acquires these assets, and operates them.The network still exists of course, but increasingly data flows over private links, and is not subject to open protocol design imperatives.A quote from Peter Thiel highlights how the modern Venture Capitalist in our space does not actively seek to operate in a competitive market. As Peter says: “competition is for losers” – It can be hard to avoid the “good” and “bad” labels talking about this, but Geoff is clear he isn’t here to argue what is right or wrong, simply to observe the behaviour and the consequences.Geoff presented on centrality to the Decentralised Internet Research Group or DINRG at the recent IETF meeting held in Madrid, and as he observes, “distributed” is not the same as “decentralised” -we’ve managed to achieve the first one, but the second eludes us.Read more about the policy issues of the modern Internet at the apnic labs blog, the DINRG (IETF) and APNIC BlogDecentralizing Services? (Geoff Huston, talk to DINRG IETF123 Madrid)Centralization topics at the APNIC BlogDINRG at the IETF Wiki (IETF web page)

In this episode of PING, Robert Kisteleki from the RIPE NCC discusses the RIPE Atlas system -a network of over 13,000 measurement devices deployed worldwide in homes, exchange points, stub and transit AS, densely connected regions and sparse island states.Atlas began with a vision of the world at night -a powerful metaphor for where people are, and where technology reaches. Could a measurement system achieve sufficient density to "light up the internet" in a similar manner? Could network measurement be "democratized" to include internet citizens at large?From it's launch at the RIPE 61 meeting held in Rome Italy. with 500 probes based on a small ucLinux device designed as an ethernet converter, to 5 generations of probe hardware and now a soft probe design which can be installed on linux, and an "anchor" device which not only sends tests but can receive them, Atlas has become core technology for network monitoring, measurement and research. Rob discusses the history, design, methodology and futures of this system. A wonderful contribution from the RIPE NCC for the community at large.

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses "a day in the life of BGP" -Not an extraordinary day, not a special day, just the 8th of May.What happens inside the BGP system, from the point of view of AS4608, one ordinary BGP speaker on the edge of the network? What kinds of things are seen, and why are they seen?Geoff has been measuring BGP for almost it's entire life as the internet routing protocol, but this time looks at the dynamics at a more "micro" level than usual. In particular there are some things about the rate of messages and changes which points to the problems BGP faces. A small number of BGP speakers produce the vast majority of change, and overall the network information BGP speakers have to deal with as a persisting view of the world increases more slowly. Both kinds of message dynamics have to be dealt with.Can we fix this? Is there even anything worth fixing here, or is BGP just doing fine?Read more about the dynamics of BGP on the APNIC Blog:A Day in the life of BGP (Geoff Huston June 2025 APNIC Blog)BGP topics at the APNIC BlogGeoff's archive of BGP data at bgp.potaroo.net

In this episode of PING, Doug Madory from Kentik discusses his rundown of the state of play in secure BGP across 2024 and 2025. Kentik has it’s own internal measurements of BGP behaviour and flow data across the surface of the internet, which combined with the Oregon University curated routeviews archive means Doug can analyse both the publicly visible state of BGP from archives, and Kentik’s own view of the dynamics of BGP change, along side other systems like the worldwide RPKI model, and the Internet Routing Registry systems.Doug has written about this before on the APNIC Blog in May of 2024.RPKI demands two outcomes, Firstly that the asset holders who control a given range of Internet Address sign an intent regarding who originates it the ROA, and secondly that the BGP speakers worldwide implement validation of the routing they see, known as Route Origin Validation or ROV. ROA signing is easy, and increases very simply if the delegate uses an RIR hosted system to make the signed objects. ROV is not always simple and has to be deployed carefully so has a slower rate of deployment, and more consequence in costs to the BGP speaker. Doug has been tracking both independently, as well as looking at known routing incidents in the default free zone, and therefore the impact on RPKI active networks, and everywhere else.Read more about RPKI and BGP on the APNIC Blog, the web, and at Doug’s own blogging at Kentik:RPKI ROV reaches a Major Milestone (APNIC Blog, May 2024)Blog Articles by Doug Madory on the APNIC BlogThe Oregon Routeviews ProjectDoug Madory’s blog posts at KentikA shorter interview with Doug Madory on AS_SET problems features in an earlier PING episode, recorded at the ISOC Pulse “PIMF” session at APRICOT 2025.

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, discusses the root zone of the DNS, and some emerging concerns in how much it costs to service query load at the root.In the absence of cacheing, all queries in the DNS (except ones the DNS system you ask is locally authoritative for anyway) have to be sent through the root of the DNS, to find the right nameserver to ask for the specific information. Thanks to cacheing, this system doesn't drown in the load of every worldwide query, all the time, going through the root. But, even taking cacheing into account there is an astronomical amount of query seen at the root, and it has two interesting qualitiesFirstly, its growing significantly faster than the normal rate of growth of the Internet. We're basically at small incremental growth overall in new users, but query load at the root increases significantly faster, even after some more unexpected loads have been reduced.Secondly, almost all of the queries demand the answer "No, that doesn't exist" and the fact most traffic to the root hunts the answer NO means that the nature of distributed DNS cacheing of negative answers isn't addressing the fundamental burden here.Geoff thinks we may be ignoring some recent developments in proving the contents of a zone, the ZONEMD record which is a DNSSEC signed check on the entire zone contents, and emerging systems to download the root zone, and localise all the queries sent onwards into a copy of the root held in the resolver.Basically, "can we do better" -And Geoff thinks, we very probably can.Read more about the economics of the root zone and ZONEMD at the APNIC Blog and on the web:The Root of the DNS (Geoff Huston, APNIC Blog March 2025) ZoneMD: Message digest for DNS Zones RFC8976 (IETF RFC)

In this episode of PING, We’re talking to Leslie Daigle from the Global Cyber Alliance (GCA) again, discussing GCA’s honeynet project. Leslie spoke with PING back in January 2024, and in this episode we re-visit things. Honeynets (or Honey farms) are deliberately weakly protected systems put online, to see what kinds of bad traffic exist out in the global Internet, where they come from and what kinds of attack they are mounting.In the intervening period GCA has continued to develop its honeyfarm, building out it’s own systems images, and can now capture more kinds of bad traffic. They have also bedded in the MANRS community, which is now supported by GCA worldwide.In this episode, Leslie is actually asking more questions than providing answers. If we accept that there is now a persisting problem at scale, what kinds of approaches do we need to take to “get on top” of bad traffic? It used to be we thought of this in terms of technical solutions but increasingly Leslie feels we now need to broaden the conversation and take this into Public policy and governance communities, to understand what kinds of social cost we can bear, and what socially driven objectives we want to drive to. The problem is, this is one of the tasks technologists are often the least equipped to do: Talk to people.GCA is showcasing the AIDE system, reachable at https://gcaaide.org/ as a way of opening up the conversation with national strategic policy makers, and the wider community. It’s a simple economy & region model summarising the state of honeynet detected bad traffic levels worldwide, and helps to set an agenda with which the individual ISPs and routing-active community can engage, for their locus of control.Read more about GCA, Honey nets, AIDE on the APNIC blog and the web:The invisible War: Why securing Internet Traffic is Everyone’s Responsibility (Leslie Daigle, APNIC Blog May 2025)Global Cyber Alliance measurements (Podcast, PING at APNIC Jan 2024)Dealing with the undercurrent of unwanted Traffic (Leslie Daigle, APNIC Blog October 2022)AIDE: Addressing unwanted Internet Traffic at it’s source (GCA Website)

In this episode of PING, APNIC’s Chief Scientist, Geoff Huston, revisits changes underway in how the Domain Name System (DNS) delegates authority over a given zone and how resolvers discover the new authoritative sources. We last explored this in March 2024.In DNS, the word ‘domain’ refers to a scope of authority. Within a domain, everything is governed by its delegated authority. While that authority may only directly manage its immediate subdomains (children), its control implicitly extends to all subordinate levels (grandchildren and beyond). If a parent domain withdraws delegation from a child, everything beneath that child disappears. Think of it like a Venn diagram of nested circles — being a subdomain means being entirely within the parent’s scope.The issue lies in how this delegation is handled. It’s by way of nameserver (NS) records. These are both part of the child zone (where they are defined) and the parent zone (which must reference them). This becomes especially tricky with DNSSEC. The parent can’t authoritatively sign the child’s NS records because they are technically owned by the child. But if the child signs them, it breaks the trust chain from the parent.Another complication is the emergence of third parties to the delegate, who actually operate the machinery of the DNS. We need mechanisms to give them permission to make changes to operational aspects of delegation, but not to hold all the keys a delegate has regarding their domain name.A new activity has been spun up in the IETF to discuss how to alter this delegation problem by creating a new kind of DNS record, the DELEG record. This is proposed to follow the Service Binding model defined in RFC 9460. Exactly how this works and what it means for the DNS is still up in the air.DELEG could fundamentally change how authoritative answers are discovered, how DNS messages are transported, and how intermediaries interact with the DNS ecosystem. In the future, significant portions of DNS traffic might flow over new protocols, introducing novel behaviours in the relationships between resolvers and authoritative servers.Read more about DELEG on the APNIC Blog and the web:DNS and the proposed DELEG record (APNIC Blog, February 2024)DELEG Working Group Charter (IETF Website)Service Binding and Parameter Specification via the DNS (IETF RFC 9460)

In this episode of PING, Professor Cristel Pelsser who holds the chair of critical embedded systems at UCLouvain Discusses her work measuring BGP and in particular the system described in the 2024 SIGCOMM “best paper” award winning research: “The Next Generation of BGP Data Collection Platforms”Cristel and her collaborators Thomas Alfroy, Thomas Holterbach, Thomas Krenc and K. C. Claffy have built a system they call GILL, available on the web at https://bgproutes.io This work also features a new service called MVP, to help find the “most valuable vantage point” in the BGP collection system for your particular needs. GILL has been designed for scale, and will be capable of encompassing thousands of peerings. it also has an innovative approach to holding BGP data, focussed on the removal of demonstrably redundant information, and therefore significantly higher compression of the data stream compared to e.g. holding MRT files.The MVP system exploits machine learning methods to aide in the selection of the most advantageous data collection point reflecting a researchers specific needs. Application of ML methods here permits a significant amount of data to be managed and change reflected in the selection of vantage points.Their system has already been able to support DFOH, an approach to finding forged origin attacks from peering relationships seen online in BGP, as opposed to the peering expected both from location, and declarations of intent inside systems like peeringDB.Read more about Cristel’s work, and their BGP analysis tools on the web:The Next Generation of BGP Data Collection Platforms (Best Paper Award at ACM SIGCOMM 2024)bgproutes.io (web portal to GILL, MVP and DFOH systems)Measuring Internet Routing from the Most Valuable PointsA system to Detect Forged-Origin Hijacks (DFOH)