Detecting BGP hijacks in 2014

No ratings

Presented at PacSec 2014 by

The main goal of this talk is to raise awareness of routing security issues by providing a tutorial on the BGP routing protocol and on the detection of specific routing events called IP prefixes hijacks. In a nutshell, such events happen when two network operators announce overlapping IP prefixes using BGP. As a consequence, IP packets could be delivered to these two operators. The final destination mainly depends on the home network of the sender. Overlapping announcements can disturb the whole Internet as observed in 2008 when YouTube traffic was partially redirected to Pakistan Telecom. However, duplicated and overlapping announcements may also be legitimate when an operator wishes to distribute its DNS servers using anycast to filter out DDoS attacks, or needs to assign IPv4 resources to its clients. As a consequence, detecting and classifying hijacks is a challenging task, not only because the dataset is large (around 500 Gb per year), but also because of engineering and commercial practices.