I want to know more about the fight-back security mechanism in OSPF routing protocol.
When is the mechanism activated and how does it work?
I found the source description of OSPF fight-back, but the description is vague.
|
I want to know more about the fight-back security mechanism in OSPF routing protocol. When is the mechanism activated and how does it work? I found the source description of OSPF fight-back, but the description is vague. |
||||
|
|
|
OSPF is a routing protocol in which the various routers involved in the process periodically shout: they broadcast "Link State Advertisements" which tell the other routers how things look like in their own vicinity. The fight-back mechanism is the following: when a router observes a LSA which states falsehoods about itself, the router is allowed (and actually encouraged) to immediately send another LSA which sets the record right. It is a metaphor of the antique Agora: to counter liars, just stand in the Agora yourself and whenever you hear a lie about yourself, shout "this is not true". This is not a very effective security mechanism. It is not officially a security mechanism either; the behemoth OSPFv2 specification does not contain the word "fight". Actually the specification deals very little with security (the "Security Considerations" section is only half a page, for a 244-page specification). This draft is a more thorough security analysis of OSPF; see in particular sections 4.1.3 and 4.1.4 which explain how to circumvent the fight-back mechanism or even turn it into a tool for disruption (in the Agora metaphor, you may use the fight-back to create an ear-shattering shout contest which drowns normal conversation). |
|||
|
|