0

I know very little about Internet Protocol or networking in general but my understanding is that, at a very high level, the routing works by routers telling other routers how "fast" they can reach other destinations. What if there is a malicious (or faulty) router that advertises itself as a fast node but actually slows (or even drops) packets?

4
  • Routers don't "advertise" themselves. BGP is used to exchange routing information. The very simple version is: If your router is faulty, others will eventually realize and not send to you anymore.
    – user163495
    Commented Mar 17, 2022 at 11:55
  • @MechMK1 what about en.wikipedia.org/wiki/BGP_hijacking
    – schroeder
    Commented Mar 17, 2022 at 12:25
  • @schroeder thank you. That link has plenty of helpful information.
    – user275766
    Commented Mar 17, 2022 at 13:00
  • @schroeder BGP hijacking involves a malicious router and is a serious issue because of the complete lack of security in the protocol. A router that is merely faulty will be quickly ignored by the rest.
    – forest
    Commented Mar 18, 2022 at 21:12

1 Answer 1

0

The Routing protocol used on the public internet (BGP) does not care about bandwith at all. That information is not exchanged between two routers, because it is unknown: I can connect two BGP speaking routers with 10Gbps ports through a series of switches, one of them having only 100Mbps ports, and the routers would never be able to detect that, they'd think they have 10Gbps capacity, even though there's a 100Mbps bottleneck on the link.

Many networks have tooling which can monitor link availability, latency, bandwidth used, and other aspects of links and their network to determine which routes they prefer. This tooling interacts with routers to change configurations, especially routing preferences. It's not part of the routing protocols used by the routers.

What routers DO exchange, is what IP ranges (prefixes) can be reached via that router, so the receiving router can decide to add routes for the prefixes received via the sending router if it thinks it's the best path available.

A router could of course unintentionally or on purpose advertise prefixes that it shouldn't, and if another router would accept them and install them in their routing table as best route, send traffic for those prefixes there. This is often called a 'BGP Hijack' and can result into:

  1. traffic towards the hijacked prefixes from networks accepting the hijacked prefix as best route ends up in some other network. If it's an unintentional hijack, the prefix could be unreachable, if it's with malicious intent, the hijacker could try to impersonate services in the destination network to their benefit (for example for harvesting credentials).

  2. traffic towards the hijacked prefix is forwarded to the router doing the hijack, which then forwards traffic to the destination. Everything works as designed as long as the network which hijacks the prefix has sufficient bandwidth to forward all the traffic (which it in most cases doesn't). If such a hijack is intentional, malicious actors may be trying to eavesdrop on traffic towards destinations in the hijacked network.

To prevent that from happening (though it happens a lot, take a look at bgpstream.com for example), a router can do a few things:

  1. prefix filtering: the receiving router keeps a list of prefixes it expects to receive. Any prefix received not on the list is ignored. The downside here is that these lists grow very large and need to be updated regularly. If you don't do that, you may miss routes to part of the internet.
  2. RPKI: for a (growing) number of prefixes, routers are able to do a lookup to verify if the network originating the prefix is allowed to do so. Wikipedia and this page have some more info on how this works. There are a few downsides to RPKI. It doesn't solve everything (to be specific, it validates only if the destination network and prefix match (so I can't claim that prefixes belonging to for example Google are mine), it does not validate if a routing path ("you can reach Google via my network, I'll forward traffic for you") is valid.

So in practice, networks often implement both of these to handle advertisement of incorrect routes.

You must log in to answer this question.