0

I wonder if we can change the default port TCP port number(179) used during the BGP session. I recently came across a document BGP Vulnerability Testing: Separating Fact from FUD. It suggested considering source port randomization in BGP for security purposes.

2
  • 2
    What kind of security improvement are you aiming for? Or in which scenario?
    – Zac67
    Sep 27, 2023 at 10:39
  • That slide deck is 20 years old. BGP has changed in those two decades. If you implement RPKI, stealing a session still won't get you anywhere. TCP sequence numbers make it very difficult to spoof a connection. (as a man-in-the-middle, it's trivial)
    – Ricky
    Sep 27, 2023 at 23:36

2 Answers 2

1

Asking such a question, you should summarize the essence of the linked paper - few potential responders are likely to click the link and skim the paper.

The paper seems to be about mitigating a brute-force attack on BGP peers, spoofing the source IP address and source port of likely peers and trying to inject malicious information or forcing a TCP connection reset, essentially a DoS attack.

With a fixed source port for a running BGP-over-TCP session, the attacker needs to guess the current sequence number (with a chance of 1:232. Randomizing the source port would increase the difficulty by the port number size (16 bits) to 1:248.

While that seems doable and does seem to solve the problem mathematically, I'd suggest a more practical approach - without any necessity to change a BGP entity, which is often embedded in a border gateway and not easy to change. Also, sequence numbering might not be truly random, so an attacker could start with a much lower complexity, and then adding 16 bits wouldn't really help.

BGP takes place at a public or private IX. If the IX simply filters the peering segment(s) for inbound destination port 179, security improves much more than port randomization does. Also, proper monitoring a BGP entity is pretty much mandatory, and a brute-force, high-rate attack shouldn't go unnoticed for an extended time anyway.

1

'We' can only change the default port number for any given service if the organization who makes the service software allows a configuration to do so. So if your router has the option to configure the BGP service to listen on a different port and use a different source port, then you can do so.

If you can, it would not accomplish much. Anyone who wanted to find a BGP service to abuse could just do a port scan until they find it. If you want to actually secure your BGP service, use an access list to limit source IP addresses that can connect using the standard BGP port and authentication for the peer relationship.

2
  • The OP is asking about source-port randomization, not about changing the destination port.
    – Zac67
    Sep 27, 2023 at 14:56
  • Yes that is what I assumed but BGP (at least in every implementation I have seen) uses the configured listening port as source port when acting as 'server' to reply to a session request. So I would assume any system that allows you to change the BGP service port configuration would change both the listening port and the source port at the same time. BPG already uses a random source port when starting a request for a peer session from what I remember. Sep 27, 2023 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.