Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I saw this question:

Suppose a university with address block 12.1.0.0/16 has a link connected to AT&T, where the AT&T router forwards packets destined to 12.1.0.0/16 to the university router. Suppose the university router has three forwarding entries: 12.1.1.0/24 out the link to the math department, 12.1.2.0/24 out the link to the CS department, and a “default route” for 0.0.0.0/0 pointing to the AT&T router. Suppose a host in the rest of the Internet sends a packet destined to 12.1.57.109. What would happen to that packet? What could be done to prevent it?

the answer is :

The packets would loop between the AT&T and university routers, because AT&T would forward the packet to the university (using the route for 12.1.0.0/16) and the university would forward the packet back to AT&T (using the default route 0.0.0.0/0). The university should configure a “null route” to drop all packets matching 12.1.0.0/16 to prevent this. See http://www.nanog.org/mtg-0602/gao.html for details about this issue, and the security vulnerabilities associated with it.

I can't understand what are the security vulnerabilities associated with it

all above taken from http://www.cs.princeton.edu/courses/archive/spring11/cos461/exams.html

share|improve this question

migrated from stackoverflow.com Feb 14 '12 at 14:01

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 7 down vote accepted

You could start sort of a DoS attack by sending packets to out of range 12.1.0.0/16 addresses that would get stuck in a routing loop. Eventually you could get enough traffic in the loop that things would start to break.

So their inbound filter would look like this

  • 12.1.1.0/24 allow
  • 12.1.2/0/24 allow
  • 12.1.0.0/16 drop
share|improve this answer
1  
admittedly TTL would help prevent eternal loops, but you could probably build up a fair old DOS :) –  Rory Alsop Feb 15 '12 at 9:21
1  
Any reason you wouldn't drop outbound packets on the AT&T interface of the university router destined for 12.1.0.0/16? then you don't need to explicitly allow each route, simplifying administration. –  mgjk Feb 15 '12 at 11:12
    
@mgjk That would work too. The reason I used inbound was because I think the most likely source of the DoS would be outside the network. So I was just putting the filter closest to the likely origin of the attack. –  Hersha Feb 15 '12 at 14:51
    
@mgjk Putting the filter on the inbound side will reduce the amount of processing that the internal network devices need to do for those packets, which will allow for better performance (albeit perhaps only slightly) during possible attacks. –  Iszi Feb 15 '12 at 16:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.