BLACKHOLE Community

King, T.; Dietzel, Christoph; Snijders, J.; Doering, G.; Hankins, G.

doi:10.17487/rfc7999

Cited by 18 publications

(11 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The most noticeable among these is MSK IXP, which has locations in 9 Russian cities. The large majority, 47 out of 49, follow the suggestion of RFC 7999 [42] regarding the usage of the BGP blackhole community value 65535:666. In almost all cases they also provide a blackholing IP for IPv4 and IPv6.…”

Section: Blackhole Communities Dictionarymentioning

confidence: 96%

“…Second, we only observe prexes whose blackholing announcements are visible in the public Internet. Note that according to RFC7999 [42] and RFC5635 [45], blackhole announcements must not be propagated outside the local AS and should carry the noexport community. Nonetheless, our ndings suggest that these recommendations are not respected by a number of networks, as we present in Section 9.…”

Section: Limitationsmentioning

confidence: 99%

See 1 more Smart Citation

Inferring BGP blackholing activity in the internet

Giotsas

Smaragdakis

Dietzel³

et al. 2017

Proceedings of the 2017 Internet Measurement Conference

View full text Add to dashboard Cite

The Border Gateway Protocol (BGP) has been used for decades as the de facto protocol to exchange reachability information among networks in the Internet. However, little is known about how this protocol is used to restrict reachability to selected destinations, e.g., that are under attack. While such a feature, BGP blackholing, has been available for some time, we lack a systematic study of its Internet-wide adoption, practices, and network ecacy, as well as the prole of blackholed destinations. In this paper, we develop and evaluate a methodology to automatically detect BGP blackholing activity in the wild. We apply our method to both public and private BGP datasets. We nd that hundreds of networks, including large transit providers, as well as about 50 Internet exchange points (IXPs) oer blackholing service to their customers, peers, and members. Between 2014-2017, the number of blackholed prexes increased by a factor of 6, peaking at 5K concurrently blackholed prexes by up to 400 Autonomous Systems. We assess the eect of blackholing on the data plane using both targeted active measurements as well as passive datasets, nding that blackholing is indeed highly eective in dropping trac before it reaches its destination, though it also discards legitimate trac. We augment our ndings with an analysis of the target IP addresses of blackholing. Our tools and insights are relevant for operators considering oering or using BGP blackholing services as well as for researchers studying DDoS mitigation in the Internet.

show abstract

Section: Blackhole Communities Dictionarymentioning

confidence: 96%

Section: Limitationsmentioning

confidence: 99%

Inferring BGP blackholing activity in the internet

Giotsas

Smaragdakis

Dietzel³

et al. 2017

Proceedings of the 2017 Internet Measurement Conference

View full text Add to dashboard Cite

show abstract

“…BGP communities are optional attributes that can be added to a BGP announcement for controlling the routing policy in upstream ASes. There are a small set of standardized communities defined by RFCs (e.g., RFC 1997, RFC 3765, RFC 7999 [51,61,64]). However, the vast majority of community use is non-standardized and varies from AS to AS.…”

Section: Bgp Communitymentioning

confidence: 99%

“…RFC 7999 [64] standardizes the use of the BLACKHOLE community which triggers blackholing (and can be used to act upon remotely triggered black hole lists [62]) and clearly outlines a secure implementation that avoids potential exploitation (e.g., only accepting the BLACKHOLE community for routes a customer is authorized to announce). Even beyond the general BLACKHOLE community, recent work has proposed a method to communicate port and protocol specific blackholing via BGP communities [52].…”

Section: Symbol Description As Advmentioning

confidence: 99%

“…Giotsas et al examined communities that geographically tag route origins and found that there were no standardized values across providers [57]. In addition, even though RFC 7999 standardizes the black hole community [64], Giotsas et al found that several nonstandard variants still exist and some ASes do not adhere to the proper implementation of the standard (particularly regarding the propagation of blackholed prefixes) [58]. The severe lack of standardization and centralized documentation for BGP communities has caused researchers to resort to applying natural language processing on routing policies as a means of measuring large scale community usage [57,58].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Sico

Birge-Lee

Wang

Rexford

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

The Border Gateway Protocol (BGP) is the primary routing protocol for the Internet backbone, yet it lacks adequate security mechanisms. While simple BGP hijack attacks only involve an adversary hijacking Internet traffic destined to a victim, more complex and challenging interception attacks require that adversary intercept a victim's traffic and forward it on to the victim. If an interception attack is launched incorrectly, the adversary's attack will disrupt its route to the victim making it impossible to forward packets. To overcome these challenges, we introduce SICO attacks (Surgical Interception using COmmunities): a novel method of launching interception attacks that leverages BGP communities to scope an adversary's attack and ensure a route to the victim. We then show how SICO attacks can be targeted to specific source IP addresses for reducing attack costs. Furthermore, we ethically perform SICO attacks on the real Internet backbone to evaluate their feasibility and effectiveness. Results suggest that SICO attacks can achieve interception even when previously proposed attacks would not be feasible and outperforms them by attracting traffic from an additional 16% of Internet hosts (worst case) and 58% of Internet hosts (best case). Finally, we analyze the Internet topology to find that at least 83% of multi-homed ASes are capable of launching these attacks.

show abstract

A Taxonomy of Attacks Using BGP Blackholing

Miller

Pelsser

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

BLACKHOLE Community

Cited by 18 publications

References 5 publications

Inferring BGP blackholing activity in the internet

Inferring BGP blackholing activity in the internet

Sico

A Taxonomy of Attacks Using BGP Blackholing

Contact Info

Product

Resources

About