How routing protocols deal with malicious or faulty routers?

Question

I know very little about Internet Protocol or networking in general but my understanding is that, at a very high level, the routing works by routers telling other routers how "fast" they can reach other destinations. What if there is a malicious (or faulty) router that advertises itself as a fast node but actually slows (or even drops) packets?

Answer 1

The Routing protocol used on the public internet (BGP) does not care about bandwith at all. That information is not exchanged between two routers, because it is unknown: I can connect two BGP speaking routers with 10Gbps ports through a series of switches, one of them having only 100Mbps ports, and the routers would never be able to detect that, they'd think they have 10Gbps capacity, even though there's a 100Mbps bottleneck on the link.

Many networks have tooling which can monitor link availability, latency, bandwidth used, and other aspects of links and their network to determine which routes they prefer. This tooling interacts with routers to change configurations, especially routing preferences. It's not part of the routing protocols used by the routers.

What routers DO exchange, is what IP ranges (prefixes) can be reached via that router, so the receiving router can decide to add routes for the prefixes received via the sending router if it thinks it's the best path available.

A router could of course unintentionally or on purpose advertise prefixes that it shouldn't, and if another router would accept them and install them in their routing table as best route, send traffic for those prefixes there. This is often called a 'BGP Hijack' and can result into:

1. traffic towards the hijacked prefixes from networks accepting the hijacked prefix as best route ends up in some other network. If it's an unintentional hijack, the prefix could be unreachable, if it's with malicious intent, the hijacker could try to impersonate services in the destination network to their benefit (for example for harvesting credentials).

2. traffic towards the hijacked prefix is forwarded to the router doing the hijack, which then forwards traffic to the destination. Everything works as designed as long as the network which hijacks the prefix has sufficient bandwidth to forward all the traffic (which it in most cases doesn't). If such a hijack is intentional, malicious actors may be trying to eavesdrop on traffic towards destinations in the hijacked network.

To prevent that from happening (though it happens a lot, take a look at bgpstream.com for example), a router can do a few things:

1. prefix filtering: the receiving router keeps a list of prefixes it expects to receive. Any prefix received not on the list is ignored. The downside here is that these lists grow very large and need to be updated regularly. If you don't do that, you may miss routes to part of the internet.
2. RPKI: for a (growing) number of prefixes, routers are able to do a lookup to verify if the network originating the prefix is allowed to do so. Wikipedia and this page have some more info on how this works. There are a few downsides to RPKI. It doesn't solve everything (to be specific, it validates only if the destination network and prefix match (so I can't claim that prefixes belonging to for example Google are mine), it does not validate if a routing path ("you can reach Google via my network, I'll forward traffic for you") is valid.

So in practice, networks often implement both of these to handle advertisement of incorrect routes.