Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I saw this question:

Suppose a university with address block has a link connected to AT&T, where the AT&T router forwards packets destined to to the university router. Suppose the university router has three forwarding entries: out the link to the math department, out the link to the CS department, and a “default route” for pointing to the AT&T router. Suppose a host in the rest of the Internet sends a packet destined to What would happen to that packet? What could be done to prevent it?

the answer is :

The packets would loop between the AT&T and university routers, because AT&T would forward the packet to the university (using the route for and the university would forward the packet back to AT&T (using the default route The university should configure a “null route” to drop all packets matching to prevent this. See for details about this issue, and the security vulnerabilities associated with it.

I can't understand what are the security vulnerabilities associated with it

all above taken from

share|improve this question

migrated from Feb 14 '12 at 14:01

This question came from our site for professional and enthusiast programmers.

up vote 7 down vote accepted

You could start sort of a DoS attack by sending packets to out of range addresses that would get stuck in a routing loop. Eventually you could get enough traffic in the loop that things would start to break.

So their inbound filter would look like this

  • allow
  • 12.1.2/0/24 allow
  • drop
share|improve this answer
admittedly TTL would help prevent eternal loops, but you could probably build up a fair old DOS :) – Rory Alsop Feb 15 '12 at 9:21
Any reason you wouldn't drop outbound packets on the AT&T interface of the university router destined for then you don't need to explicitly allow each route, simplifying administration. – mgjk Feb 15 '12 at 11:12
@mgjk That would work too. The reason I used inbound was because I think the most likely source of the DoS would be outside the network. So I was just putting the filter closest to the likely origin of the attack. – Hersha Feb 15 '12 at 14:51
@mgjk Putting the filter on the inbound side will reduce the amount of processing that the internal network devices need to do for those packets, which will allow for better performance (albeit perhaps only slightly) during possible attacks. – Iszi Feb 15 '12 at 16:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.