{"id":31415,"date":"2019-10-31T21:41:08","date_gmt":"2019-10-31T18:41:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika\/"},"modified":"2019-10-31T21:41:08","modified_gmt":"2019-10-31T18:41:08","slug":"vse-ochen-ploho-ili-novyj-vid-perehvata-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika","title":{"rendered":"V\u0161etko je ve\u013emi zl\u00e9 alebo nov\u00fd sp\u00f4sob zachyt\u00e1vania prenosu d\u00e1t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>13. marca sa do pracovnej skupiny RIPE na boj proti zneu\u017e\u00edvaniu dostal n\u00e1vrh <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ripe.net\/ripe\/mail\/archives\/anti-abuse-wg\/2019-March\/004585.html\">zv\u00e1\u017ei\u0165 BGP-preberanie (hjjack) ako poru\u0161enie politiky RIPE. V pr\u00edpade prijatia n\u00e1vrhu by internetov\u00fd poskytovate\u013e, ktor\u00fd bol napadnut\u00fd preberan\u00edm prev\u00e1dzky, mal mo\u017enos\u0165 posla\u0165 osobitn\u00fa \u017eiados\u0165 na odhalenie p\u00e1chate\u013ea. Ak expertn\u00e1 skupina zhroma\u017ed\u00ed dostato\u010dn\u00e9 potvrden\u00e9 d\u00f4kazy, tak\u00fd LIR, ktor\u00fd je zdrojom BGP-preberania, by bol pova\u017eovan\u00fd za poru\u0161ovate\u013ea a mohol by by\u0165 zbaven\u00fd statusu LIR. Boli aj niektor\u00e9 argumenty<\/a><\/noindex> proti tomu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ripe.net\/ripe\/mail\/archives\/anti-abuse-wg\/2019-March\/004601.html\">V tejto publik\u00e1cii chceme uk\u00e1za\u0165 pr\u00edklad \u00fatoku, ke\u010f nebol pod ot\u00e1zkou iba skuto\u010dn\u00fd p\u00e1chate\u013e, ale aj cel\u00fd zoznam postihnut\u00fdch prefixov. Navy\u0161e, tak\u00fdto \u00fatok op\u00e4\u0165 vyvol\u00e1va ot\u00e1zky t\u00fdkaj\u00face sa motiv\u00e1cie bud\u00facich preberan\u00ed prev\u00e1dzky tohto typu.<\/a><\/noindex> zmeny.<\/p>\n<p>Posledn\u00e9 dve roky sa v tla\u010di ako BGP-preberania diskutovali iba konflikty typu MOAS (Multiple Origin Autonomous System). MOAS je \u0161peci\u00e1lny pr\u00edpad, ke\u010f dve r\u00f4zne auton\u00f3mne syst\u00e9my oznamuj\u00fa konfliktuj\u00face prefixy s pr\u00edslu\u0161n\u00fdmi \u010d\u00edslami ASN v AS_PATH (prv\u00e9 ASN v AS_PATH, \u010falej v texte - origin ASN). M\u00f4\u017eeme v\u0161ak uvies\u0165 aspo\u0148<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n3 \u010fal\u0161ie typy <noindex><a rel=\"nofollow\" href=\"https:\/\/pc.nanog.org\/static\/published\/meetings\/NANOG75\/1892\/20190219_Gavrichenkov_Four_Years_Of_v1.pdf\">preberania prev\u00e1dzky, ktor\u00e9 umo\u017e\u0148uj\u00fa p\u00e1chate\u013eovi manipulova\u0165 s atrib\u00fatom AS_PATH s r\u00f4znymi cie\u013emi, vr\u00e1tane obch\u00e1dzania modern\u00fdch pr\u00edstupov k filtr\u00e1cii a monitorovaniu. Zn\u00e1mym typom \u00fatoku<\/a><\/noindex> Pilosova-Kapely <noindex><a rel=\"nofollow\" href=\"https:\/\/we.riseup.net\/assets\/43591\/defcon-16-pilosov-kapela.pdf\">je posledn\u00fd typ tak\u00e9ho preberania, ale rozhodne nie\u010do menej v\u00fdznamn\u00e9. Je ve\u013emi pravdepodobn\u00e9, \u017ee pr\u00e1ve tak\u00fdto \u00fatok sme mohli pozorova\u0165 v priebehu posledn\u00fdch t\u00fd\u017ed\u0148ov. Tak\u00e1to udalos\u0165 m\u00e1 pochopite\u013en\u00fd charakter a dostato\u010dne v\u00e1\u017ene d\u00f4sledky.<\/a><\/noindex> T\u00ed, ktor\u00ed h\u013eadaj\u00fa verziu TL;DR, si m\u00f4\u017eu posun\u00fa\u0165 k podnadpisu \u201eIde\u00e1lny \u00fatok\u201c.<\/p>\n<p>Sie\u0165ov\u00fd background<\/p>\n<h3>(aby ste lep\u0161ie ch\u00e1pali procesy zapojen\u00e9 do tohto incidentu)<\/h3>\n<p><i>Ak chcete posla\u0165 paket a m\u00e1te nieko\u013eko prefixov v routovacej tabu\u013eke obsahuj\u00facich cie\u013eov\u00fa IP adresu, pou\u017eijete trasu pre prefix s maxim\u00e1lnou d\u013a\u017ekou. Ak v\u0161ak existuje v routovacej tabu\u013eke nieko\u013eko r\u00f4znych tr\u00e1s pre jeden prefix, vyberiete si t\u00fa najlep\u0161iu (pod\u013ea mechanizmu v\u00fdberu najlep\u0161ej cesty).<\/i><\/p>\n<p>Ak chcete odosla\u0165 paket a m\u00e1te v routovacej tabu\u013eke nieko\u013eko prefixov obsahuj\u00facich cie\u013eov\u00fa IP adresu, pou\u017eijete smerovanie pre prefix s maxim\u00e1lnou d\u013a\u017ekou. Ak v\u0161ak v routovacej tabu\u013eke existuje nieko\u013eko r\u00f4znych smerovan\u00ed pre jeden prefix, vyberiete si najlep\u0161ie (v s\u00falade s mechanizmom v\u00fdberu najlep\u0161ej cesty).<\/p>\n<p>Existuj\u00face pr\u00edstupy k filtrovania a monitorovaniu sa sna\u017eia analyzova\u0165 trasy a prij\u00edma\u0165 rozhodnutia anal\u00fdzou atrib\u00fatu AS_PATH. Smerova\u010d m\u00f4\u017ee zmeni\u0165 tento atrib\u00fat na ak\u00fako\u013evek hodnotu po\u010das oznamovania. Jednoduch\u00e9 pridanie ASN vlastn\u00edka na za\u010diatok AS_PATH (ako origin ASN) m\u00f4\u017ee by\u0165 dostato\u010dn\u00e9 na ob\u00eddenie s\u00fa\u010dasn\u00fdch mechanizmov overovania zdroja. Navy\u0161e, ak existuje trasa od napadnut\u00e9ho ASN k v\u00e1m, vznik\u00e1 mo\u017enos\u0165 vy\u0165a\u017ei\u0165 a pou\u017ei\u0165 AS_PATH tejto trasy vo va\u0161ich \u010fal\u0161\u00edch ozn\u00e1meniach. Ak\u00e9ko\u013evek overovanie platnosti len AS_PATH pre va\u0161e falo\u0161n\u00e9 ozn\u00e1menia nakoniec prejde.<\/p>\n<p>E\u0161te existuje nieko\u013eko hodn\u00fdch spomenutia obmedzen\u00ed. Po prv\u00e9, v pr\u00edpade filtrovania prefixov vy\u0161\u0161\u00edm poskytovate\u013eom m\u00f4\u017ee by\u0165 va\u0161a trasa aj tak odfiltrovan\u00e1 (aj s korektn\u00fdm AS_PATH), ak prefix nepatr\u00ed do v\u00e1\u0161ho klientsk\u00e9ho ku\u017eela nastaven\u00e9ho u upstreamu. Po druh\u00e9 - platn\u00fd AS_PATH sa m\u00f4\u017ee sta\u0165 neplatn\u00fdm, ak vytvoren\u00e1 trasa je oznamovan\u00e1 v nespr\u00e1vnych smeroch a teda poru\u0161uje politiku smerovania. A nakoniec - ak\u00e1ko\u013evek trasa s prefixom poru\u0161uj\u00facim ROA length m\u00f4\u017ee by\u0165 pova\u017eovan\u00e1 za neplatn\u00fa.<\/p>\n<h3>Incident<\/h3>\n<p>\nPred nieko\u013ek\u00fdmi t\u00fd\u017ed\u0148ami sme dostali s\u0165a\u017enos\u0165 od jedn\u00e9ho z u\u017e\u00edvate\u013eov. Videli sme trasy s jeho origin\u00e1lnym ASN a prefixmi \/25, zatia\u013e \u010do u\u017e\u00edvate\u013e tvrdil, \u017ee ich neoznamoval.<\/p>\n<p><code>TABLE_DUMP2|1554076803|B|xxx|265466|78.163.7.0\/25|265466 262761 263444 22356 3491 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.7.128\/25|265466 262761 263444 22356 3491 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.18.0\/25|265466 262761 263444 6762 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.18.128\/25|265466 262761 263444 6762 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.226.0\/25|265466 262761 263444 22356 3491 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.163.226.128\/25|265466 262761 263444 22356 3491 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.164.7.0\/25|265466 262761 263444 6762 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076803|B|xxx|265466|78.164.7.128\/25|265466 262761 263444 6762 2914 9121|NE\u00daPLN\u00c9|xxx|0|0||NAG||<\/code><br \/>\n<i>Pr\u00edklady ozn\u00e1men\u00ed na za\u010diatku apr\u00edla 2019<\/i><\/p>\n<p>NTT na ceste pre prefix \/25 rob\u00ed jeho obzvl\u00e1\u0161\u0165 podozriv\u00fdm. Po\u010das incidentu LG NTT ni\u010d nevedel o tejto trase. Tak\u017ee \u00e1no, nejak\u00fd oper\u00e1tor vytv\u00e1ra cel\u00fd AS_PATH pre tieto prefixy! Kontrola na in\u00fdch smerova\u010doch umo\u017e\u0148uje vyzdvihn\u00fa\u0165 jeden osobitn\u00fd ASN: AS263444. Pozreli sme sa na in\u00e9 trasy s touto auton\u00f3mnou s\u00fastavou a stretli sme sa s nasleduj\u00facou situ\u00e1ciou:<\/p>\n<p><code>TABLE_DUMP2|1554076800|B|xxx|265466|1.6.36.0\/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.6.38.0\/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.23.143.0\/25|265466 262761 263444 22356 6762 9498 9730 45528|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.23.143.128\/25|265466 262761 263444 22356 6762 9498 9730 45528|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.24.0.0\/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.24.128.0\/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.26.0.0\/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.26.128.0\/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.64.96.0\/20|265466 262761 263444 6762 3491 4760|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.64.112.0\/20|265466 262761 263444 6762 3491 4760|IGP|xxx|0|0||NAG||<\/code><br \/>\n<i>Sk\u00faste uh\u00e1dnu\u0165, \u010do tu nie je v poriadku<\/i><\/p>\n<p>Zd\u00e1 sa, \u017ee niekto vzal prefix z trasy, rozdelil ho na dve \u010dasti a ozn\u00e1mil trasu s t\u00fdm ist\u00fdm AS_PATH pre tieto dva prefixy.<\/p>\n<p><code>TABLE_DUMP2|1554076800|B|xxx|263444|1.6.36.0\/23|263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|263444|1.6.38.0\/23|263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|61775|1.6.36.0\/23|61775 262761 263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|61775|1.6.38.0\/23|61775 262761 263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.6.36.0\/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|265466|1.6.38.0\/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|28172|1.6.36.0\/23|28172 52531 263444 52320 9583|IGP|xxx|0|0||NAG||<br \/>\nTABLE_DUMP2|1554076800|B|xxx|28172|1.6.38.0\/23|28172 52531 263444 52320 9583|IGP|xxx|0|0||NAG||<\/code><br \/>\n<i>Pr\u00edklady tr\u00e1s pre jeden z p\u00e1rov rozdelen\u00fdch prefixov<\/i><\/p>\n<p>Vyn\u00e1ra sa hne\u010f nieko\u013eko ot\u00e1zok. Skuto\u010dne niekto vysk\u00fa\u0161al v praxi tento typ zachytenia? Niekto prijal tieto trasy? Ak\u00e9 prefixy boli dotknut\u00e9?<\/p>\n<p>Tu a za\u010d\u00edna na\u0161a s\u00e9ria ne\u00faspechov a \u010fal\u0161ie kolo sklamania v aktu\u00e1lnom zdravotnom stave Internetu.<\/p>\n<h3>Cesta ne\u00faspechov<\/h3>\n<p>\nO v\u0161etkom poriadku. Ako m\u00f4\u017eeme ur\u010di\u0165, ktor\u00e9 smerova\u010de prijali tak\u00e9 prepojen\u00e9 trasy a ktor\u00fdch prev\u00e1dzka m\u00f4\u017ee by\u0165 presmerovan\u00e1 u\u017e dnes? Rozhodli sme sa za\u010da\u0165 s prefixmi \/25, preto\u017ee \u201ejednoducho nem\u00f4\u017eu ma\u0165 glob\u00e1lne roz\u0161\u00edrenie\u201c. Ako m\u00f4\u017eete uh\u00e1dnu\u0165 \u2014 ve\u013emi sme sa m\u00fdlili. Tento ukazovate\u013e sa uk\u00e1zal ako pr\u00edli\u0161 \u0161umiv\u00fd a trasy s tak\u00fdmi prefixmi sa m\u00f4\u017eu objavi\u0165 aj od oper\u00e1torov Tier-1. Napr\u00edklad NTT m\u00e1 okolo 50 tak\u00fdch prefixov, ktor\u00e9 \u0161\u00edri medzi svojich klientov. Na druhej strane, tento ukazovate\u013e je zl\u00fd, preto\u017ee tak\u00e9 prefixy m\u00f4\u017eu by\u0165 filtrovan\u00e9 v pr\u00edpade, \u017ee oper\u00e1tor nasadzuje <noindex><a rel=\"nofollow\" href=\"http:\/\/bgpfilterguide.nlnog.net\/guides\/small_prefixes\/\">filter pre mal\u00e9 prefixy<\/a><\/noindex>, vo v\u0161etk\u00fdch smeroch. Preto je tento pr\u00edstup nevhodn\u00fd na vyh\u013ead\u00e1vanie v\u0161etk\u00fdch oper\u00e1torov, ktor\u00fdch prev\u00e1dzka bola presmerovan\u00e1 v d\u00f4sledku tak\u00e9hoto incidentu.<\/p>\n<p>\u010eal\u0161\u00edm dobr\u00fdm n\u00e1padom sa n\u00e1m zdalo pozrie\u0165 sa na <noindex><a rel=\"nofollow\" href=\"https:\/\/datatracker.ietf.org\/doc\/rfc6811\/\">POV<\/a><\/noindex>. Najm\u00e4 na trasy poru\u0161uj\u00face pravidlo maxLength pr\u00edslu\u0161n\u00e9ho ROA. Takto by sme mohli n\u00e1js\u0165 po\u010det r\u00f4znych origin\u00e1lnych ASN so statusom Invalid, ktor\u00e9 boli vidite\u013en\u00e9 pred touto AS. Napriek tomu existuje \u201emal\u00fd\u201c probl\u00e9m. Priemern\u00e1 hodnota (medi\u00e1n a moda) tohto \u010d\u00edsla (po\u010dtu r\u00f4znych origin\u00e1lnych ASN) je pribli\u017ene 150 a aj ke\u010f odfiltrujeme mal\u00e9 prefixy, zostane nad 70. T\u00e1to situ\u00e1cia m\u00e1 celkom jednoduch\u00e9 vysvetlenie: existuje len nieko\u013eko oper\u00e1torov, ktor\u00ed u\u017e nasadili ROA filtre s politikou \u201eresetova\u0165 Invalid trasy\u201c na vstupn\u00fdch bodoch, tak\u017ee kdeko\u013evek vo skuto\u010dnom svete sa objav\u00ed trasa s poru\u0161en\u00edm ROA, m\u00f4\u017ee sa \u0161\u00edri\u0165 vo v\u0161etk\u00fdch smeroch.<\/p>\n<p>Posledn\u00e9 dva pr\u00edstupy umo\u017e\u0148uj\u00fa n\u00e1js\u0165 oper\u00e1torov, ktor\u00ed si v\u0161imli n\u00e1\u0161 incident (ke\u010f\u017ee bol dostato\u010dne ve\u013ek\u00fd), ale celkovo s\u00fa nepraktick\u00e9. Dobre, ale m\u00f4\u017eeme n\u00e1js\u0165 \u00fato\u010dn\u00edka? Ak\u00e9 s\u00fa v\u0161eobecn\u00e9 znaky takej manipul\u00e1cie AS_PATH? Existuje nieko\u013eko z\u00e1kladn\u00fdch predpokladov:<\/p>\n<ul>\n<li>Prefix nebol predt\u00fdm nikde zaznamenan\u00fd;<\/li>\n<li>Origin ASN (pripomenutie: prv\u00fd ASN v AS_PATH) je platn\u00fd;<\/li>\n<li>Posledn\u00fd ASN v AS_PATH - to je ASN \u00fato\u010dn\u00edka (v pr\u00edpade, \u017ee jeho sused kontroluje ASN suseda na v\u0161etk\u00fdch prich\u00e1dzaj\u00facich tras\u00e1ch);<\/li>\n<li>\u00datok vych\u00e1dza od jedn\u00e9ho poskytovate\u013ea.<\/li>\n<\/ul>\n<p>\nAk s\u00fa v\u0161etky predpoklady spr\u00e1vne, na v\u0161etk\u00fdch nespr\u00e1vnych tras\u00e1ch bude prezentovan\u00e9 ASN \u00fato\u010dn\u00edka (okrem p\u00f4vodn\u00e9ho ASN) a tak to je \"kritick\u00fd\" bod. Medzi skuto\u010dn\u00fdmi \u00fanoscami sa nach\u00e1dzal aj AS263444, hoci boli aj in\u00ed. Aj ke\u010f sme vyl\u00fa\u010dili trasy incidentu z \u00favahy. Pre\u010do? Kritick\u00fd bod m\u00f4\u017ee zosta\u0165 kritick\u00fd aj pre spr\u00e1vne trasy. M\u00f4\u017ee by\u0165 v\u00fdsledkom zl\u00e9ho prepojenia v nejakom regi\u00f3ne alebo obmedzen\u00ed na\u0161ej vlastnej vidite\u013enosti.<\/p>\n<p>V\u00fdsledkom je: existuje sp\u00f4sob, ako odhali\u0165 \u00fato\u010dn\u00edka, ale len za podmienky splnenia v\u0161etk\u00fdch uveden\u00fdch krit\u00e9ri\u00ed a len vtedy, ke\u010f je zachytenie dostato\u010dne ve\u013ek\u00e9 na prekro\u010denie prahov monitorovania. Ak v\u0161ak niektor\u00e9 z t\u00fdchto faktorov nie s\u00fa splnen\u00e9, m\u00f4\u017eeme vy\u010dleni\u0165 prefixy, ktor\u00e9 boli postihnut\u00e9 tak\u00fdmto zachyten\u00edm? Pre ur\u010dit\u00e9 oper\u00e1torov \u2013 \u00e1no.<\/p>\n<p>Ke\u010f \u00fato\u010dn\u00edk vytvor\u00ed more specific trasu, tak\u00fd prefix nie je oznamovan\u00fd skuto\u010dn\u00fdm vlastn\u00edkom. V pr\u00edpade, ak m\u00e1te od neho dynamick\u00fd zoznam v\u0161etk\u00fdch jeho prefixov, je mo\u017en\u00e9 vykona\u0165 porovnanie a n\u00e1js\u0165 skreslen\u00e9 more specific trasy. Tento zoznam prefixov zbierame pomocou na\u0161ich BGP rel\u00e1ci\u00ed, preto\u017ee n\u00e1m odovzd\u00e1vaj\u00fa nielen \u00fapln\u00fd zoznam tr\u00e1s, ktor\u00e9 oper\u00e1tor vid\u00ed pr\u00e1ve teraz, ale aj zoznam v\u0161etk\u00fdch prefixov, ktor\u00e9 chce ozn\u00e1mi\u0165 svetu. Bohu\u017eia\u013e, v s\u00fa\u010dasnosti existuje nieko\u013eko desiatok pou\u017e\u00edvate\u013eov Radar, ktor\u00ed posledn\u00fa \u010das\u0165 vykon\u00e1vaj\u00fa nie \u00faplne spr\u00e1vne. \u010coskoro ich upozorn\u00edme a pok\u00fasime sa t\u00fato situ\u00e1ciu vyrie\u0161i\u0165. V\u0161etci ostatn\u00ed sa m\u00f4\u017eu pripoji\u0165 k n\u00e1\u0161mu monitorovaciemu syst\u00e9mu pr\u00e1ve teraz.<\/p>\n<p>Ak sa vr\u00e1time k p\u00f4vodn\u00e9mu incidentu, \u00fato\u010dn\u00edka a rozsah distrib\u00facie sme odhalili pomocou vyh\u013ead\u00e1vania kritick\u00fdch bodov. Prekvapivo, AS263444 posielal sfal\u0161ovan\u00e9 trasy nie v\u0161etk\u00fdm svojim klientom. Hoci existuje aj podivnej\u0161\u00ed aspekt.<\/p>\n<p><code>BGP4MP|1554905421|A|xxx|263444|178.248.236.0\/24|263444 6762 197068|IGP|xxx|0|0|13106:12832 22356:6453 65444:20000|NAG||<br \/>\nBGP4MP|1554905421|A|xxx|263444|178.248.237.0\/24|263444 6762 197068|IGP|xxx|0|0|13106:12832 22356:6453 65444:20000|NAG||<\/code><br \/>\n<i>Ned\u00e1vny pr\u00edklad pokusu o zachytenie n\u00e1\u0161ho adresn\u00e9ho priestoru<\/i><\/p>\n<p>Ke\u010f boli vytvoren\u00e9 more specific prefixy pre na\u0161e prefixy, pou\u017eil sa \u0161peci\u00e1lne vytvoren\u00fd AS_PATH. Tento AS_PATH v\u0161ak nemohol by\u0165 prevzat\u00fd z ktor\u00e9hoko\u013evek z na\u0161ich predch\u00e1dzaj\u00facich tr\u00e1s. Nem\u00e1me dokonca ani spojenie s AS6762. Pozrime sa na in\u00e9 trasy v incidente: niektor\u00e9 z nich mali skuto\u010dn\u00fd AS_PATH, ktor\u00fd bol pou\u017eit\u00fd sk\u00f4r, a in\u00e9 nie, aj ke\u010f vyzeraj\u00fa ako skuto\u010dn\u00e9. Dodato\u010dn\u00e1 zmena AS_PATH nem\u00e1 \u017eiadny praktick\u00fd zmysel, preto\u017ee v ka\u017edom pr\u00edpade bude prem\u00e1vka presmerovan\u00e1 na \u00fato\u010dn\u00edka, ale trasy s \u201ezl\u00fdm\u201c AS_PATH m\u00f4\u017eu by\u0165 filtrovan\u00e9 ASPA alebo ak\u00fdmko\u013evek in\u00fdm mechanizmom overovania. Tu sme rozm\u00fd\u0161\u013eali o motiv\u00e1cii \u00fanoscov. Moment\u00e1lne n\u00e1m ch\u00fdbaj\u00fa \u00fadaje na to, aby sme tvrdili, \u017ee tento incident bol pl\u00e1novan\u00fdm \u00fatokom. Napriek tomu \u2014 je to mo\u017en\u00e9. Sk\u00fasme si predstavi\u0165 aj ke\u010f hypotetick\u00fa, ale potenci\u00e1lne ve\u013emi re\u00e1lnu situ\u00e1ciu.<\/p>\n<h3>Ide\u00e1lny \u00fatok<\/h3>\n<p>\n\u010co m\u00e1me? Predpokladajme, \u017ee ste tranzitn\u00fd poskytovate\u013e, ktor\u00fd vysiela trasy pre svojich klientov. Ak maj\u00fa va\u0161i klienti viacn\u00e1sobn\u00fa pr\u00edtomnos\u0165 (multihome), dostanete len \u010das\u0165 ich prem\u00e1vky. Ale \u010d\u00edm viac prem\u00e1vky \u2014 t\u00fdm v\u00e4\u010d\u0161\u00ed je v\u00e1\u0161 pr\u00edjem. Preto, ak za\u010dnete oznamova\u0165 prefixy podsiet\u00ed t\u00fdchto rovnak\u00fdch tr\u00e1s so rovnak\u00fdm AS_PATH, dostanete zvy\u0161ok ich prem\u00e1vky. V d\u00f4sledku toho aj zvy\u0161ok pe\u0148az\u00ed.<\/p>\n<p>Pom\u00f4\u017ee tu ROA? Mo\u017eno, \u00e1no, ak sa rozhodnete \u00faplne vzda\u0165 pou\u017e\u00edvania <noindex><a rel=\"nofollow\" href=\"https:\/\/datatracker.ietf.org\/doc\/draft-ietf-sidrops-rpkimaxlen\/\">maxLength<\/a><\/noindex>. Okrem toho, pri tomto je ve\u013emi ne\u017eelan\u00e9 ma\u0165 z\u00e1znamy ROA s prekryvaj\u00facimi sa prefixami. Pre niektor\u00fdch oper\u00e1torov s\u00fa tak\u00e9to obmedzenia neprijate\u013en\u00e9.<\/p>\n<p>Pri zva\u017eovan\u00ed in\u00fdch mechanizmov zabezpe\u010denia smerovania, v tomto pr\u00edpade ASPA tie\u017e nepom\u00f4\u017ee (preto\u017ee sa pou\u017e\u00edva AS_PATH z povolenej trasy). BGPSec st\u00e1le nie je optim\u00e1lna mo\u017enos\u0165 kv\u00f4li n\u00edzkemu percentu prijatia a zost\u00e1vaj\u00facej mo\u017enosti downgrade \u00fatokov.<\/p>\n<p>Tak\u017ee m\u00e1me zjavn\u00fd zisk pre \u00fato\u010dn\u00edka a nedostatok bezpe\u010dnosti. Skvel\u00e1 kombin\u00e1cia!<\/p>\n<h3>\u010co treba robi\u0165?<\/h3>\n<p>\nO\u010dividn\u00fd a najradik\u00e1lnej\u0161\u00ed krok \u2014 prehodnoti\u0165 va\u0161u aktu\u00e1lnu politiku smerovania. Rozde\u013ete va\u0161e adresn\u00e9 priestory na najmen\u0161ie kusy (bez prekrytia), ktor\u00e9 chcete ozn\u00e1mi\u0165. Podp\u00ed\u0161te ROA iba pre nich, bez pou\u017eitia parametra maxLength. V tomto pr\u00edpade v\u00e1s s\u00fa\u010dasn\u00fd POV m\u00f4\u017ee ochr\u00e1ni\u0165 pred tak\u00fdmto \u00fatokom. Av\u0161ak znovu, pre niektor\u00fdch oper\u00e1torov sa tak\u00fdto pr\u00edstup nemus\u00ed javi\u0165 ako rozumn\u00fd kv\u00f4li v\u00fdnimo\u010dn\u00e9mu pou\u017e\u00edvaniu more specific tr\u00e1s. V\u0161etky probl\u00e9my s\u00fa\u010dasn\u00e9ho stavu ROA a route objektov bud\u00fa op\u00edsan\u00e9 v jednom z na\u0161ich bud\u00facich materi\u00e1lov.<\/p>\n<p>Okrem toho sa m\u00f4\u017eete pok\u00fasi\u0165 monitorova\u0165 podobn\u00e9 prehliadky. Na to potrebujeme d\u00f4veryhodn\u00e9 inform\u00e1cie o va\u0161ich prefixoch. Tak\u017ee, ak si nastav\u00edte BGP session s na\u0161\u00edm zberate\u013eom a poskytnete n\u00e1m inform\u00e1cie o va\u0161ej vidite\u013enosti na internete \u2014 m\u00f4\u017eeme n\u00e1js\u0165 rozsah pre \u010fal\u0161ie incidenty. Pre t\u00fdch, ktor\u00ed e\u0161te nie s\u00fa pripojen\u00ed k n\u00e1\u0161mu monitorovaciemu syst\u00e9mu \u2014 na za\u010diatok n\u00e1m bude sta\u010di\u0165 zoznam tr\u00e1s len s va\u0161imi prefixmi. Ak v\u0161ak m\u00e1te s nami nastaven\u00fa session, pros\u00edm, overte, \u017ee boli odoslan\u00e9 v\u0161etky va\u0161e trasy. Bohu\u017eia\u013e, je potrebn\u00e9 to pripomen\u00fa\u0165, preto\u017ee niektor\u00ed oper\u00e1tori zab\u00fadaj\u00fa na jeden alebo dva prefixy a t\u00fdm p\u00e1dom vytv\u00e1raj\u00fa prek\u00e1\u017eky pre na\u0161e met\u00f3dy vyh\u013ead\u00e1vania. Ak v\u0161etko urob\u00edte spr\u00e1vne, budeme ma\u0165 spo\u013eahliv\u00e9 \u00fadaje o va\u0161ich prefixoch, ktor\u00e9 v bud\u00facnosti pom\u00f4\u017eu automaticky identifikova\u0165 a detekova\u0165 tak\u00e9 (a in\u00e9) typy prehliadania prev\u00e1dzky pre v\u00e1\u0161 adresn\u00fd priestor.<\/p>\n<p>Ak ste v re\u00e1lnom \u010dase zistili tak\u00fdto prehliadanie va\u0161ej prev\u00e1dzky, m\u00f4\u017eete sa pok\u00fasi\u0165 proti tomu zasiahnu\u0165 sami. Prv\u00fd pr\u00edstup \u2014 ozn\u00e1mi\u0165 trasy s t\u00fdmito more specific prefixami sami. V pr\u00edpade nov\u00e9ho \u00fatoku na tieto prefixy \u2014 zopakujte to.<\/p>\n<p>Druh\u00fd pr\u00edstup \u2014 potresta\u0165 \u00fato\u010dn\u00edka a t\u00fdch, pre ktor\u00fdch je kritick\u00fdm bodom (pre dobr\u00e9 trasy), odrezan\u00edm pr\u00edstupu va\u0161ich tr\u00e1s k \u00fato\u010dn\u00edkovi. To je mo\u017en\u00e9 dosiahnu\u0165 pridan\u00edm ASN \u00fato\u010dn\u00edka do AS_PATH va\u0161ich star\u00fdch tr\u00e1s a t\u00fdm ich prin\u00fati\u0165 vyhn\u00fa\u0165 sa tejto AS, vyu\u017e\u00edvaj\u00fac zabudovan\u00fd mechanizmus detekcie cyklov v BGP. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/en\/company\/qrator\/blog\/431244\/\">pre vlastn\u00e9 dobro<\/a><\/noindex>.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/qrator\/blog\/447876\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>13 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 RIPE \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c BGP-\u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 (hjjack) \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 RIPE. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043d\u044f\u0442\u0438\u044f \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440, \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043f\u043e\u043b\u0443\u0447\u0430\u043b \u0431\u044b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u043b\u044f \u0432\u044b\u0432\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043d\u0430 \u0447\u0438\u0441\u0442\u0443\u044e \u0432\u043e\u0434\u0443. \u0415\u0441\u043b\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0441\u043e\u0431\u0435\u0440\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0442\u043e \u0442\u0430\u043a\u043e\u0439 LIR, \u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c BGP-\u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31415","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"13 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 RIPE \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0441\u0435 \u043e\u0447\u0435\u043d\u044c \u043f\u043b\u043e\u0445\u043e \u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"13 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 RIPE \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:41:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:41:08+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47V\u0161etko je ve\u013emi zl\u00e9 alebo nov\u00fd sp\u00f4sob zachyt\u00e1vania prev\u00e1dzky | ProHoster","description":"13. marca bola do pracovnej skupiny RIPE pre boj proti zneu\u017e\u00edvaniu predlo\u017een\u00e1 pet\u00edcia.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0441\u0435 \u043e\u0447\u0435\u043d\u044c \u043f\u043b\u043e\u0445\u043e \u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster","og:description":"13 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 RIPE \u043f\u043e \u0431\u043e\u0440\u044c\u0431\u0435 \u0441\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vse-ochen-ploho-ili-novyj-vid-perehvata-trafika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:08+00:00","article:modified_time":"2019-10-31T18:41:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31415","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 06:04:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:17:25","updated":"2026-01-21 06:04:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31415\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}