{"id":31415,"date":"2019-10-31T21:41:08","date_gmt":"2019-10-31T18:41:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika\/"},"modified":"2019-10-31T21:41:08","modified_gmt":"2019-10-31T18:41:08","slug":"vse-ochen-ploho-ili-novyj-vid-perehvata-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika","title":{"rendered":"V\u0161echno je velmi \u0161patn\u00e9 nebo nov\u00fd zp\u016fsob zachycen\u00ed provozu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>13. b\u0159ezna byla pracovn\u00ed skupin\u011b RIPE pro pot\u00edr\u00e1n\u00ed zneu\u017e\u00edv\u00e1n\u00ed p\u0159edlo\u017eena <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ripe.net\/ripe\/mail\/archives\/anti-abuse-wg\/2019-March\/004585.html\">n\u00e1vrh<\/a><\/noindex> zv\u00e1\u017eit BGP p\u0159epaden\u00ed (hjjack) jako poru\u0161en\u00ed politiky RIPE. Pokud by byl n\u00e1vrh p\u0159ijat, internetov\u00fd poskytovatel napaden\u00fd p\u0159epaden\u00edm provozu by m\u011bl mo\u017enost zaslat speci\u00e1ln\u00ed \u017e\u00e1dost na odhalen\u00ed \u00fato\u010dn\u00edka. Pokud odborn\u00e1 skupina shrom\u00e1\u017ed\u00ed dostatek potvrzuj\u00edc\u00edch d\u016fkaz\u016f, takov\u00fd LIR, kter\u00fd je zdrojem BGP p\u0159epaden\u00ed, by byl pova\u017eov\u00e1n za poru\u0161itele a mohl by b\u00fdt zbaven statusu LIR. Byly zde i n\u011bkter\u00e9 argumenty <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ripe.net\/ripe\/mail\/archives\/anti-abuse-wg\/2019-March\/004601.html\">proti tomuto<\/a><\/noindex> zm\u011bn\u011b.<\/p>\n<p>V tomto \u010dl\u00e1nku chceme uk\u00e1zat p\u0159\u00edklad \u00fatoku, kdy nebyl zpochyb\u0148ov\u00e1n pouze skute\u010dn\u00fd \u00fato\u010dn\u00edk, ale tak\u00e9 cel\u00fd seznam posti\u017een\u00fdch prefix\u016f. Nav\u00edc tento \u00fatok op\u011bt vyvol\u00e1v\u00e1 ot\u00e1zky o motivech budouc\u00edch p\u0159epaden\u00ed provozu tohoto typu.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPosledn\u00ed dva roky byly v tisku jako BGP p\u0159epaden\u00ed zd\u016fraz\u0148ov\u00e1ny pouze konflikty typu MOAS (Multiple Origin Autonomous System). MOAS je specifick\u00fd p\u0159\u00edpad, kdy dv\u011b r\u016fzn\u00e9 autonomn\u00ed syst\u00e9my inzeruj\u00ed konfliktn\u00ed prefixy s odpov\u00eddaj\u00edc\u00edmi \u010d\u00edsly ASN v AS_PATH (prvn\u00ed ASN v AS_PATH se d\u00e1le naz\u00fdv\u00e1 origin ASN). Nicm\u00e9n\u011b m\u016f\u017eeme pojmenovat alespo\u0148 <noindex><a rel=\"nofollow\" href=\"https:\/\/pc.nanog.org\/static\/published\/meetings\/NANOG75\/1892\/20190219_Gavrichenkov_Four_Years_Of_v1.pdf\">3 dal\u0161\u00ed typy<\/a><\/noindex> p\u0159epaden\u00ed provozu, kter\u00e9 umo\u017e\u0148uj\u00ed \u00fato\u010dn\u00edkovi manipulovat s atributem AS_PATH r\u016fzn\u00fdmi c\u00edli, v\u010detn\u011b obch\u00e1zen\u00ed sou\u010dasn\u00fdch p\u0159\u00edstup\u016f k filtrov\u00e1n\u00ed a monitorov\u00e1n\u00ed. Zn\u00e1m\u00fd typ \u00fatoku <noindex><a rel=\"nofollow\" href=\"https:\/\/we.riseup.net\/assets\/43591\/defcon-16-pilosov-kapela.pdf\">Pilosova-Kapely<\/a><\/noindex> je posledn\u00ed typ takov\u00e9ho p\u0159epaden\u00ed, ale nikoli bezv\u00fdznamn\u00fd. Je velmi pravd\u011bpodobn\u00e9, \u017ee pr\u00e1v\u011b takov\u00fd \u00fatok jsme sledovali v posledn\u00edch t\u00fddnech. Tato ud\u00e1lost m\u00e1 vysv\u011btliteln\u00fd charakter a dostate\u010dn\u011b v\u00e1\u017en\u00e9 d\u016fsledky.<\/p>\n<p>Ti, kdo hledaj\u00ed verzi TL;DR, se mohou posunout k podnadpisu \u201eIde\u00e1ln\u00ed \u00fatok\u201c.<\/p>\n<h3>S\u00ed\u0165ov\u00e9 pozad\u00ed<\/h3>\n<p><i>(abyste l\u00e9pe rozum\u011bli proces\u016fm z\u00fa\u010dastn\u011bn\u00fdch v tomto incidentu)<\/i><\/p>\n<p>Pokud chcete odeslat paket a m\u00e1te n\u011bkolik prefix\u016f v tabulce sm\u011brov\u00e1n\u00ed obsahuj\u00edc\u00edch c\u00edlovou IP adresu, pou\u017eijete pro prefix s maxim\u00e1ln\u00ed d\u00e9lkou. Pokud v\u0161ak existuje n\u011bkolik r\u016fzn\u00fdch tras pro jeden prefix v tabulce sm\u011brov\u00e1n\u00ed, vyberete nejlep\u0161\u00ed (v souladu se mechanismem v\u00fdb\u011bru nejlep\u0161\u00ed cesty).<\/p>\n<p>Existuj\u00edc\u00ed p\u0159\u00edstupy k filtrov\u00e1n\u00ed a monitorov\u00e1n\u00ed se sna\u017e\u00ed analyzovat trasy a p\u0159ij\u00edmat rozhodnut\u00ed na z\u00e1klad\u011b anal\u00fdzy atributu AS_PATH. Sm\u011brova\u010d m\u016f\u017ee tento atribut zm\u011bnit na libovolnou hodnotu p\u0159i anoncov\u00e1n\u00ed. Jednoduch\u00e9 p\u0159id\u00e1n\u00ed ASN vlastn\u00edka na za\u010d\u00e1tek AS_PATH (jako origin\u00e1ln\u00ed ASN) m\u016f\u017ee b\u00fdt dosta\u010duj\u00edc\u00ed pro obch\u00e1zen\u00ed st\u00e1vaj\u00edc\u00edch mechanism\u016f ov\u011b\u0159ov\u00e1n\u00ed zdroje. Nav\u00edc, pokud existuje trasa od napaden\u00e9ho ASN k v\u00e1m, vznik\u00e1 mo\u017enost extrahovat a pou\u017e\u00edt AS_PATH t\u00e9to trasy ve va\u0161ich dal\u0161\u00edch anonc\u00edch. Jak\u00e9koli ov\u011b\u0159ov\u00e1n\u00ed pouze AS_PATH pro va\u0161e vygenerovan\u00e9 anonce nakonec bude proj\u00edt.<\/p>\n<p>Existuje tak\u00e9 n\u011bkolik dal\u0161\u00edch v\u00fdznamn\u00fdch omezen\u00ed. Za prv\u00e9, v p\u0159\u00edpad\u011b filtrov\u00e1n\u00ed prefix\u016f vy\u0161\u0161\u00edm poskytovatelem m\u016f\u017ee b\u00fdt va\u0161e trasa st\u00e1le filtrov\u00e1na (i s platn\u00fdm AS_PATH), pokud prefix nepat\u0159\u00ed do va\u0161eho z\u00e1kaznick\u00e9ho ku\u017eele, nastaven\u00e9ho u upstreamu. Za druh\u00e9 \u2013 platn\u00fd AS_PATH se m\u016f\u017ee st\u00e1t neplatn\u00fdm, pokud je vytvo\u0159en\u00e1 trasa anoncov\u00e1na nespr\u00e1vn\u00fdmi sm\u011bry a t\u00edm poru\u0161uje routingovou politiku. A nakonec \u2013 jak\u00e1koli trasa s prefixem, kter\u00fd poru\u0161uje ROA d\u00e9lku, m\u016f\u017ee b\u00fdt pova\u017eov\u00e1na za neplatnou.<\/p>\n<h3>Incident<\/h3>\n<p>\nP\u0159ed n\u011bkolika t\u00fddny jsme obdr\u017eeli st\u00ed\u017enost od jednoho z u\u017eivatel\u016f. Vid\u011bli jsme trasy s jeho origin\u00e1ln\u00edm ASN a prefixy \/25, zat\u00edmco u\u017eivatel tvrdil, \u017ee je neanoncoval.<\/p>\n<p><code>TABLE_DUMP2|1554076803|B|xxx|265466|78.163.7.0\/25|265466 262761 263444 22356 3491 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.7.128\/25|265466 262761 263444 22356 3491 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.18.0\/25|265466 262761 263444 6762 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.18.128\/25|265466 262761 263444 6762 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.226.0\/25|265466 262761 263444 22356 3491 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.226.128\/25|265466 262761 263444 22356 3491 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.164.7.0\/25|265466 262761 263444 6762 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.164.7.128\/25|265466 262761 263444 6762 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<\/code><br \/>\n<i>P\u0159\u00edklady anonc\u00ed na za\u010d\u00e1tku dubna 2019<\/i><\/p>\n<p>NTT na cest\u011b pro prefix \/25 \u010din\u00ed tento obzvl\u00e1\u0161\u0165 podez\u0159el\u00fdm. B\u011bhem incidentu LG NTT o t\u00e9to trase nev\u011bd\u011bl. Tak\u017ee ano, n\u011bjak\u00fd oper\u00e1tor vytv\u00e1\u0159\u00ed cel\u00fd AS_PATH pro tyto prefixy! Ov\u011b\u0159en\u00ed na jin\u00fdch sm\u011brova\u010d\u00edch umo\u017e\u0148uje vyzdvihnout jeden zvl\u00e1\u0161tn\u00ed ASN: AS263444. Kdy\u017e jsme se pod\u00edvali na dal\u0161\u00ed trasy s t\u00edmto autonomn\u00edm syst\u00e9mem, narazili jsme na n\u00e1sleduj\u00edc\u00ed situaci:<\/p>\n<p><code>TABLE_DUMP2|1554076800|B|xxx|265466|1.6.36.0\/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.6.38.0\/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.23.143.0\/25|265466 262761 263444 22356 6762 9498 9730 45528|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.23.143.128\/25|265466 262761 263444 22356 6762 9498 9730 45528|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.24.0.0\/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.24.128.0\/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.26.0.0\/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.26.128.0\/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.64.96.0\/20|265466 262761 263444 6762 3491 4760|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.64.112.0\/20|265466 262761 263444 6762 3491 4760|IGP|xxx|0|0||NAG||<\/code><br \/>\n<i>Zkuste uhodnout, co nen\u00ed v po\u0159\u00e1dku<\/i><\/p>\n<p>Zd\u00e1 se, \u017ee n\u011bkdo vzal prefix z trasy, rozd\u011blil ho na dv\u011b \u010d\u00e1sti a anoncoval trasu se stejn\u00fdm AS_PATH pro tyto dva prefixy.<\/p>\n<p><code>TABLE_DUMP2|1554076800|B|xxx|263444|1.6.36.0\/23|263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|263444|1.6.38.0\/23|263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|61775|1.6.36.0\/23|61775 262761 263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|61775|1.6.38.0\/23|61775 262761 263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.6.36.0\/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.6.38.0\/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|28172|1.6.36.0\/23|28172 52531 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|28172|1.6.38.0\/23|28172 52531 263444 52320 9583|IGP|xxx|0|0||NAG||<\/code><br \/>\n<i>P\u0159\u00edklady tras pro jeden z p\u00e1r\u016f rozd\u011blen\u00fdch prefix\u016f<\/i><\/p>\n<p>Objevuje se n\u011bkolik ot\u00e1zek. Zkou\u0161el n\u011bkdo skute\u010dn\u011b v praxi tento typ zachycen\u00ed? P\u0159ijal n\u011bkdo tyto trasy? Jak\u00e9 prefixy byly ovlivn\u011bny?<\/p>\n<p>Tady za\u010d\u00edn\u00e1 na\u0161e \u0159ada ne\u00fasp\u011bch\u016f a dal\u0161\u00ed kolo zklam\u00e1n\u00ed v aktu\u00e1ln\u00edm stavu zdrav\u00ed Internetu.<\/p>\n<h3>Cesta ne\u00fasp\u011bch\u016f<\/h3>\n<p>\nO v\u0161em postupn\u011b. Jak m\u016f\u017eeme ur\u010dit, kter\u00e9 sm\u011brova\u010de p\u0159ijaly takto zachycen\u00e9 trasy a \u010d\u00ed provoz m\u016f\u017ee b\u00fdt p\u0159esm\u011brov\u00e1n u\u017e dnes? Rozhodli jsme se za\u010d\u00edt s prefixy \/25, proto\u017ee \u201ejednodu\u0161e nemohou m\u00edt glob\u00e1ln\u00ed dosah\u201c. Jak m\u016f\u017eete h\u00e1dat, siln\u011b jsme se m\u00fdlili. Tato metrika se uk\u00e1zala jako p\u0159\u00edli\u0161 zkreslen\u00e1 a trasy s takov\u00fdmi prefixy se mohou objevovat i u oper\u00e1tor\u016f Tier-1. Nap\u0159\u00edklad NTT m\u00e1 p\u0159ibli\u017en\u011b 50 takov\u00fdch prefix\u016f, kter\u00e9 \u0161\u00ed\u0159\u00ed sv\u00fdm vlastn\u00edm klient\u016fm. Na druhou stranu, tato metrika je \u0161patn\u00e1, proto\u017ee takov\u00e9 prefixy mohou b\u00fdt filtrovan\u00e9, pokud oper\u00e1tor aplikuje <noindex><a rel=\"nofollow\" href=\"http:\/\/bgpfilterguide.nlnog.net\/guides\/small_prefixes\/\">filtrov\u00e1n\u00ed mal\u00fdch prefix\u016f<\/a><\/noindex>, ve v\u0161ech sm\u011brech. Proto takov\u00e1 metoda nen\u00ed vhodn\u00e1 pro hled\u00e1n\u00ed v\u0161ech oper\u00e1tor\u016f, jejich\u017e provoz byl p\u0159esm\u011brov\u00e1n v d\u016fsledku podobn\u00e9ho incidentu.<\/p>\n<p>Dal\u0161\u00ed dobr\u00fd n\u00e1pad se n\u00e1m zd\u00e1l pohl\u00e9dnout na <noindex><a rel=\"nofollow\" href=\"https:\/\/datatracker.ietf.org\/doc\/rfc6811\/\">POV<\/a><\/noindex>. Zejm\u00e9na na trasy s poru\u0161en\u00edm pravidla maxLength p\u0159\u00edslu\u0161n\u00e9ho ROA. T\u00edmto zp\u016fsobem bychom mohli naj\u00edt po\u010det r\u016fzn\u00fdch origin\u00e1ln\u00edch ASN se statusem Invalid, kter\u00e9 byly viditeln\u00e9 dan\u00e9 AS. Nicm\u00e9n\u011b, existuje \u201emal\u00fd\u201c probl\u00e9m. Pr\u016fm\u011br (medi\u00e1n a moda) tohoto \u010d\u00edsla (po\u010det r\u016fzn\u00fdch origin\u00e1ln\u00edch ASN) \u010din\u00ed p\u0159ibli\u017en\u011b 150 a i kdy\u017e odfiltrujeme mal\u00e9 prefixy, z\u016fstane nad 70. Takov\u00e1 situace m\u00e1 docela jednoduch\u00e9 vysv\u011btlen\u00ed: existuje jen n\u011bkolik oper\u00e1tor\u016f, kte\u0159\u00ed ji\u017e aplikuj\u00ed ROA filtry s politikou \u201eresetovat Invalid trasy\u201c na vstupn\u00edch bodech, tak\u017ee a\u0165 u\u017e se v re\u00e1ln\u00e9m sv\u011bt\u011b objev\u00ed jak\u00e1koli trasa s poru\u0161en\u00edm ROA, m\u016f\u017ee se \u0161\u00ed\u0159it ve v\u0161ech sm\u011brech.<\/p>\n<p>Posledn\u00ed dva p\u0159\u00edstupy umo\u017e\u0148uj\u00ed naj\u00edt oper\u00e1tory, kte\u0159\u00ed vid\u011bli n\u00e1\u0161 incident (proto\u017ee byl dost velk\u00fd), ale celkov\u011b jsou nepraktick\u00e9. Dob\u0159e, ale m\u016f\u017eeme naj\u00edt \u00fato\u010dn\u00edka? Jak\u00e9 jsou obecn\u00e9 charakteristiky takov\u00e9 manipulace AS_PATH? Existuje n\u011bkolik z\u00e1kladn\u00edch p\u0159edpoklad\u016f:<\/p>\n<ul>\n<li>Prefix nebyl d\u0159\u00edve nikde zaznamen\u00e1n;<\/li>\n<li>Origin ASN (p\u0159ipom\u00ednka: prvn\u00ed ASN v AS_PATH) je platn\u00fd;<\/li>\n<li>Posledn\u00ed ASN v AS_PATH je ASN \u00fato\u010dn\u00edka (v p\u0159\u00edpad\u011b, \u017ee jeho soused kontroluje ASN souseda na v\u0161ech p\u0159\u00edchoz\u00edch tras\u00e1ch);<\/li>\n<li>\u00datok poch\u00e1z\u00ed od jednoho poskytovatele.<\/li>\n<\/ul>\n<p>\nPokud jsou v\u0161echny p\u0159edpoklady spr\u00e1vn\u00e9, na v\u0161ech nespr\u00e1vn\u00fdch tras\u00e1ch bude p\u0159edstaven ASN \u00fato\u010dn\u00edka (krom\u011b origin\u00e1ln\u00edho ASN) a to je takzvan\u00fd \u201ekritick\u00fd\u201c bod. Mezi skute\u010dn\u00fdmi \u00fanosci byl i AS263444, i kdy\u017e byly i dal\u0161\u00ed. I kdy\u017e jsme vylou\u010dili trasy incidentu z \u00favahy. Pro\u010d? Kritick\u00fd bod m\u016f\u017ee z\u016fstat kritick\u00fd i pro spr\u00e1vn\u00e9 trasy. Mohou b\u00fdt v\u00fdsledkem \u0161patn\u00e9 konektivity v n\u011bjak\u00e9m regionu nebo omezen\u00ed na\u0161\u00ed vlastn\u00ed viditelnosti.<\/p>\n<p>Jak\u00fd je v\u00fdsledek: existuje zp\u016fsob, jak detekovat \u00fato\u010dn\u00edka, ale pouze v p\u0159\u00edpad\u011b spln\u011bn\u00ed v\u0161ech v\u00fd\u0161e zm\u00edn\u011bn\u00fdch podm\u00ednek a pouze kdy\u017e je zachycen\u00ed dostate\u010dn\u011b velk\u00e9 pro p\u0159ekro\u010den\u00ed monitorovac\u00edho prahu. Pokud n\u011bkter\u00e9 z t\u011bchto faktor\u016f nejsou spln\u011bny, m\u016f\u017eeme identifikovat prefixy, kter\u00e9 byly t\u00edmto zachycen\u00edm posti\u017eeny? Pro ur\u010dit\u00e9 oper\u00e1tory \u2013 ano.<\/p>\n<p>Kdy\u017e \u00fato\u010dn\u00edk vytvo\u0159\u00ed more specific trasu, takov\u00fd prefix nen\u00ed ozn\u00e1men skute\u010dn\u00fdm vlastn\u00edkem. Pokud m\u00e1te od n\u011bj dynamick\u00fd seznam v\u0161ech jeho prefix\u016f, vznik\u00e1 mo\u017enost prov\u00e9st srovn\u00e1n\u00ed a naj\u00edt zkreslen\u00e9 more specific trasy. Tento seznam prefix\u016f shroma\u017e\u010fujeme pomoc\u00ed na\u0161ich BGP sezen\u00ed, proto\u017ee n\u00e1m p\u0159ed\u00e1vaj\u00ed nejen kompletn\u00ed seznam tras, kter\u00e9 jsou oper\u00e1torovi aktu\u00e1ln\u011b viditeln\u00e9, ale tak\u00e9 seznam v\u0161ech prefix\u016f, kter\u00e9 chce ozn\u00e1mit sv\u011btu. Bohu\u017eel nyn\u00ed existuje n\u011bkolik des\u00edtek u\u017eivatel\u016f Radar, kte\u0159\u00ed tuto posledn\u00ed \u010d\u00e1st neprov\u00e1d\u011bj\u00ed zcela spr\u00e1vn\u011b. V nejbli\u017e\u0161\u00ed dob\u011b je budeme informovat a pokus\u00edme se tento probl\u00e9m vy\u0159e\u0161it. V\u0161ichni ostatn\u00ed se mohou p\u0159ipojit k na\u0161emu monitorovac\u00edmu syst\u00e9mu pr\u00e1v\u011b te\u010f.<\/p>\n<p>Pokud se vr\u00e1t\u00edme k p\u016fvodn\u00edmu incidentu, \u00fato\u010dn\u00edka a oblast roz\u0161\u00ed\u0159en\u00ed jsme objevili pomoc\u00ed hled\u00e1n\u00ed kritick\u00fdch bod\u016f. Je p\u0159ekvapiv\u00e9, \u017ee AS263444 rozes\u00edlal fal\u0161ovan\u00e9 trasy ne v\u0161em sv\u00fdm klient\u016fm. Ale existuje i podivn\u011bj\u0161\u00ed aspekt.<\/p>\n<p><code>BGP4MP|1554905421|A|xxx|263444|178.248.236.0\/24|263444 6762 197068|IGP|xxx|0|0|13106:12832 22356:6453 65444:20000|NAG||<br \/>\nBGP4MP|1554905421|A|xxx|263444|178.248.237.0\/24|263444 6762 197068|IGP|xxx|0|0|13106:12832 22356:6453 65444:20000|NAG||<\/code><br \/>\n<i>Ned\u00e1vn\u00fd p\u0159\u00edklad pokusu o zachycen\u00ed na\u0161eho adresn\u00edho prostoru<\/i><\/p>\n<p>Kdy\u017e byly vytvo\u0159eny more specific pro na\u0161e prefixy, byla pou\u017eita speci\u00e1ln\u011b vytvo\u0159en\u00e1 AS_PATH. Tento AS_PATH v\u0161ak nemohl b\u00fdt p\u0159evzat z \u017e\u00e1dn\u00e9 z na\u0161ich p\u0159edchoz\u00edch tras. Dokonce nem\u00e1me spojen\u00ed s AS6762. Pod\u00edv\u00e1me se na dal\u0161\u00ed trasy v incidentu: n\u011bkter\u00e9 z nich m\u011bly skute\u010dn\u00fd AS_PATH, kter\u00fd byl pou\u017e\u00edv\u00e1n d\u0159\u00edve, a jin\u00e9 ne, i kdy\u017e vypadaly jako skute\u010dn\u00e9. Dal\u0161\u00ed zm\u011bna AS_PATH nem\u00e1 praktick\u00fd smysl, proto\u017ee v ka\u017ed\u00e9m p\u0159\u00edpad\u011b bude provoz p\u0159esm\u011brov\u00e1n na \u00fato\u010dn\u00edka, ale trasy se \u201e\u0161patn\u00fdm\u201c AS_PATH mohou b\u00fdt filtrov\u00e1ny ASPA nebo jak\u00fdmkoli jin\u00fdm mechanismem kontroly. Zde jsme se zamysleli nad motivac\u00ed \u00fanosce. V sou\u010dasn\u00e9 dob\u011b n\u00e1m chyb\u00ed data abychom mohli tvrdit, \u017ee tento incident byl pl\u00e1novan\u00fdm \u00fatokem. Nicm\u00e9n\u011b \u2014 je to mo\u017en\u00e9. Poj\u010fme se pokusit p\u0159edstavit si alespo\u0148 hypotetickou, ale potenci\u00e1ln\u011b docela re\u00e1lnou situaci.<\/p>\n<h3>Ide\u00e1ln\u00ed \u00fatok<\/h3>\n<p>\nCo m\u00e1me? P\u0159edstavme si, \u017ee jste tranzitn\u00ed poskytovatel, kter\u00fd vys\u00edl\u00e1 trasy pro sv\u00e9 klienty. Pokud maj\u00ed va\u0161i klienti v\u00edcero p\u0159\u00edtomnost\u00ed (multihome), z\u00edsk\u00e1te pouze \u010d\u00e1st jejich provozu. Ale \u010d\u00edm v\u00edce provozu, t\u00edm v\u011bt\u0161\u00ed v\u00e1\u0161 p\u0159\u00edjem. Proto, pokud za\u010dnete oznamovat prefixy pods\u00edt\u00ed t\u011bchto stejn\u00fdch tras se stejn\u00fdm AS_PATH, z\u00edsk\u00e1te zbytek jejich provozu. V d\u016fsledku toho i zbytek pen\u011bz.<\/p>\n<p>Pom\u016f\u017ee zde ROA? Mo\u017en\u00e1, ano, pokud se rozhodnete zcela vzd\u00e1t pou\u017eit\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/datatracker.ietf.org\/doc\/draft-ietf-sidrops-rpkimaxlen\/\">maxLength<\/a><\/noindex>. Krom\u011b toho je v tomto p\u0159\u00edpad\u011b velmi ne\u017e\u00e1douc\u00ed m\u00edt z\u00e1znamy ROA s p\u0159ekr\u00fdvaj\u00edc\u00edmi se prefixy. Pro n\u011bkter\u00e9 oper\u00e1tory jsou takov\u00e1 omezen\u00ed nep\u0159ijateln\u00e1.<\/p>\n<p>P\u0159i zva\u017eov\u00e1n\u00ed dal\u0161\u00edch mechanism\u016f zaji\u0161t\u011bn\u00ed bezpe\u010dnosti routov\u00e1n\u00ed, ASPA v tomto p\u0159\u00edpad\u011b tak\u00e9 nepom\u016f\u017ee (proto\u017ee se pou\u017e\u00edv\u00e1 AS_PATH z povolen\u00e9 trasy). BGPSec st\u00e1le nen\u00ed optim\u00e1ln\u00ed volbou kv\u016fli n\u00edzk\u00e9mu procentu p\u0159ijet\u00ed a z\u016fst\u00e1vaj\u00edc\u00ed mo\u017enosti downgrade \u00fatok\u016f.<\/p>\n<p>Tak\u017ee m\u00e1me jasn\u00fd zisk pro \u00fato\u010dn\u00edka a nedostatek bezpe\u010dnosti. Skv\u011bl\u00e1 sm\u011bs!<\/p>\n<h3>Co d\u011blat?<\/h3>\n<p>\nZ\u0159ejm\u00fdm a nejradik\u00e1ln\u011bj\u0161\u00edm krokem je p\u0159ehodnocen\u00ed va\u0161\u00ed sou\u010dasn\u00e9 politiky sm\u011brov\u00e1n\u00ed. Rozd\u011blte sv\u00e9 adresn\u00ed prostory na co nejmen\u0161\u00ed \u010d\u00e1sti (bez p\u0159ekryv\u016f), kter\u00e9 chcete ozn\u00e1mit. Podepi\u0161te ROA jen pro n\u011b, ani\u017e byste pou\u017e\u00edvali parametr maxLength. V tomto p\u0159\u00edpad\u011b v\u00e1m sou\u010dasn\u00fd POV m\u016f\u017ee pomoci chr\u00e1nit se p\u0159ed podobn\u00fdm \u00fatokem. Op\u011bt v\u0161ak pro n\u011bkter\u00e9 oper\u00e1tory takov\u00fd p\u0159\u00edstup nen\u00ed rozumn\u00fd kv\u016fli v\u00fdjime\u010dn\u00e9mu pou\u017e\u00edv\u00e1n\u00ed more specific tras. V\u0161echny probl\u00e9my sou\u010dasn\u00e9ho stavu ROA a objekty tras budou pops\u00e1ny v n\u011bkter\u00e9m z na\u0161ich budouc\u00edch materi\u00e1l\u016f.<\/p>\n<p>Krom\u011b toho se m\u016f\u017eete pokusit monitorovat podobn\u00e9 p\u0159epady. K tomu pot\u0159ebujeme spolehliv\u00e9 informace o va\u0161ich prefixech. Pokud tedy nastav\u00edte BGP seanci s na\u0161\u00edm sb\u011bra\u010dem a p\u0159ed\u00e1te n\u00e1m informace o va\u0161\u00ed viditelnosti na internetu, m\u016f\u017eeme naj\u00edt oblast roz\u0161\u00ed\u0159en\u00ed i pro dal\u0161\u00ed incidenty. Pro ty, kte\u0159\u00ed je\u0161t\u011b nejsou p\u0159ipojeni k na\u0161emu monitorovac\u00edmu syst\u00e9mu, n\u00e1m zpo\u010d\u00e1tku bude sta\u010dit seznam tras pouze va\u0161ich prefix\u016f. Pokud v\u0161ak ji\u017e m\u00e1te seanci s n\u00e1mi, pros\u00edm, zkontrolujte, \u017ee byly odesl\u00e1ny v\u0161echny va\u0161e trasy. Bohu\u017eel o tom mus\u00edme p\u0159ipomenout, proto\u017ee \u010d\u00e1st oper\u00e1tor\u016f zapom\u00edn\u00e1 na jeden nebo dva prefixy a t\u00edm vytv\u00e1\u0159\u00ed probl\u00e9my pro na\u0161e vyhled\u00e1vac\u00ed metody. Pokud se v\u0161e ud\u011bl\u00e1 spr\u00e1vn\u011b, budou m\u00edt spolehliv\u00e9 \u00fadaje o va\u0161ich prefixech, kter\u00e9 v budoucnu pomohou automaticky identifikovat a detekovat tento (a jin\u00e9) typy p\u0159epady provozu pro va\u0161e adresn\u00ed prostory.<\/p>\n<p>Pokud se v re\u00e1ln\u00e9m \u010dase dozv\u00edte o takov\u00e9m p\u0159epadu va\u0161eho provozu, m\u016f\u017eete se pokusit protivzoru\u010dit sami. Prvn\u00edm p\u0159\u00edstupem je ozn\u00e1mit trasy s t\u011bmito more specific prefixy samostatn\u011b. V p\u0159\u00edpad\u011b nov\u00e9ho \u00fatoku na tyto prefixy zopakujte.<\/p>\n<p>Druh\u00fdm p\u0159\u00edstupem je potrestat \u00fato\u010dn\u00edka a ty, pro kter\u00e9 je kritick\u00fdm bodem (pro dobr\u00e9 trasy), t\u00edm, \u017ee od\u0159\u00edznete p\u0159\u00edstup va\u0161ich tras k \u00fato\u010dn\u00edku. To lze prov\u00e9st p\u0159id\u00e1n\u00edm ASN \u00fato\u010dn\u00edka do AS_PATH va\u0161ich star\u00fdch tras a t\u00edm je donutit vyhnout se t\u00e9to AS pomoc\u00ed vestav\u011bn\u00e9ho mechanismu detekce cykl\u016f v BGP. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/en\/company\/qrator\/blog\/431244\/\">pro vlastn\u00ed dobro<\/a><\/noindex>.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/qrator\/blog\/447876\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>13 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 RIPE \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c BGP-\u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 (hjjack) \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 RIPE. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043d\u044f\u0442\u0438\u044f \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440, \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043f\u043e\u043b\u0443\u0447\u0430\u043b \u0431\u044b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u043b\u044f \u0432\u044b\u0432\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043d\u0430 \u0447\u0438\u0441\u0442\u0443\u044e \u0432\u043e\u0434\u0443. \u0415\u0441\u043b\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0441\u043e\u0431\u0435\u0440\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0442\u043e \u0442\u0430\u043a\u043e\u0439 LIR, \u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c BGP-\u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31415","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"13 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 RIPE \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0441\u0435 \u043e\u0447\u0435\u043d\u044c \u043f\u043b\u043e\u0445\u043e \u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"13 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 RIPE \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:41:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:41:08+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47V\u0161echno je velmi \u0161patn\u00e9 nebo nov\u00fd zp\u016fsob zachyt\u00e1v\u00e1n\u00ed provozu | ProHoster","description":"Dne 13. b\u0159ezna byl pracovn\u00ed skupin\u011b RIPE pro boj proti zneu\u017e\u00edv\u00e1n\u00ed p\u0159edlo\u017een n\u00e1vrh.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0441\u0435 \u043e\u0447\u0435\u043d\u044c \u043f\u043b\u043e\u0445\u043e \u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster","og:description":"13 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 RIPE \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:08+00:00","article:modified_time":"2019-10-31T18:41:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31415","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 06:04:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:17:25","updated":"2026-01-21 06:04:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31415\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}