I am a bit stuck with OSPF. Want to know how an OSPF network react when an attacker deactivate one of the network interfaces on the router? What are possible impacts on the network if this deactivation happens repeatedly on all routers of the network.

One possible scenario I can think of but not sure is that this attack can erase the link state info of all routers in the network and thus render it useless.

  • 2
    OSPF will react the exact same way as if an administrator shut down the interface or unplugged the cable. The change to the network will be propagated to the rest of the OSPF area. The bigger problem is that if an attacker can do that to multiple routers, then the attacker already owns your network.
    – Ron Maupin
    Aug 2 '20 at 3:59
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17 '20 at 20:46

When a router interface loses its link - for whatever reason - OSPF communicates that new link state to the other routers. Accordingly, the routers remove the corresponding route from their routing tables (if it was a shortest path). If other gateways to the connected subnet exist (with previously longer paths) those will be used instead. With no gateway left, the subnet cannot be routed to any more and it becomes orphaned.

As Ron has pointed out, an attacker doing that to your network already owns it. That shows a fundamental lack of security that you need to re-establish before anything else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.