8

I saw this question:

Suppose a university with address block 12.1.0.0/16 has a link connected to AT&T, where the AT&T router forwards packets destined to 12.1.0.0/16 to the university router. Suppose the university router has three forwarding entries: 12.1.1.0/24 out the link to the math department, 12.1.2.0/24 out the link to the CS department, and a “default route” for 0.0.0.0/0 pointing to the AT&T router. Suppose a host in the rest of the Internet sends a packet destined to 12.1.57.109. What would happen to that packet? What could be done to prevent it?

the answer is :

The packets would loop between the AT&T and university routers, because AT&T would forward the packet to the university (using the route for 12.1.0.0/16) and the university would forward the packet back to AT&T (using the default route 0.0.0.0/0). The university should configure a “null route” to drop all packets matching 12.1.0.0/16 to prevent this. See http://www.nanog.org/mtg-0602/gao.html for details about this issue, and the security vulnerabilities associated with it.

I can't understand what are the security vulnerabilities associated with it

all above taken from http://www.cs.princeton.edu/courses/archive/spring11/cos461/exams.html

migrated from stackoverflow.com Feb 14 '12 at 14:01

This question came from our site for professional and enthusiast programmers.

7

You could start sort of a DoS attack by sending packets to out of range 12.1.0.0/16 addresses that would get stuck in a routing loop. Eventually you could get enough traffic in the loop that things would start to break.

So their inbound filter would look like this

  • 12.1.1.0/24 allow
  • 12.1.2/0/24 allow
  • 12.1.0.0/16 drop
  • 1
    admittedly TTL would help prevent eternal loops, but you could probably build up a fair old DOS :) – Rory Alsop Feb 15 '12 at 9:21
  • 1
    Any reason you wouldn't drop outbound packets on the AT&T interface of the university router destined for 12.1.0.0/16? then you don't need to explicitly allow each route, simplifying administration. – mgjk Feb 15 '12 at 11:12
  • @mgjk That would work too. The reason I used inbound was because I think the most likely source of the DoS would be outside the network. So I was just putting the filter closest to the likely origin of the attack. – Hersha Feb 15 '12 at 14:51
  • @mgjk Putting the filter on the inbound side will reduce the amount of processing that the internal network devices need to do for those packets, which will allow for better performance (albeit perhaps only slightly) during possible attacks. – Iszi Feb 15 '12 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.