What attack vectors does the BGP TTL security knob protect against?
3
-
2Why ask a question and then immediately answer it?– smithianMay 8, 2013 at 8:18
-
3I thought it was weird, saw that happening on some other questions. Looked it up and apparently it's generally accepted. At least if someone else has a better answer, it can be upvoted higher. SE Blog Post about answering own questions– Mat WoodMay 8, 2013 at 14:31
-
2We can take this to meta (and maybe we should), but generally speaking you can (and should!) do it if 1) you yourself experienced something that you think others could learn from (Q and A) and 2) It's vitally important to 'prime' beta sites with good questions and answers in advance so that they will attract good questions and answers in the future.. more follow-ups on meta.NE, please...– AaronMay 8, 2013 at 15:51
Add a comment
|
2 Answers
BGP TTL security makes your router only accept packets that have a very high TTL number, typically 254. Since TTL is decremented every time a packet is routed, configuring this feature on both neighbors ensures that only a directly connected neighbor router could have sent you this packet.
-
I'll add this as a comment: packetlife.net/blog/2009/nov/23/understanding-bgp-ttl-security as it also explans it with some pretty pictures.– nosMay 10, 2013 at 15:33
When you configure for example a value of 5 in the tt-security feature, the router deduct 5 from 255, so it accepts only an IP TTL greater than or equal to 255 minus the value configured.
So, it doesn't really means it only accept a router directly connected. It avoids attacks from host manipulating the TTL in the TCP session.
-
5This seems like a reply to Aaron's answer. An answer should stand alone (this is not a forum).– rtfMay 8, 2013 at 14:41