[Patch 1.0.0.133: Ziggs] General Discussion - Page 156

Let's see if I can explain this. Basically, there are a finite number of IP addresses which can be grouped in various ways.

IP addresses these days are typically IPv4, which are 32 bits long, which is 4,294,967,296 IP addresses. There's actually a bit less available in the public domain and the shortage of IP addresses is part of the reason the world is slowly migrating to IPv6, but I digress.

A typical public IP address might be something like 74.125.113.99 (in this case the IP of Google.com that faces the web). Notice that there are four groupings of numbers. As stated earlier, there are about 4.3 billion IP addresses. Consider a public IP address to be like a mailing address. If a single post office tried to keep track and route all 4.3 billion addresses individually, it'd be a nightmare. However, this process can be made a lot easier by grouping addresses into something akin to a ZIP code.

One such range could be 74.125.113.0 to 74.125.113.255, which can be denoted as 74.125.133.0 /24 (the reason it's written that way isn't important for this example). Instead of having 256 routes, you can now say any of the addresses that fall into this range should get sent to Router X. Each router maintains what's called a "Routing Table," which is how it knows where to send what. Naturally, routers generally don't have paths for even every grouping of addresses, so there's also a default gateway where everything unknown get's sent. Having received the data, Router X will then look at its own Routing Table and send the information down the line until it eventually reaches it's destination. This generally involves going through a large number of routers and networks, each with their own routing information.

If Router X doesn't have a route for the IP (or its range), it'll sent it down its own default route until some router knows what to do with the data or the data reaches its expiration criteria. Actual criteria for expiration vary between the different routing protocols. One example is with RIP (residential routers generally use RIP or RIPv2), where data can travel no more than 15 "hops," with each hop being basically equivalent to data going from one router to another. This means that if you set up two routers on your network (and misconfigure them somehow), instead of data looping indefinitely, it would simply be discarded on the 16th hop). Note that global routers don't use RIP, so that 15-router limit is just an example and you aren't actually limited to 15 routers from your house to e.g. China. Once your data leaves your network, it likely gets encapsulated into a different routing protocol.

Global routing systems are generally very good at maintaining routes, so it's abnormal for a legitimate address to be unreachable. There are exceptions, of course, which is partially related to DNS propagation. There are two primary ways for a 'black hole' to occur. First, there are domain names and IPs. A domain name is e.g. www.google.com, while an IP is 74.125.113 99. Domain's are used because it's easier to remember a name than a series of numbers. If you a website changes their IP address, the DNS server that links the name and IP together has to also be updated. Since there are many DNS servers across the world, it can take time for this to propagate, especially for small websites.

The second way is ignorance, maliciousness, or a bit of both. Global routers all use a protocol called Border Gateway Protocol (BGP) to go between their own network and someone else's network (hence the name 'Border'). One problem with BGP is authenticating that someone advertising they have a route to a certain location actually does have a route (and that the route is as good as they claim it to be). Upstream providers (e.g. your ISP) are supposed to filter this information, but that's not always done effectively. There was one case where Pakistan actually knocked YouTube offline for ~2 hours doing this. Basically, YT wouldn't block access to Pakistan users, so Pakistan's government tried to change the routing for Pakistani users so that it would not be able to reach YT. What they actually did was advertise to the world that they had the best path to YT and their upstream provider allowed it to get sent out. For ~2 hours, the routers around the world all changed their routes to point to Pakistan, where the requests were simply discarded. It got resolved as quickly as it did because YT has round the clock monitoring and the clout to quickly get the routes fixed. Read more here: http://news.cnet.com/8301-10784_3-9878655-7.html

ISPs are generally assigned blocks of IP addresses which is somehow divided up by region (not 100% on how that works). The point is that the other routers between your personal network and the Internet know that any of the addresses in a certain ip range should get sent to your particular ISP. Your ISP is the only one who actually knows to send information for your specific IP address to your specific location (e.g. your house). Generally speaking, routers prefer more specific routes to more general routes, so having a route for your single IP address is more specific than having a route for the entire range of addresses. Thus, once your ISP receives something destined for a specific IP on their network, they can forward it to the customer in question.

This means that you can call up your ISP and have your IP changed to another address within that range and have minimal disruption in your service. The routing tables around the world will not need to be changed because it's still within the same grouping of addresses. It's as if you moved to a different house in your neighborhood. Mail sent from across the country would still know to direct it to the post office in your town and therefore would have no need to update their mailing routes.

DDoS attacks work by flooding more traffic into your network than it can handle. For residential and small business users, this isn't very much. Things like Google can however handle a huge volume of traffic. The normal response to a DoS attack is to just block traffic coming from the errant source, but DDoS circumvents that by having potentially thousands of different sources all spamming traffic to one location. Eventually, your router just can't keep up and you start losing data (either incoming or outgoing). There are methods that protect against DDoS, but a typical home user isn't going to have much or any of them.