8

I saw this question:

Suppose a university with address block 12.1.0.0/16 has a link connected to AT&T, where the AT&T router forwards packets destined to 12.1.0.0/16 to the university router. Suppose the university router has three forwarding entries: 12.1.1.0/24 out the link to the math department, 12.1.2.0/24 out the link to the CS department, and a “default route” for 0.0.0.0/0 pointing to the AT&T router. Suppose a host in the rest of the Internet sends a packet destined to 12.1.57.109. What would happen to that packet? What could be done to prevent it?

the answer is :

The packets would loop between the AT&T and university routers, because AT&T would forward the packet to the university (using the route for 12.1.0.0/16) and the university would forward the packet back to AT&T (using the default route 0.0.0.0/0). The university should configure a “null route” to drop all packets matching 12.1.0.0/16 to prevent this. See http://www.nanog.org/mtg-0602/gao.html for details about this issue, and the security vulnerabilities associated with it.

I can't understand what are the security vulnerabilities associated with it

all above taken from http://www.cs.princeton.edu/courses/archive/spring11/cos461/exams.html

Improve this question

1 Answer 1

Reset to default
7

You could start sort of a DoS attack by sending packets to out of range 12.1.0.0/16 addresses that would get stuck in a routing loop. Eventually you could get enough traffic in the loop that things would start to break.

So their inbound filter would look like this

  • 12.1.1.0/24 allow
  • 12.1.2/0/24 allow
  • 12.1.0.0/16 drop
Improve this answer
4
  • 1
    admittedly TTL would help prevent eternal loops, but you could probably build up a fair old DOS :)
    – Rory Alsop ♦
    Feb 15, 2012 at 9:21
  • 1
    Any reason you wouldn't drop outbound packets on the AT&T interface of the university router destined for 12.1.0.0/16? then you don't need to explicitly allow each route, simplifying administration.
    – mgjk
    Feb 15, 2012 at 11:12
  • @mgjk That would work too. The reason I used inbound was because I think the most likely source of the DoS would be outside the network. So I was just putting the filter closest to the likely origin of the attack.
    – Hersha
    Feb 15, 2012 at 14:51
  • @mgjk Putting the filter on the inbound side will reduce the amount of processing that the internal network devices need to do for those packets, which will allow for better performance (albeit perhaps only slightly) during possible attacks.
    – Iszi
    Feb 15, 2012 at 16:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .