Subject: RE: PI/metro/geo [Re: The state of IPv6 multihoming development]

From: "Michel Py" <[email-masked]>
Date: Tue, 5 Nov 2002 11:10:42 -0800

Ran,

> RJ Atkinson wrote
> I've seen it happen -- in fact I was one of the
> early victims, which later caused various vendors
> to implement BGP MD5 in routers.

Are we talking about someone hijacking the BGP TCP connection between
you and your peer and actually injecting you forged routes, or a denial
of service by other means?

In other words, did the session with the peer appeared to be up but
contained a bunch of junk or was it down?

Michel.

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 5 Nov 2002 15:14:14 -0500

> of service by other means?

I've seen forged RSTs to take out the BGP session also, but the 
earliest attack
I saw involved somone stealing a BGP TCP session and then injecting 
false routing
information.  Operators who don't have BGP TCP MD5 deployed are at 
serious
operational risk these days.

Ran

---

From: Pekka Savola <[email-masked]>
Date: Tue, 5 Nov 2002 22:51:01 +0200 (EET)

On Tue, 5 Nov 2002, RJ Atkinson wrote:
> I've seen forged RSTs to take out the BGP session also, but the earliest
> attack I saw involved somone stealing a BGP TCP session and then
> injecting false routing information.  Operators who don't have BGP TCP
> MD5 deployed are at serious operational risk these days.

This only applies to eBGP sessions (if the neighbor does not do ingress
filtering) and operators which do not use proper source address ingress
filtering at their borders.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Peter Tattam <[email-masked]>
Date: Wed, 6 Nov 2002 07:53:12 +1100 (EST)

> operational risk these days.

I thought this was a man-on-the-side attack, not man-in-the-middle

> Ran

Peter

--
Peter R. Tattam                            [email-masked]
Managing Director,    Trumpet Software International Pty Ltd
Hobart, Australia,  Ph. +61-3-6245-0220,  Fax +61-3-62450210