14

What attack vectors does the BGP TTL security knob protect against?

3
  • 2
    Why ask a question and then immediately answer it?
    – smithian
    May 8, 2013 at 8:18
  • 3
    I thought it was weird, saw that happening on some other questions. Looked it up and apparently it's generally accepted. At least if someone else has a better answer, it can be upvoted higher. SE Blog Post about answering own questions
    – Mat Wood
    May 8, 2013 at 14:31
  • 2
    We can take this to meta (and maybe we should), but generally speaking you can (and should!) do it if 1) you yourself experienced something that you think others could learn from (Q and A) and 2) It's vitally important to 'prime' beta sites with good questions and answers in advance so that they will attract good questions and answers in the future.. more follow-ups on meta.NE, please...
    – Aaron
    May 8, 2013 at 15:51

2 Answers 2

13

BGP TTL security makes your router only accept packets that have a very high TTL number, typically 254. Since TTL is decremented every time a packet is routed, configuring this feature on both neighbors ensures that only a directly connected neighbor router could have sent you this packet.

1
3

When you configure for example a value of 5 in the tt-security feature, the router deduct 5 from 255, so it accepts only an IP TTL greater than or equal to 255 minus the value configured.

So, it doesn't really means it only accept a router directly connected. It avoids attacks from host manipulating the TTL in the TCP session.

1
  • 5
    This seems like a reply to Aaron's answer. An answer should stand alone (this is not a forum).
    – rtf
    May 8, 2013 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.