1. Introduction
This Anti-Abuse Policy defines RegPEX’s approach to detecting, classifying, and responding to abuse of its infrastructure and services. RegPEX is committed to maintaining a secure and reliable peering environment for all members.
2. Definitions of Abuse
2.1 Network-Based Abuse
| Abuse Type | Description | Severity |
|---|---|---|
| DDoS | Distributed denial-of-service attacks originating from or transiting the IX | Critical |
| BGP Hijacking | Unauthorised announcement of prefixes belonging to other networks | Critical |
| BGP Route Leak | Accidental or intentional propagation of routes beyond intended scope | High |
| Transit / Private Carriage | Use of the RegPEX platform for transit traffic or for private carriage of traffic (point-to-point transport, private VLAN, closed circuit) (Participation Agreement Annex 2.7) | Tiered (Annex 2.6) |
| IP Spoofing | Use of source IP addresses not legitimately assigned to the sender | High |
| ARP/NDP Spoofing | Manipulation of Layer 2/3 address resolution to divert traffic | High |
| MAC Flooding | Excessive MAC announcements to overload switch forwarding tables | Medium |
| Broadcast Storm | Excessive broadcast or multicast traffic affecting the LAN | Medium |
| Port Scanning | Scanning of other members’ infrastructure from the IX | Medium |
| Spam Relay | Use of the IX infrastructure to relay spam or malicious email | Medium |
2.2 Operational Abuse
| Abuse Type | Description | Severity |
|---|---|---|
| False Information | Providing materially false or misleading membership or technical data | High |
| Unauthorised Access | Accessing RegPEX or member systems without authorisation | Critical |
| Policy Breach | Significant or repeated breach of RegPEX policies | Medium–High |
3. Detection
3.1 Automatic Detection
- sFlow/NetFlow analysis: Traffic anomaly and DDoS detection
- BGP monitoring: RPKI and IRRDB validation; hijacking and route leak detection
- ARP monitoring: Detection of ARP/NDP spoofing and MAC flooding
- Traffic anomaly detection: Statistical deviation from baseline
- Max-prefix alarms: Notification of prefix limit violations
3.2 Manual Detection
- Member reports: Complaints and incident reports from members
- NOC review: Operational monitoring and incident investigation
- External sources: CERTs, ISPs, other IXPs, and trusted third parties
4. Intervention Tiers
In case of non-compliance, intervention follows Participation Agreement Annex 2.6:
| Tier | Situation | Intervention | Notice |
|---|---|---|---|
| 1 | Active threat to platform integrity (loop, broadcast storm, DDoS-driven flooding) | Immediate suspension of the port | Simultaneously or immediately afterwards |
| 2 | Technical rule breach that does not pose a threat | Written warning, five (5) business days to cure | In advance |
| 3 | Uncured breach | Suspension of the port | In advance |
| 4 | Repeated or serious breach | Termination of the Agreement | In accordance with the provisions of the main Agreement |
4.1 Emergency Response Rights
A Tier 1 intervention may be applied without prior notice in order to protect the integrity of the platform. The OPERATOR notifies the PARTICIPANT in writing of the reason for the intervention and its technical basis within twenty-four (24) hours (Participation Agreement Annex 2.6).
4.2 Transit and Private Carriage
RegPEX may be used only for the exchange of traffic for peering between PARTICIPANTs and hobby members; transit and private carriage of traffic are prohibited (Participation Agreement Annex 2.7). What is restricted is the use of the RegPEX platform for transit traffic; a PARTICIPANT providing transit services to its own customers outside RegPEX is not restricted.
The indicators — the share in bytes of traffic outside the PARTICIPANT's customer cone (the expansion of its AS-SET registered in the IRR), an unregistered MAC address, an ethertype other than IPv4, IPv6 and ARP, IP traffic whose source and destination both lie outside the customer cones of the parties exchanging it, and the same MAC address appearing on more than one RegPEX unit — only initiate a review and warning; they are not in themselves a breach and do not give rise to automatic sanctions. An intensive or continuous flow of traffic between two parties is not in itself a private carriage indicator. The review relies on route server data and only on the header fields of sampled flow data (sFlow); traffic content is not inspected.
If a breach is proven in the review, the tiers in Annex 2.6 apply: as a rule starting with Tier 2 (written warning, five business days to cure); if not cured, Tier 3 (suspension), and if repeated or serious, Tier 4 (termination — main Agreement Article 10.3). If the breach poses an active threat to platform integrity, Tier 1 and main Agreement Article 7A apply.
5. Member Obligations
Members are expected to:
- BCP-38/BCP-84: Implement anti-spoofing (ingress filtering) on all prefixes
- RPKI ROA: Maintain valid Route Origin Authorisations for announced prefixes
- IRRDB maintenance: Keep AS-SET and route objects accurate and up to date
- Max-prefix: Configure appropriate BGP max-prefix limits
- Bogon filtering: Filter invalid and reserved address space
- Incident reporting: Report abuse originating from or targeting their infrastructure
- Cooperation: Cooperate with RegPEX and other members during abuse investigations
6. MANRS IXP Programme Compliance
RegPEX supports the Mutually Agreed Norms for Routing Security (MANRS) IXP Programme. Member obligations align with MANRS requirements, including:
- Filtering: Implementation of prefix filtering (RPKI, IRRDB)
- Anti-spoofing: Prevention of source address spoofing
- Coordination: Participation in coordination and incident response
- Global validation: Support for RPKI and route validation globally
7. Reporting Abuse
Report to: peering@regpex.tr / +90 (312) 988 00 00
Reports should include, where available:
- Date and time (UTC) of the incident
- Source IP addresses and related identifiers
- Attack or abuse type
- Logs or other evidence
- Impact description
8. Record Keeping and Reporting
- Abuse incidents are logged for investigation and potential escalation
- RegPEX publishes quarterly anonymous abuse reports summarising incident types and trends without identifying individual members
9. Policy Updates
RegPEX may update this policy as threats and best practices evolve. Material changes will be communicated to members with reasonable notice.