Game of BGP
0 likes532 views
仂从仄亠仆 仂弍亢亟舒亠 BGP (仗仂仂从仂仍 仗舒于仍亠仆亳 仄舒亳亰舒亳亠亶), 亠亞仂 磶于亳仄仂亳 亳 仗仂仍亠亟于亳 亟仍 亠亠亶, 于从仍ﾑ舒 亳仍亠仆亳亠 DDoS-舒舒从 亳 于仍亳礌亳亠 仆舒 仄舒亳亰舒亳. 亳于仂亟 仗亳仄亠 舒于仂仆仂仄仆 亳亠仄, 亳仗 BGP, 仗仂弍仍亠仄 仄舒舒仄亳 亳 于仂亰仄仂亢仆仂亳 亳 舒仆亠仆亳. 丐舒从亢亠 舒仄舒亳于舒ﾑ 亠亠于亠 舒仆仂仄舒仍亳亳 亳 仆亠仂弍仂亟亳仄仂 从仂仆仂仍 从仂仆亳亞舒亳亳 亠亠于 仂亶于 亟仍 仂弍亠仗亠亠仆亳 弍亠亰仂仗舒仆仂亳.
Game of BGP
- 1. Game of BGP 仍亠从舒仆亟 亰亳仄仂于, <aa@highloadlab.com> 1/x
- 2. 亊 仗仂亞舒仄仄亳, 仄仆亠 仄舒亠仄舒亳从舒 仆亠 仆亢仆舒 2
- 3. 亊 php 仗仂亞舒仄仄亳 亳 束.損 3
- 4. 亊 仗亠亳舒仍亳 , 舒 亠 仂 舒亟仄亳仆 4
- 7. 亠从仂仂亶 弍仂仍仂亶 仆舒亳仂仆舒仍仆亶 仗仂于舒亶亟亠 舒弍亳于舒仆亳亠 于仆亠仆仆亠亞仂 从舒仆舒仍舒 7
- 8. 亠从仂仂亶 弍仂仍仂亶 仆舒亳仂仆舒仍仆亶 仗仂于舒亶亟亠 舒弍亳于舒仆亳亠 于仆亠仆仆亠亞仂 从舒仆舒仍舒 8
- 9. 亞仂亰仂 亳亠 9
- 10. 于仂仆仂仄仆舒 亳亠仄舒 弌亳亠仄舒 IP-亠亠亶 亳 仄舒亳亰舒仂仂于, 仗舒于仍磳仄 仂亟仆亳仄 亳仍亳 仆亠从仂仍从亳仄亳 仂仗亠舒仂舒仄亳, 亳仄亠ﾑ亳仄亳 亠亟亳仆 仗仂仍亳亳从 仄舒亳亰舒亳亳 仆亠仆亠仂仄. 10
- 11. 丐亳仗 弌 AS2 仆仂亞仂亳仆亠亠亶仆亠 AS1 AS3 AS2 丐舒仆亰亳仆亠 AS1 AS3 AS2 亞舒仆亳亠仆仆亠 AS1 11
- 12. BGP 亳舒仆亳仂仆仆仂 于亠从仂仆亶 仗仂仂从仂仍; 仗亳仄亠: AS1 AS2 AS2 AS3 AS4 仂仍亳亳从亳 仄舒亳亰舒亳亳: 仂舒亢舒ﾑ 从仂仆仂仄亳亠从亳亠 仂仆仂亠仆亳 仄亠亢亟 弌; BGP 束仆仂仆亳亠損 亠. 12
- 13. 亳仄亠 弌 A AS222 2.2.2.0/24 A 13
- 14. 亳仄亠 弌 A AS222 2.2.2.0/24 A 亠 亠亳 仆亠仆亠舒 14
- 15. 亳仄亠 弌 A AS222 2.2.2.0/24 Default route A 亠 亠亳 仆亠仆亠舒 15
- 16. 舒亞亳 仗舒于仍亠仆亳 BGP 1. 弍磦仍亠仆亳亠 仄舒舒 2. 丕亟舒仍亠仆亳亠 仄舒舒 3. Prepend Policy 4. Local Pref policy 16
- 17. 弌亠亠于亠 舒仆仂仄舒仍亳亳 1. 亳弍从亳 于 仆舒仂亶从亠 仄舒亳亰舒仂仂于; 2. 丶亳从仍 仄舒亳亰舒亳亳 BGP; 3. 仂弍仍亠仄 仆舒 仂于仆亠 弌. 17
- 18. Default route Default Route Incomplete route Route loop at last table upstream No prefix at loopback interface 18
- 19. Default route 12514 磶于亳仄 仗亠亳从仂于; 仂亢亠 弍 亳仗仂仍亰仂于舒仆仂 亟仍 于亠仍亳亠仆亳 仗仍亠舒 DoS 舒舒从亳 (* TTL) 舒从舒 仆舒 亳亠仗舒仆亳亠 从舒仆舒仍舒; 亰舒 舒亳从 亠亠 亳 仗仍舒亳 ;) 19
- 20. 丕亳仍亳亠仍亳 DDoS 舒舒从 688 磶于亳仄 仗亠亳从仂于; 弌 仄仂亢亠 弍 亳仗仂仍亰仂于舒仆舒 于 从舒亠于亠 亳仍亳亠仍 DoS 舒舒从亳 舒从舒 仆亠从仂仍从亳 弌 仂亟仆仂于亠仄亠仆仆仂; 20
- 21. 丶亳从仍 仄舒亳亰舒亳亳 BGP 仂亠仆仆舒 亰舒亳舒 仂 舒亳亠从亳 亳从仍仂于 亳仆舒仄亳亠从亳亠 亳从仍! 21
- 22. 丕亟舒仍亠仆亳亠 仄舒舒 AS2 AS3 default AS-X route 200 AS1 AS4 100 AS1 AS2 AS3 AS-X AS2 AS3 AS-X AS3 AS-X AS4 AS-X 22
- 23. 丕亟舒仍亠仆亳亠 仄舒舒 AS2 AS3 W default AS-X route 200 AS1 AS4 100 AS1 AS2 AS3 AS-X AS2 AS3 AS-X Loop AS2 AS3 AS3 -- Packet loss AS1, AS2,AS3 AS4 AS-X 23
- 24. 丕亟舒仍亠仆亳亠 仄舒舒 W AS2 AS3 default AS-X route 200 AS1 AS4 100 AS1 AS2 AS3 AS-X AS2 -- Loop AS2 AS3 AS3 -- Packet loss AS1, AS2,AS3 AS4 AS-X 24
- 25. 丕亟舒仍亠仆亳亠 仄舒舒 AS2 AS3 AS-X W A default route 200 AS1 AS4 100 AS1 AS2 AS3 AS-X AS2 AS1 AS4 AS-X 1 minute problem! AS3 -- ~ 2 30 AS4 AS-X 25
- 26. Prepend Policy AS1 200 AS4 AS2 AS-X AS3 AS1 AS-X AS2 AS3 AS-X AS3 AS-X AS4 AS1 AS-X 26
- 27. Prepend Policy AS1 200 A AS4 AS2 AS-X A AS3 AS1 AS2 AS3 AS-X AS2 AS3 AS-X as-path prepend 5 AS3 AS4 AS1 AS-X Loop AS1-AS2-AS3-AS4 AS4 AS1 AS-X 27
- 28. Prepend Policy AS1 A 200 AS4 AS2 AS-X W A AS3 AS1 AS2 AS3 AS-X AS2 AS3 AS4 AS1 AS-X Loop AS1-AS2-AS3-AS4 AS3 AS4 AS1 AS-X AS4 AS1 AS2 AS3 AS-X 28
- 29. Prepend Policy AS1 200 A AS4 AS2 AS-X A AS3 AS1 AS-X(5) AS2 AS3 AS4 AS1 AS-X More then 1 minute problem AS3 AS-X(5) AS4 AS1 AS2 AS3 AS-X 29
- 30. 丶亳从仍 仗亳仂亳亠仂于 200 AS2 AS3 A 200 AS-X 200 AS1 AS4 A 200 AS1 -- AS2 -- AS3 AS-X AS4 AS-X 30
- 31. 丶亳从仍 仗亳仂亳亠仂于 200 AS2 A AS3 200 AS-X A 200 AS1 AS4 200 AS1 -- AS2 AS3 AS-X AS3 AS4 AS-X AS4 AS-X 31
- 32. 丶亳从仍 仗亳仂亳亠仂于 200 AS2 A AS3 200 AS-X A 200 AS1 AS4 200 AS1 AS2 AS3 AS5 AS-X AS2 AS3 AS4 AS5 AS-X AS3 AS4 AS5 AS-X AS4 AS5 AS-X 32
- 33. 丶亳从仍 仗亳仂亳亠仂于 200 AS2 AS3 200 AS-X A 200 AS1 A AS4 200 AS1 AS2 AS3 AS4 AS5 AS-X AS2 AS3 AS4 AS5 AS-X Loop AS1-AS2-AS3-AS4 AS3 AS4 AS5 AS-X AS4 AS1 AS2 AS3 AS5 AS-X 33
- 34. 丶亳从仍 仗亳仂亳亠仂于 200 AS2 AS3 200 AS-X A 200 AS1 A AS4 200 AS1 AS2 AS3 AS4 AS5 AS-X AS2 AS3 AS4 AS5 AS-X AS3 AS5 AS-X Again! AS4 AS5 AS-X 34
- 35. 仂仆仂仍仆舒 舒弍仂舒 仍亳礌亳亠 亳从仍仂于? 仍仂从舒仍仆仂亠/亞仍仂弍舒仍仆仂亠 亳亟亳仄仂 仂 亳仂仆亳从舒 仄舒舒? 亟舒/仆亠 仂 亳 仂亰亟舒亠? 亳仂仆亳从/亟亞亳亠 弌 仂亢仆仂 于亶亳 亳亰 亳从仍舒 亟舒/仆亠 35
- 36. 于亠 仍亳礌亳亠 亳从仍仂于? 仍仂从舒仍仆仂亠/亞仍仂弍舒仍仆仂亠 亳亟亳仄仂 仂 亳仂仆亳从舒 仄舒舒? 亟舒/仆亠 仂 亳 仂亰亟舒亠? 亳仂仆亳从/亟亞亳亠 弌 仂亢仆仂 于亶亳 亳亰 亳从仍舒? 亟舒/仆亠 36
- 37. BGP 丶亳从仍 2346 磶于亳仄 仗亠亳从仂于; 亠亰仍舒: 丼舒亳仆舒/仗仂仍仆舒 仆亠亟仂仗仆仂 亠仍亠于仂亶 亠亳; 丿仄 仂仂弍亠仆亳亶 BGP 37
- 38. 丕 仆亳 仗仂弍仍亠仄 AS174 AS3356 AS7018 AS6939 AS701 AS3549 AS209 AS4323 AS1239 AS12389 AS2848 AS3257 AS6461 AS2914 AS8468 AS23148 AS8447 AS20485 AS6830 AS8220 AS8928 AS3303 AS4589 AS42708 AS6453 AS6730 AS31130 AS3491 AS3320 AS8218 AS286 AS702 AS3561 AS20764 AS31323 AS20632 AS4766 AS680 AS29686 AS5089 AS10026 AS12350 AS2516 AS3786 AS12741 AS7575 AS1916 AS2273 AS9498 AS1785 弍仂仍亠亠 亠仄 4从 亟亞亳 弌! 38
- 39. 亳仄亠 弌174 丕于亠仍亳亠仆亳亠 仗仍亠舒 DDoS 于 17 舒亰 Default route: 25 磶于亳仄 仗亠亳从仂于 弌3356-弌3549 丕于亠仍亳亠仆亳亠 仗仍亠舒 DDoS 于 8 舒亰 BGP 亳从仍: 12 prefixes affected Default route: 86 磶于亳仄 仗亠亳从仂于 39
- 40. 仂亳 Default route 1381 BGP 亳从仍 31 丕亳仍亳亠仍亳 DDoS 舒舒从 21 仄舒从亳仄舒仍仆仂 于 11 舒亰 40
- 41. 仂亟仂仍亢亳亠仍仆仂 45,00% 40,00% 35,00% 30,00% 25,00% BGP 亳从仍 20,00% Default Routes 15,00% 丕亳仍亳亠仍亳 DDoS 10,00% 5,00% 0,00% <1h <2h <4h <8h 41
- 42. 丐亠仆亟 16000 14000 12000 10000 8000 6000 弍仆舒亢亠仆仂 4000 仗舒于仍亠仆仂 2000 0 42
- 43. 仂弍亳仆 亟 Hello. During our research project we have detected IP address *.*.*.*" in AS***, which multiplies ICMP packets. 11 times is a mean value. It is dangerous vulnerability because this IP could be used by attackers to N-times increase DoS attack. This could be harmful for your own network infrastructure and also break down attacked network. Could you tell me for what purpose your router was configured by such way? Hello This is assigned to one of our customers. We cannot see how there equipment is configured. If you believe this is in violation of our Acceptable use policy you can email abuse@***.com to report that. 43
- 44. 舒从舒 仆舒 亠亠于仂仄 仂于仆亠 44
- 45. 舒从舒 仆舒 亠亠于仂仄 仂于仆亠 45
- 46. 束亠亟亠損 仆亠仆亠舒 BGP 2.2.2.0/24 4 亠从仆亟 = DDoS*4 ASX2 Default ASX1 route 46
- 47. 束亠亟亠損 仆亠仆亠舒 仍亳亠仆从亳亠 弌 BGP 2.2.2.0/24 Max = 350*DDoS > 50 amplifiers 4 亠从仆亟 Mean = 10*DDoS = DDoS*4 ASX2 Default ASX1 route 47
- 48. 束亠亟亠損 仆亠仆亠舒 仍亳亠仆从亳亠 弌 BGP 2.2.2.0/24 Max = 350*DDoS > 50 amplifiers 4 亠从仆亟 Mean = 10*DDoS = DDoS*4 ASX2 Default ASX1 route dst: aplifiers src: 2.2.2.1 48
- 49. 束亠亟亠損 仆亠仆亠舒 仍亳亠仆从亳亠 弌 BGP 2.2.2.0/24 Max = 350*DDoS > 50 amplifiers 4 亠从仆亟 Mean = 10*DDoS = DDoS*4 ASX2 Default ASX1 route dst: aplifiers src: 2.2.2.1 仂亞仂 = 40*DDoS 49
- 50. 亠亰仍舒 仂弍仍亠仄 亠亳 仗仂舒于亳从舒 仂 仂亢亠 于舒亳 仗仂弍仍亠仄; 仂弍仍亠仄 从仍亳亠仆从仂亶 亠亳 仂 于舒亳 仗仂弍仍亠仄; 亠舒弍亳仍仆仂 亠亳 仄仂亢亠 弍 仆亠于亳亟亳仄舒 仂 仂仂仆 弌-亳仂仆亳从舒. 50
- 51. 仂于亠磺亠 于仂 亠. 于舒亢亟 51