RR = simpler, more common | Confederation = more complex, better for very large AS
BGP Security
Threat
Description
Defense
Route Hijacking
Advertise someone else’s prefix → traffic goes to attacker
RPKI (ROA), prefix filtering, IRR
Route Leak
Re-advertise routes to wrong peers → traffic misdirected
AS-Path filtering, community-based policies, ASPA
Session Hijacking
Inject TCP RST or fake BGP messages into session
MD5/TCP-AO authentication, GTSM (TTL security)
Prefix De-aggregation
Advertise more-specific prefix → longest match wins → steal traffic
ROV (Route Origin Validation), max-prefix limits
RPKI
Resource Public Key Infrastructure: cryptographic proof of prefix ownership
ROA (Route Origin Authorization) + ROV on routers
BGPsec
Sign each AS hop in AS-Path → verify entire path (not just origin)
Future: full path validation (not widely deployed yet)
ทิ้งท้าย: BGP = The Protocol That Runs the Internet
BGP Deep Dive eBGP: between AS (AD 20, TTL 1, changes next-hop) | iBGP: within AS (AD 200, full mesh required) Path Selection: weight → local pref → AS-path length → origin → MED → eBGP > iBGP → IGP metric → oldest → router ID Attributes: AS-Path (loop prevention), Next-Hop (reachability), Local Pref (outbound), MED (inbound), Community (policy) Route Reflector: eliminate iBGP full mesh → RR reflects to clients → most common scalability solution Confederation: split AS into sub-AS → eBGP between sub-AS → alternative to RR for very large AS Security: RPKI/ROA (origin validation), prefix filtering, MD5/TCP-AO auth, GTSM → BGPsec (future path validation) Key: BGP misconfiguration = internet outage — understand path selection, implement security (RPKI), monitor routes
