Lesson 57 · Network security: attacks and defences

Attack and defence: BGP hijacking and RPKI

BGP believes what networks announce. Watch a network called H claim half of someone else's address block, 203.0.113.0/25, and pull traffic towards itself, because routers always use the most specific route. Then see the defence: the real owner signs a Route Origin Authorization in the RPKI, your ISP checks it, and Route Origin Validation marks the hijack Invalid and drops it.

12 min12 steps5 questionsBeginner

Fig 57 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01D has two routes: 203.0.113.0/24 via B and 203.0.113.0/25 via H. Where do packets for 203.0.113.10 go?

Routers forward on the longest matching prefix. 203.0.113.10 is inside both blocks, and the /25 is more specific, so it wins before local preference or path length are ever looked at.

02Why could D not tell that H's announcement was false, before RPKI?

A BGP UPDATE says which prefix and which AS_PATH, but nothing in it proves the right to use those addresses. Networks simply believe their neighbours unless they add their own checks.

03A's ROA says: AS64496 may originate 203.0.113.0/24, maxLength /24. H (AS64510) announces 203.0.113.0/25. What is the ROV state?

A ROA covers the /25, but the origin AS is wrong and /25 is longer than the maxLength. Either reason alone makes the route Invalid (RFC 6811).

04Who signs a ROA?

The registry certifies which addresses a network holds. The holder then signs ROAs with that certificate, so a validator can check them back to the registry, the trust anchor.

05An attacker announces 203.0.113.0/24 with the AS_PATH 64510 64496, putting A's number last. What does ROV say?

ROV looks only at the origin AS and the prefix length. A forged path that ends in the real origin passes it. Checking the whole path is the job of newer work such as BGPsec and ASPA.

Key terms

Glossary

BGP hijack: Announcing addresses you do not hold, by mistake or on purpose, so that other networks send that traffic to you.
More specific prefix: A smaller block inside a bigger one, with a longer length: 203.0.113.0/25 is more specific than 203.0.113.0/24.
Longest-prefix match: The rule every router uses: of all routes that contain the destination, use the one with the longest prefix.
Origin AS: The AS where a route starts: the last (rightmost) number in its AS_PATH.
RPKI: Resource Public Key Infrastructure: certificates from the regional internet registries that prove who holds which addresses.
ROA: Route Origin Authorization: a signed statement that one AS may originate a prefix, up to a maximum length.
Route Origin Validation (ROV): Checking each BGP route against validated ROAs and labelling it Valid, Invalid or NotFound.
Validator: Software (a relying party) that downloads ROAs, checks their signatures and gives routers the list of what is allowed.

Fine print

Notes and sources

AS numbers 64496-64511 (RFC 5398) and the prefixes 198.51.100.0/24 and 203.0.113.0/24 (RFC 5737) are reserved for documentation.
YouTube, February 2008: Pakistan Telecom (AS17557) announced 208.65.153.0/24 inside YouTube's 208.65.152.0/22; its provider PCCW (AS3491) passed it on (RIPE NCC RIS case study).
ROV only labels routes. Dropping Invalid routes is each network's own policy (RFC 8481); a hijack is stopped only where networks do it.
RFC 9319 advises setting maxLength equal to the prefix length, so nobody can announce an unused more specific part with your AS number.
ROV checks the origin AS only. An attacker who puts the real origin at the end of a forged AS_PATH passes it; BGPsec (RFC 8205) and ASPA aim to check the path.

Quiz Unlocks after the last step.