You have a /22, you want /24′s, 2 bits give you 4 sub-nets. Or you want one /24, so you break the /22 into two /24′s and a /23. Not rocket science. It’s the kind of thing you can do in your head and keep track of in a spreadsheet or a text file if you don’t have too many networks.

When you’re planning an IP addressing scheme, you probably have the luxury of time, to think about it. But what if you need to do this in a crisis situation? Fortunately it has never happened to me, but I can think of scenarios where you need to do this very quickly:

Apparently, if you use BGP to advertise a network to the Internet and specific hosts within that network become the target of a DDoS attack, one way to mitigate the attack could be to stop advertising the /24 sub-nets being attacked. Although this means the attacker still succeeds in taking down his intended targets (because he made you take them down), at least you can remove the attack traffic from your link, and the rest of your network can remain available.

Another scenario might be someone hijacking part of your network by advertising a more specific route than you are (either intentionally, or due to a BGP filtering misconfiguration). This happened to youtube last year.

Either way, you’ll need to split the network into at least two (in the case of a /23) sub-nets to get a /24, which is generally the longest prefix accepted on the Internet. In the former case, you want to withdraw the more specific network, and in the latter you want to advertise it.

To this end, I have written a script that accepts a list of networks (in CIDR format, one per line) from STDIN, and the desired sub-net as the first command line argument. It loops through the input subnets, looking for the one that overlaps with the desired prefix. If a network doesn’t match, the script just prints it out untouched, if it does, then the script will de-aggregate that network into the minimum number of sub-nets in order to get the desired sub-net as one of the outputs. It prints the surrounding pieces, and unless you specify “-exclude” as the second argument, the desired sub-net itself is also added to the output:

#!/usr/bin/python
# deaggregate.py - deaggregate a network for a specific subnet, yielding the minimum number of subnets
# Add -exclude to only output the surrounding subnets. Subnet is read from stdin, all non matching subnets
# are output untouched. Use as a filter, rinse, repeat.
# Simeon Miteff <simeon@localloop.co.za>
from IPy import IP
import sys
 
def split(ip,sub,exclude):
    if ip==sub:
        if not exclude:
            print ip
    else:
        a = IP(str(ip.net())+'/'+str(ip.prefixlen()+1))
        b = IP(str(IP(ip.net().int()|2**(32-(ip.prefixlen()+1))))+'/'+str(ip.prefixlen()+1))
        if a.overlaps(sub):
            print b
            split(a,sub,exclude)
        elif b.overlaps(sub):
            print a
            split(b,sub,exclude)
 
if __name__=="__main__":
    if len(sys.argv)<2:
        sys.stderr.write("Usage: %s CIDR_prefix [-exclude]\n" % sys.argv[0]) 
        sys.exit(1)
 
    sub = IP(sys.argv[1])
 
    exclude = False
    if len(sys.argv)==3:
        if sys.argv[2]=='-exclude':
            exclude = True
 
    for line in sys.stdin:
        pre = IP(line.strip())
        if not pre.overlaps(sub):
            print line.strip()
        else:
            split(pre,sub,exclude)

An example run:

simeon@capybara:~/personal$ cat routes.txt
10.0.0.0/10
192.168.0.0/16
simeon@capybara:~/personal$ python deaggregate.py 10.0.100.0/24 < routes.txt
10.32.0.0/11
10.16.0.0/12
10.8.0.0/13
10.4.0.0/14
10.2.0.0/15
10.1.0.0/16
10.0.128.0/17
10.0.0.0/18
10.0.64.0/19
10.0.112.0/20
10.0.104.0/21
10.0.96.0/22
10.0.102.0/23
10.0.101.0/24
10.0.100.0/24
192.168.0.0/16
simeon@capybara:~/personal$

It requires the IPy module (apt-get install python-ipy). To handle multiple desired sub-nets, run the script again for each subsequent sub-net, using the output of the previous run as the input. Note that your (and your upstream's) filters might need to be updated (unless your original prefix is allowed with something like "le 24").

I've added this to the code page. Thanks for listening :-)

ZA Internet Map (click for full size image)

• Only local autonomous systems are included. I’ll probably include the first international upstreams, in the next version.
• Only the inbound path (international transit, probably) as seen from RouteViews OIX is shown. This means peering links are not indicated. That might also change in the next version.
• This is not an ISP map, like Greg Massel’s, because it includes all autonomous systems, including non-ISP’s such as customers/end-users running BGP. I’m toying with the idea of colour-coding different types of ASes.
• There are likely to be errors. If you spot them, please let me know so that I can correct my scripts.

While it has it’s fair share of bugs (OSPF instabilities in 2.9.x for example), I quite enjoy working with RouterOS. I recently noticed that version 3 sports some “grown up” router features, like MPLS support, as well as some innovative stuff like Xen integration.

Apart from a good CLI interface, RouterOS also has a Windows client application for configuration and monitoring called winbox. A convenient feature of winbox is that you can save device profiles, and optionally store their login credentials. If you want to move these saved profiles to another machine, you can use the Tools->Export/Import function, that respectively writes and reads a binary file called addresses.wbx.

If you’ve forgotten the login password for one of your RouterOS devices, but you chose to have winbox store it, you can use strings(1) to dump the contents of addresses.wbx to retrieve it.

Last week I wrote a little python script called wbx.py that reads this binary format and presents the output in a tabular format that is somewhat friendlier than what strings(1) (or notepad.exe for the unfortunate) would produce. Please be warned though, it’s not well tested, so your mileage may vary.

I’ve added a code page, where I intend to begin collecting any executable bits that I happen to blog about. You can find wbx.py there.

Python to the rescue. The dnspython module has support for parsing BIND zones, and rendering them without the shortcuts:

#!/usr/bin/python
# bindnorm.py - "normalise" a bind zone file by expanding relative names.
# Simeon Miteff <simeon@localloop.co.za>
# Tue Sep 23 10:03:35 SAST 2008
import dns.zone
import sys
 
if len(sys.argv)<2:
	sys.stderr.write("Usage: %s [zone fqdn]\n" % sys.argv[0])
	sys.stderr.write("Example: %s example.com < db.example.com > norm.db.example.com\n" % sys.argv[0])
	sys.exit(1)
 
zone = dns.zone.from_text(sys.stdin.read(), sys.argv[1], relativize=False, check_origin=False)
zone.to_file(sys.stdout, relativize=False)

To use it, you’ll need to install dnspython first. Fortunately, on Debian or Ubuntu, it’s just an apt-get install python-dnspython away. Running this little script with the example zone above as input yields:

example.com. 259200 IN SOA server1.example.com. hostmaster.example.com. 1 28800 7200 2419200 86400
example.com. 259200 IN NS server1.example.com.
example.com. 259200 IN NS server2.example.com.
example.com. 259200 IN MX 10 server1.example.com.
example.com. 259200 IN MX 20 server2.example.com.
server1.example.com. 259200 IN A 127.0.0.1
server2.example.com. 259200 IN A 127.0.0.2
www.example.com. 259200 IN CNAME server1.example.com.


This format is less canonical, but at least each line is context-free. Now you can proceed to grep the output to your heart’s desire :-)