Content area
Full Text
Abstract - As the number of IP hijacking incidents has increased, many IP hijacking monitoring tools have been implemented. However, none of the monitoring tools can directly control the data plane of BGP routers. Therefore, network administrators should protect their routers by using command line interface when the network administrator receives any warning from BGP hijacking monitoring tools. As the number of routers and prefixes continuously increased, checking the routing information in their routers manually is one of the big burdens on the administrators. In addition, when IP hijacking occurs, it is very important for the administrator to quickly block the bogus prefixes. Otherwise, thousands of traffic will be transferred to the wrong way within a very short moment. In this paper, we extended Quagga-SRx so that the Quagga-SRx can send a BGP update message including an opaque extend community to other iBGP peers for notifying bogus IP prefixes after detecting abnormal IP prefixes. As a result of this, the other iBGP peers can recognize bogus IP prefixes by accepting the BGP update message that includes the opaque extend community, and automatically blocks the bogus prefixes if the iBGP routers have an ability to process the opaque extend community. Therefore, when IP hijacking occurs, the bogus prefixes can be blocked automatically and quickly, which makes the ASes more secure.
Keywords: BGP, border gateway protocol, interdomain routing, network security, networks, routing
1 Introduction
The BGP is an Inter-domain routing protocol, and is the routing protocol that enables large networks to form a single Internet. The main functionality of BGP is to exchange Network Layer Reachability Information (NLRI) between Autonomous Systems (ASes) so that a BGP speaker can communicate with other BGP routers and ultimately can reach a destination of a certain router [1]. However, when the BGP was designed, its vulnerabilities were hardly considered [2].
Unfortunately, the lack of consideration of BGP vulnerabilities occasionally causes severe failure of Internet service provision. Such a failure called prefix hijacking causes attacks on the routing infrastructure or the control plane of the Internet. The prefix hijacking occurred on the 25th of April in 1997 by a misconfigured router that advertised incorrect prefixes and announced AS 7007 as an origin of them. As a result, it created a...