Inferring BGP blackholing activity in the internet

Abstract

The Border Gateway Protocol (BGP) has been used for decades as the de facto protocol to exchange reachability information among networks in the Internet. However, little is known about how this protocol is used to restrict reachability to selected destinations, e.g., that are under attack. While such a feature, BGP blackholing, has been available for some time, we lack a systematic study of its Internet-wide adoption, practices, and network ecacy, as well as the prole of blackholed destinations. In this paper, we develop and evaluate a methodology to automatically detect BGP blackholing activity in the wild. We apply our method to both public and private BGP datasets. We nd that hundreds of networks, including large transit providers, as well as about 50 Internet exchange points (IXPs) oer blackholing service to their customers, peers, and members. Between 2014-2017, the number of blackholed prexes increased by a factor of 6, peaking at 5K concurrently blackholed prexes by up to 400 Autonomous Systems. We assess the eect of blackholing on the data plane using both targeted active measurements as well as passive datasets, nding that blackholing is indeed highly eective in dropping trac before it reaches its destination, though it also discards legitimate trac. We augment our ndings with an analysis of the target IP addresses of blackholing. Our tools and insights are relevant for operators considering oering or using BGP blackholing services as well as for researchers studying DDoS mitigation in the Internet.

A First Joint Look at DoS Attacks and BGP Blackholing in the Wild

“…We obtain a data set of inferred blackholing events from publicly available BGP routing data, using a measurement system that we implemented on the basis of the methodology described by Giotsas et al [11].…”

“…3 Blackholing Communities -Within the BGP data, we look for BGP announcements tagged with a community that is likely to signal a blackholing request. Giotsas et al [11] created a dictionary of such communities by applying natural language processing to resources where blackholing communities are likely to be documented (e.g., in Internet Routing Registry (IRR) records). We use a copy of this dictionary, which provides us with 288 asn:value community tags, for 251 blackholing providers, using 74 distinct values (e.g., 666).…”

“…Although empirical evidence of blackholing activities is documented in literature [11], a clear understanding about how BGP blackholing is used in practice when attacks occur is still missing. The goal of this paper is to provide a first joint look at DoS attacks and BGP blackholing in the wild.…”

Sico

“…Giotsas et al examined communities that geographically tag route origins and found that there were no standardized values across providers [57]. In addition, even though RFC 7999 standardizes the black hole community [64], Giotsas et al found that several nonstandard variants still exist and some ASes do not adhere to the proper implementation of the standard (particularly regarding the propagation of blackholed prefixes) [58]. The severe lack of standardization and centralized documentation for BGP communities has caused researchers to resort to applying natural language processing on routing policies as a means of measuring large scale community usage [57,58].…”

“…In addition, even though RFC 7999 standardizes the black hole community [64], Giotsas et al found that several nonstandard variants still exist and some ASes do not adhere to the proper implementation of the standard (particularly regarding the propagation of blackholed prefixes) [58]. The severe lack of standardization and centralized documentation for BGP communities has caused researchers to resort to applying natural language processing on routing policies as a means of measuring large scale community usage [57,58]. We considered this approach but instead opted to manually parse routing policies from a smaller number of ASes to eliminate potential inaccuracies and extract more nuanced levels of community support.…”