wan-sdn

WAN SDN

 

Software defined networking

 

WAN SDN

In today’s fast-paced digital world, organizations constantly seek ways to optimize their network infrastructure for improved performance, scalability, and cost efficiency. One emerging technology that has gained significant traction is WAN Software-Defined Networking (SDN). By decoupling the control and data planes, WAN SDN provides organizations unprecedented flexibility, agility, and control over their wide area networks (WANs). In this blog post, we will delve into the world of WAN SDN, exploring its key benefits, implementation considerations, and real-world use cases.

WAN SDN is a network architecture that allows organizations to manage and control their wide area networks using software centrally. Traditionally, WANs have been complex and time-consuming to configure, often requiring manual network provisioning and management intervention. However, with WAN SDN, network administrators can automate these tasks through a centralized controller, simplifying network operations and reducing human errors.

 

Highlights: WAN SDN

  • SDN and APIs

WAN SDN is a modern approach to network management that uses a centralized control model to manage, configure, and monitor large and complex networks. It allows network administrators to use software to configure, monitor, and manage network elements from a single, centralized system. This enables the network to be managed more efficiently and cost-effectively than traditional networks.

SDN uses an application programming interface (API) to abstract the underlying physical network infrastructure, allowing for more agile network control and easier management. It also enables network administrators to rapidly configure and deploy services from a centralized location. This enables network administrators to respond quickly to changes in traffic patterns or network conditions, allowing for more efficient use of resources.

  • Scalability and Automation

SDN also allows for improved scalability and automation. Network administrators can quickly scale up or down the network by leveraging automated scripts depending on its current needs. Automation also enables the network to be maintained more quickly and efficiently, saving time and resources.

 

Before you proceed, you may find the following posts helpful:

  1. WAN Virtualization
  2. Software Defined Perimeter Solutions
  3. What is OpenFlow
  4. SD WAN Tutorial
  5. What Does SDN Mean
  6. Data Center Site Selection

 



SDN Internet

Key WAN SDN Discussion Points:


  • Introduction to WAN SDN and what is involved.

  • Highlighting the challenges of a traditional WAN design.

  • Critical points on the rise of WAN SDN.

  • Technical details Internet measurements.

  • The LISP protocol.

 

Back to Basics with WAN SDN

A Deterministic Solution

Technology typically starts as a highly engineered, expensive, deterministic solution. As the marketplace evolves and competition rises, the need for a non-deterministic, inexpensive solution comes into play. We see this throughout history. First, mainframes were/are expensive, and with the arrival of a microprocessor personal computer, the client/server model was born. The Static RAM ( SRAM ) technology was replaced with cheaper Dynamic RAM ( DRAM ). These patterns consistently apply to all areas of technology.

Finally, deterministic and costly technology is replaced with intelligent technology-using redundancy and optimization techniques. This process is now appearing in Wide Area Networks (WAN). Now, we are witnessing changes to routing space with the incorporation of Software Defined Networking (SDN) and BGP (Border Gateway Protocol). By combining these two technologies, companies can now perform  intelligent routing, aka SD-WAN path selection, with an SD WAN Overlay

 

  • A key point: SD-WAN Path Selection

SD-WAN path selection is essential to a Software-Defined Wide Area Network (SD-WAN) architecture. SD-WAN path selection selects the most optimal network path for a given application or user. This process is automated and based on user-defined criteria, such as latency, jitter, cost, availability, and security. As a result, SD-WAN can ensure that applications and users experience the best possible performance by making intelligent decisions on which network path to use.

When selecting the best path for a given application or user, SD-WAN looks at the quality of the connection and the available bandwidth. It then looks at the cost associated with each path. Cost can be a significant factor when selecting a path, especially for large enterprises or organizations with multiple sites.

SD-WAN can also prioritize certain types of traffic over others. This is done by assigning different weights or priorities for different kinds of traffic. For example, an organization may prioritize voice traffic over other types of traffic. This ensures that voice traffic has the best possible chance of completing its journey without interruption.

SD WAN traffic steering
Diagram: SD WAN traffic steering. Source Cisco.

 

 

  • Back to basics with DMVPN

Wide Area Network (WAN) DMVPN (Dynamic Multipoint Virtual Private Network) is a type of Virtual Private Network (VPN) that uses an underlying public network, such as the Internet, to transport data between remote sites. It provides a secure, encrypted connection between two or more private networks, allowing them to communicate over the public network without establishing a dedicated physical connection.

 

Critical Benefits of WAN SDN:

Enhanced Network Flexibility:

WAN SDN enables organizations to adapt their network infrastructure to meet changing business requirements dynamically. Network administrators can quickly respond to network demands through programmable policies and automated provisioning, ensuring optimal performance and resource allocation.

Improved Network Agility:

By separating the control and data planes, WAN SDN allows for faster decision-making and network reconfiguration. This agility enables organizations to rapidly deploy new services, adjust network traffic flows, and optimize bandwidth utilization, ultimately enhancing overall network performance.

Cost Efficiency:

WAN SDN eliminates manual configuration and reduces the complexity associated with traditional network management approaches. This streamlined network management saves cost through reduced operational expenses, improved resource utilization, and increased network efficiency.

Critical Considerations for Implementation:

Network Security:

When adopting WAN SDN, organizations must consider the potential security risks associated with software-defined networks. Robust security measures, including authentication, encryption, and access controls, should be implemented to protect against unauthorized access and potential vulnerabilities.

Staff Training and Expertise:

Implementing WAN SDN requires skilled network administrators proficient in configuring and managing the software-defined network infrastructure. Organizations must train and upskill their IT teams to ensure successful implementation and ongoing management.

Real-World Use Cases:

Multi-Site Connectivity:

WAN SDN enables organizations with multiple geographically dispersed locations to connect their sites seamlessly. Administrators can prioritize traffic, optimize bandwidth utilization, and ensure consistent network performance across all locations by centrally controlling the network.

Cloud Connectivity:

With the increasing adoption of cloud services, WAN SDN allows organizations to connect their data centers to public and private clouds securely and efficiently. This facilitates smooth data transfers, supports workload mobility, and enhances cloud performance.

Disaster Recovery:

WAN SDN simplifies disaster recovery planning by allowing organizations to reroute network traffic during a network failure dynamically. This ensures business continuity and minimizes downtime, as the network can automatically adapt to changing conditions and reroute traffic through alternative paths.

 

The Rise of WAN SDN

The foundation for business and cloud services are crucial elements of business operations. The transport network used for these services is best efforts, weak, and offers no guarantee of an acceptable delay. More services are being brought to the Internet, yet the Internet is managed inefficiently and cheaply.

Every Autonomous System (AS) acts independently, and there is a price war between transit providers, leading to poor quality of transit services. Operating over this flawed network, customers must find ways to guarantee applications receive the expected level of quality.

Border Gateway Protocol (BGP), the Internet’s glue, has several path selection flaws. The main drawback of BGP is the routing paradigm relating to the path-selection process. BGP default path selection is based on Autonomous System (AS) Path length; prefer the path with the shortest AS_PATH. It misses the shape of the network with its current path selection process. It does not care if propagation delay, packet loss, or link congestion exists. It resulted in long path selection and utilizing paths potentially experiencing packet loss.

 

WAN SDN with Border6 

Border6 is a French company that started in 2012. It offers a Non-Stop Internet, an integrated WAN SDN solution influencing BGP to perform optimum routing. It’s not a replacement for BGP but a complementary tool to enhance routing decisions. For example, it automates changes in routing in cases of link congestion/blackouts.

“The agile way of improving BGP paths by the Border 6 tool improves network stability” Brandon Wade, iCastCenter Owner.

Customers wanted to bring additional intelligence to routing as the Internet became more popular. Additionally, businesses require SDN traffic optimizations as many run their entire service offerings on top of it.

 

What is non-stop internet?

Border6 offers an integrated WAN SDN solution with BGP that adds intelligence to outbound routing. A common approach when designing SDN in real-world networks is to prefer that SDN solutions incorporate existing field testing mechanisms (BGP) and not reinvent all the wheels ever invented. Therefore, the border6 approach to influence BGP with SDN is a welcomed and less risky approach to implementing a greenfield startup. In addition, Microsoft and Viptela also use the SDN solution to control the behavior of BGP.

Border6 takes BGP as a sort of guidance of what might be reachable. Based on various performance metrics, they measure how well paths perform. They use BGP to learn the structure of the Internet and then run their algorithms to know what is essential for individual customers. Every customer has different needs to reach different subnets. Some prefer costs; others prefer performance.

They elect several interesting “best” performing prefixes, and the most critical prefixes are selected. Next, they find probing locations and measure the source with automatic probes; to determine the best path. All these tools combined enhance the behavior of BGP. Their mechanism can detect if ISP has hardware/software problems, drops packets, or rerouting packets worldwide. 

 

Thousands of tests per minute

The Solution offers the best path by executing thousands of tests per minute and enabling results to include the best paths for packet delivery. Outputs from the live probing of path delays and packet loss inform BGP on which path to route traffic. The “best path” is different for each customer. It depends on the routing policy the customer wants to take. Some customers prefer paths without packet loss; others want cheap costs or paths under 100ms. It comes down to customer requirements and the applications they serve.

 

BGP – Unrelated to Performance

Traditionally, BGP is getting its information to make decisions based on data unrelated to performance. Broder 6 tries to correlate your packet’s path to the Internet by choosing the fastest or cheapest link, depending on requirements.

They are taking BGP data service providers are sending them as a baseline. Based on that broad connectivity picture, they have their measurements – lowest latency, packets lost, etc.- and adjust the data from BGP to consider these other measures. They were, eventually, performing optimum packet traffic forwarding. They first look at Netflow or Sflow data to determine what is essential and use their tool to collect and aggregate the data. From this data, they know what destinations are critical to that customer.

 

BGP for outbound | Locator/ID Separation Protocol (LISP) for inbound

Border6 products relate to outbound traffic optimizations. It can be hard to influence inbound traffic optimization with BGP. Most AS behave selfishly and optimize the traffic in their interest. They are trying to provide tools that help AS optimize inbound flows by integrating their product set with Locator/ID Separation Protocol (LISP). The diagram below displays generic LISP components. It’s not necessarily related to Border6 LISP design.

LISP decouples the address space so you can optimize inbound traffic flows. Many LISP uses cases are seen with active-active data centers and VM mobility. It decouples the “who” and the “where,” which allows end-host addressing not to correlate with the actual host location. The drawback is that LISP requires endpoints that can build LISP tunnels.

Currently, they are trying to provide a solution using LISP as a signaling protocol between Border6 devices. They are also working on performing statistical analysis for data received to mitigate potential denial-of-service (DDoS) events. More DDoS algorithms are coming in future releases.

 

Conclusion:

WAN SDN is revolutionizing how organizations manage and control their wide area networks. WAN SDN enables organizations to optimize their network infrastructure to meet evolving business needs by providing enhanced flexibility, agility, and cost efficiency.

However, successful implementation requires careful consideration of network security, staff training, and expertise. With real-world use cases ranging from multi-site connectivity to disaster recovery, WAN SDN holds immense potential for organizations seeking to transform their network connectivity and unlock new opportunities in the digital era.

 

Software defined networking

 

BGP neighbor states

BGP Port 179 exploit Metasploit

BGP Port 179 Exploit Metasploit

In the world of computer networking, Border Gateway Protocol (BGP) plays a crucial role in facilitating the exchange of routing information between different autonomous systems (ASes). At the heart of BGP lies port 179, which serves as the communication channel for BGP peers. In this blog post, we will dive into the significance of BGP port 179, exploring its functionality, its role in establishing BGP connections, and its importance in global routing.

Port 179, also known as the Border Gateway Protocol (BGP) port, serves as a communication channel for routers to exchange routing information. It facilitates the establishment of connections between autonomous systems, enabling the efficient flow of data packets across the interconnected network.

Border Gateway Protocol (BGP) is a gateway protocol that enables the Internet to exchange routing information between autonomous systems (AS). This is accomplished through peering, and BGP uses TCP port 179 to communicate with other routers, known as BGP peers. Without it, networks would not be able to send and receive information with each other.

However, peering requires open ports to send and receive BGP updates that can be exploited. BGP port 179 exploit can be used with Metasploit, often referred to as port 179 BGP exploit Metasploit. Metasploit is a tool that can probe BGP to determine if there is a port 179 BGP exploit.

Table of Contents

Highlights: Port 179

BGP and internal routing protocols

Traditionally, BGP learns the prefixes to advertise from another routing protocol, usually Open Shortest Path First (OSPF), Intermediate System-to-Intermediate System (IS-IS), or Enhanced Interior Gateway Routing Protocol (EIGRP). In addition, internal routing protocols control routing within an organization. However, BGP can be used internally in the data center. It is more common to have BGP peerings work at the Internet edge, the network infrastructure that serves traffic to the Internet.

BGP at the Internet Edge

The Internet edge shares itself among other functional blocks known as Places-in-the-network ( PINs ), such as data centers, campuses, and remote branches. BGP’s WAN SDN edge includes several infrastructure components: Service provider edge (SP), demilitarized zone (DMZ), remote access, and edge Distribution.

Security Considerations

Despite its significance, BGP is susceptible to several security vulnerabilities. This section will explore the most common threats: route hijacking, route leaks, and distributed denial-of-service (DDoS) attacks. Network administrators can better prepare to mitigate potential risks by understanding these vulnerabilities. Metasploit is a versatile framework for penetration testing and vulnerability assessment that provides security professionals with various tools and techniques. 

 

Port 179 and Security

BGP port 179 plays a significant role in securing BGP sessions. BGP routers implement various mechanisms to ensure the authenticity and integrity of the exchanged information. One such mechanism is TCP MD5 signatures, which provide a simple yet effective way to authenticate BGP peers. By enabling TCP MD5 signatures, routers can verify the source of BGP messages and prevent unauthorized entities from injecting false routing information into the network.

Related: Before you proceed, you may find the following posts helpful:

  1. IP Forwarding
  2. BGP SDN
  3. Redundant Links
  4. IPv6 Host Exposure
  5. Forwarding Routing Protocols
  6. Cisco DMVPN
  7. Dead Peer Detection



BGP Port 179 exploit Metasploit


Key BGP Security Discussion Points:


  • BGP requires open ports. BGP uses TCP port 179.

  • Metasploit can probe BGP neighbours.

  • Lack of a secure BGP control plane.

  • Bogus routing information or peers.

  • DoS BGP with SYN floods.

  • BGP TTL security check.

Recap the Basics: Port 179

BGP Port 179: The Communication Channel

Port 179 is the well-known port for BGP communication, acting as the gateway for BGP messages to flow between BGP routers. BGP, a complex protocol, requires a reliable and dedicated port to establish connections and exchange routing information. By utilizing port 179, BGP ensures its communication is secure and efficient, enabling routers to establish and maintain BGP sessions effectively.

Establishing BGP Connections

When two BGP routers wish to connect, they initiate a TCP connection on port 179. This connection allows the routers to exchange BGP update messages containing routing information such as network prefixes, path attributes, and policies. Routers build a comprehensive view of the network’s topology by exchanging these updates and making informed decisions on route traffic.

BGP port 179

1st Lab Guide: BGP Port 179

In the following lab guide on port 179, we have two BGP peers labeled BGP Peer 1 and BGP Peer 2. These BGP peers have one Gigabit Ethernet link between them. I have created an iBGP peering between the two peers, where the AS numbering is the same for both peers. 

Note:

Remember that a full mesh iBGP peering is required within an AS because iBGP routers do not re-advertise routes learned via iBGP to other iBGP peers. This is called the split horizon rule and is a routing-loop-prevention mechanism. Since we have two iBGP peers, this is fine. The BGP peerings are over TCP port 179, and I have redistributed connected so we have a route in the BGP table.

Port 179
Diagram: Port 179 with BGP peerings.

BGP Neighbor States

Unlike IGPs such as EIGRP and OSPF, BGP establishes sessions differently. In IGPs, neighbors are dynamically discovered as they bootstrap themselves to the topology. To peer with another BGP speaker, BGP speakers must explicitly be configured to do so. Furthermore, BGP must wait for a reliable connection to be established before proceeding. To overcome some issues with its predecessor, EGP, BGP was enhanced to address this requirement.

For two routers to establish this connection, both sides must have an interface configured for BGP and matching BGP settings, such as an Autonomous System number. Once the two routers have established a BGP neighbor relationship, they exchange routing information and can communicate with each other as needed.

BGP neighbor states represent the different stages of the relationship between BGP routers. These states are crucial in establishing and maintaining connections for exchanging routing information. Idle, Connect, OpenSent, and Established are the four neighbor states. Each state signifies a specific phase in the BGP session establishment process.

BGP neighbor states

  1. Idle State:

The first state in the BGP neighborship is the Idle state. In this state, a BGP router does not know any neighboring routers. It is waiting to establish a connection with a potential BGP peer. When a router is in the Idle state, it periodically sends out keepalive messages to potential peers, hoping to initiate the neighborship process.

  1. Connect State:

Once a router receives a keepalive message from a potential BGP neighbor, it transitions to the Connect state. The router attempts to establish a TCP connection with the neighboring router in this state. The Connect state lasts until the TCP connection setup is successful, after which the router moves to the OpenSent state.

  1. OpenSent State:

In the OpenSent state, the BGP router sends a neighboring router an Open message containing information about its capabilities and parameters. The router waits for a response from the neighbor. If the received Open message is acceptable, the router moves to the OpenConfirm state.

  1. OpenConfirm State:

In the OpenConfirm state, BGP routers exchange Keepalive messages to confirm that the TCP connection works correctly. The routers also negotiate various BGP parameters during this state. Once both routers have confirmed the connection, they move to the Established state.

  1. Established State:

The Established state is the desired state for BGP neighborship. In this state, the routers have successfully established a BGP peering relationship and are actively exchanging routing information. They exchange updates, keepalives, and notifications, enabling them to make informed routing decisions. This state is crucial for the stability and integrity of the overall BGP routing infrastructure.

BGP Neighbor Relationship

Below, the BGP state moves from Idle to Active and OpenSent. Some Open messages are sent and received; the BGP routers exchange some of their capabilities. From there, we move to the OpenConfirm and Established state. Finally, you see the BGP neighbor as up. The output of these debug messages is friendly and easy to read. If, for some reason, your neighbor’s adjacency doesn’t appear, these debugs can be helpful to solve the problem.

BGP neighbor Relationship

2nd Lab Guide: BGP Route Dampening

BGP dampening is a technique for reducing the impact of unstable routes in the BGP routing table by temporarily suppressing their advertisement. It aims to prevent excessive route flapping, which can lead to suboptimal routing decisions, increased network overhead, and potential instability in the routing system.

Note:

  1. In the following, BGP dampening is configured only on R2. Both R2 and R1 are BGP peers. EBGP peers, as each BGP speaker is in their own AS.
  2. Notice the outputs below when we shut down the loopback interface address 1.1.1.1/32 on R1.

Network administrators need to configure dampening parameters on BGP routers to implement BGP dampening. These parameters include the penalty values, the threshold at which a route is dampened, and the dampening duration. Careful consideration must be given to setting these parameters to balance stability and responsiveness. Fine-tuning the dampening parameters is crucial to achieve optimal results.

BGP dampening
Diagram: BGP Dampening

Port Numbers

Let’s go back to the basics for just a moment. First, we have port numbers, which represent communication endpoints. Port numbers are assigned 16-bit integers (see below) that identify a specific process or network service running on your network. These are not assigned randomly, and IANA is responsible for internet protocol resources, including registering used port numbers for well-known internet services.

  • Well Known Ports: 0 through 1023.
  • Registered Ports: 1024 through 49151.
  • Dynamic/Private: 49152 through 65535.

So, we have TCP port numbers and UDP port numbers. We know TCP enables hosts to establish a connection and exchange data streams reliably. Depending on the application, TCP Port 179 may use a defined protocol to communicate. For example, BGP is an application that uses TCP Port 179.

BGP chose this port for a good reason. TCP guarantees data delivery compared to UDP, and packets will be delivered on port 179 in the same order they were sent. So, we have guaranteed communication on TCP port 179, compared to UDP port 179. UDP port 179 would not have guaranteed communication in the same way as TCP.

 

UDP vs. TCP

UDP and TCP are internet protocols but have different features and applications. UDP, or User Datagram Protocol, is a lightweight and fast protocol used for applications that do not require reliable data transmission. UDP is a connectionless protocol that does not establish a dedicated end-to-end connection before sending data. Instead, UDP packets are sent directly to the recipient without any acknowledgment or error checking.

TCP vs UDP

Knowledge Check: TCP vs UDP

UDP, often referred to as a “connectionless” protocol, operates at the transport layer of the Internet Protocol Suite. Unlike TCP, UDP does not establish a formal connection between the sender and receiver before transmitting data. Instead, it focuses on quickly sending smaller packets, known as datagrams, without error-checking or retransmission mechanisms. This makes UDP a lightweight and efficient protocol ideal for applications where speed and minimal overhead are crucial.

The Reliability of TCP

In contrast to UDP, TCP is a “connection-oriented” protocol that guarantees reliable data delivery. By employing error-checking, acknowledgment, and flow control, TCP ensures that data is transmitted accurately and in the correct order. This reliability comes at the cost of increased overhead and potential latency, making TCP more suitable for applications that prioritize data integrity and completeness, such as file transfers and web browsing.

Use Cases and Applications

1. UDP:

– Real-time streaming: UDP’s low latency and reduced overhead suit real-time applications like video and audio streaming.

– Online gaming: The fast-paced nature of online gaming benefits from UDP, providing quick updates and responsiveness.

– DNS (Domain Name System): UDP is commonly used for DNS queries, where quick responses are essential for efficient web browsing.

DNS Root Servers

2. TCP:

– Web browsing: TCP’s reliability ensures that web pages and their resources are fully and accurately loaded.

– File transfers: TCP’s error-checking and retransmission mechanisms guarantee the successful delivery of large files.

– Email delivery: TCP’s reliability ensures that emails are transmitted without loss or corruption.

The TCP 3-Way Handshake

TCP, or Transmission Control Protocol, is a more reliable protocol for applications requiring error-free data transmission and guaranteed message delivery. TCP is a connection-oriented protocol that establishes a dedicated end-to-end connection between the sender and receiver before sending data. TCP uses a three-way handshake to establish a connection and provides error checking, retransmission, and flow control mechanisms to ensure data is transmitted reliably and efficiently.

TCP Handshake
Diagram: TCP Handshake

In summary, UDP is a lightweight and fast protocol suitable for applications that do not require reliable data transmissions, such as real-time streaming media and online gaming. TCP is a more reliable protocol ideal for applications requiring error-free data transmissions and guaranteed message delivery, such as web browsing, email, and file transfer.

BGP and TCP Port 179

In the context of BGP, TCP is used to establish a connection between two routers and exchange routing information. When a BGP speaker wants to connect with another BGP speaker, a TCP SYN message is sent to the other speaker. If the other speaker is available and willing to join, it sends a SYN-ACK message. The first speaker then sends an ACK message to complete the connection.

Once the connection is established, the BGP speakers can exchange routing information. BGP uses a set of messages to exchange information about the networks that each speaker can reach. The messages include information about the network prefix, the path to the network, and various attributes that describe the network.

3rd Lab Guide: BGP Update Messages

In the following lab guide, you will see we have two BGP peers. There is also a packet capture that displays the BGP update messages. BGP uses source and destination ports other than 179, depending on who originates the session. BGP is a standard TCP-based protocol that runs on client and server computers.

Port 179
Diagram: BGP peering operating over TCP Port 179

A successful TCP connection must exist before negotiating a BGP session between two peers. TCP provides a reliable transmission medium between the two peers and allows the exchange of BGP-related messages. A broken TCP connection also breaks the BGP session. BGP sessions are not always established after successful TCP connections.

In BGP, the session establishment phase operates independently of TCP, i.e., BGP rides on top of TCP. As a result, two peers may form a TCP connection but disagree on BGP parameters, resulting in a failed peering attempt. The BGP FSM oscillates between IDLE, ACTIVE, and CONNECT states while establishing the TCP connection.

To establish a connection with a TCP server, a TCP client first sends a TCP SYN packet with the destination port as the well-known port. In this first SYN, we are requesting to open a session. The server will reply with a TCP SYN ACK if it permits the session to open. It also wants to open a session. The source port of this SYN-ACK response is a well-known port, and the destination port is randomly chosen. After the three-way handshake, the client responds to the server with a TCP ACK, acknowledging the server’s response.

As far as BGP is concerned, TCP clients and servers are routers. When the “client” router initiates the BGP connection, it sends a request to the server with a destination port 179 and a random X source port. The server then responds with a source port of 179 and a destination port of X. Consequently, all client-to-server traffic uses destination 179, while all server-to-client traffic uses source 179.

The following Wireshark output shows a sample BGP update message. Notice the Dst Port: 179 highlighted in red.

BGP update message
Diagram: BGP update message. Source is Wireshark

To achieve reliable delivery, developers could either build a new transport protocol or use an existing one. The BGP creators leveraged TCP’s already robust reliability mechanisms instead of reinventing the wheel. This integration with TCP creates two phases of BGP session establishment:

  • TCP connection establishment phase
  • BGP session establishment phase

BGP uses a finite state machine (FSM) throughout the two phases of session establishment. In computing, a finite state machine is a construct that allows an object – the machine here – to operate within a fixed number of states. There is a specific purpose and set of operations for each state. The machine exists in only one of these states at any given moment. Input events trigger state changes. BGP’s FSM has six states in total. The following three states of BGP’s FSM pertain to TCP connection establishment:

  • Idle

  • Connect

  • Active

TCP messages are exchanged in these states for reliable delivery of BGP messages. After the TCP connection establishment phase, BGP enters the following three states of the BGP FSM, which pertain to the BGP session establishment phase:

  • Opensent

  • Openconfirm

  • Established

In these states, BGP exchanges messages related to the BGP session. The OPENSENT and OPENCONFIRM states correspond to the exchange of BGP session attributes between the BGP speakers. The ESTABLISHED state indicates the peer is stable and can accept BGP routing updates.

Together, these six states make up the entire BGP FSM. BGP maintains a separate FSM for each intended peer. Upon receiving input events, a peer transitions between these states. When a TCP connection is successfully established in the CONNECT or ACTIVE states, the BGP speaker sends an OPEN message and enters the OPENSENT state. An error event could cause the peer to transition to IDLE in any state.

TCP Connection Establishment Phase

Successful TCP connections are required before negotiating a BGP session between two peers. Over TCP, BGP-related messages can be exchanged reliably between two peers. A broken TCP connection also breaks the BGP session. BGP sessions are not permanently established after successful TCP connections.

Because BGP operates independently within a TCP connection, it “rides” on top of TCP. Peering attempts can fail when two peers agree on TCP parameters but disagree on BGP parameters. While establishing the TCP connection, the BGP FSM oscillates between IDLE, ACTIVE, and CONNECT states.

TCP is a connection-oriented protocol. This means TCP establishes a connection between two speakers, ensuring the information is ordered and delivered reliably. To create this connection, TCP uses servers and clients.

  • Clients connect to servers, making them the connecting side
  • Servers listen for incoming connections from prospective clients

TCP uses port numbers to identify the services and applications a server hosts. HTTP traffic uses TCP port 80, one of the most well-known. Clients initiate connections to these ports to access a specific service from a TCP server. Randomly generated TCP port numbers will be used by TCP clients to source their messages.

Whenever a TCP connection is made, a passive side waits for a connection, and an active side tries to make the connection. The following two methods can be used to open or establish TCP connections:

  • Passive Open
  • Active Open

A passive open occurs when a TCP server accepts a TCP client’s connection attempts on a specific TCP port. A WebServer, for instance, is configured to accept connections on TCP port 80, also referred to as “listening” on TCP port 80.

Active open occurs when a TCP client attempts to connect to a specific port on a TCP server. In this case, Client A can initiate a connection request to connect to the Web Server’s TCP Port 80.

To establish and manage a TCP connection, clients and servers exchange TCP control messages. Messages sent in TCP/IP packets are characterized by control bits in the TCP header. As shown in the Wireshark capture below, the SYN and ACK bits in the TCP header of the TCP/IP packet play a crucial role in the basic setup of the TCP connection.

Source: PacketPushers

The SYN bit indicates an attempt to establish a connection. To ensure reliable communication, it synchronizes TCP sequence numbers. An ACK bit suggests that a TCP message has been acknowledged. Reliability is based on the requirement that messages be acknowledged.

TCP connections are generally established by exchanging three control messages:

    • The client initiates an active open by sending a TCP/IP packet with the SYN bit set in the TCP header. This is a SYN message.
    • The server responds with its SYN message (the SYN bit is set in the TCP header), resulting in a passive open. The server also acknowledges the client’s SYN segment by indicating the ACK bit in the same control message. Since both SYN and ACK bits are set in the same message, this message is called the SYN-ACK message.
    • The Client responds with a TCP/IP packet, with the ACK bit set in the TCP header, to acknowledge that it received the Server’s SYN segment.

A TCP three-way handshake involves exchanging control messages or segments. A TCP connection has been established, and data can be exchanged between the devices if completed.

BGP’s three-way handshake is performed as follows:

  1. BGP speakers register the BGP process on TCP port 179 and listen for connection attempts from configured clients.
  2. As the TCP client, one speaker performs an active open by sending a SYN packet destined to the remote speaker’s TCP port 179. The packet is sourced from a random port number.
  3. The remote speaker, acting as a TCP server, performs a passive open by accepting the SYN packet from the TCP client on TCP port 179 and responding with its own SYN-ACK packet.
  4. The client speaker responds with an ACK packet, acknowledging it received the server’s SYN packet.

Bonus Content: What Is BGP Hijacking?

A BGP hijack occurs when attackers maliciously reroute Internet traffic. The attacker accomplishes this by falsely announcing ownership of IP prefixes they do not control, own, or route. When a BGP hijack occurs, all the signs on a stretch of the freeway are changed, and traffic is redirected to the wrong exit.

The BGP protocol assumes that interconnected networks are telling the truth about which IP addresses they own, so BGP hijacking is nearly impossible to stop. Imagine if no one watched the freeway signs. The only way to tell if they had been maliciously changed was by observing that many cars ended up in the wrong neighborhoods. To hijack BGP, an attacker must control or compromise a BGP-enabled router that bridges two autonomous systems (AS), so not just anyone can do so.

Inject False Routing Information

BGP hijacking can occur when an attacker gains control over a BGP router and announces false routing information to neighboring routers. This misinformation causes the routers to redirect traffic to the attacker’s network instead of the intended destination. The attacker can then intercept, monitor, or manipulate the traffic for malicious purposes, such as eavesdropping, data theft, or launching distributed denial of service (DDoS) attacks.

Methods for BGP Hijacking

There are several methods that attackers can use to carry out BGP hijacking. One common technique is prefix hijacking, where the attacker announces a more specific IP address prefix for a given destination than the legitimate owner of that prefix. This causes traffic to be routed through the attacker’s network instead of the legitimate network.

Another method is AS path manipulation, where the attacker modifies the AS path attribute of BGP updates to make their route more appealing to neighboring routers. By doing so, the attacker can attract traffic to their network and then manipulate it as desired.

BGP hijacking
Diagram: BGP Hijacking. Source is catchpoint

Mitigate BGP Hijacking

Network operators can implement various security measures to mitigate the risk of BGP hijacking. One crucial step is validating BGP route announcements using Route Origin Validation (ROV) and Resource Public Key Infrastructure (RPKI). These mechanisms allow networks to verify the legitimacy of BGP updates and reject any malicious or unauthorized announcements.

Additionally, network operators should establish BGP peering relationships with trusted entities and implement secure access controls for their routers. Regular monitoring and analysis of BGP routing tables can also help detect and mitigate hijacking attempts in real-time.

BGP Exploit and Port 179

Exploiting Port 179

Port 179 is the designated port for BGP communication. Cybercriminals can exploit this port to manipulate BGP routing tables, redirecting traffic to unauthorized destinations. Attackers can potentially intercept and use sensitive data by impersonating a trusted BGP peer or injecting false routing information.

The consequences of a successful BGP exploit can be severe. Unauthorized rerouting of internet traffic can lead to data breaches, service disruptions, and even financial losses. The exploit can be particularly damaging for organizations that rely heavily on network connectivity, such as financial institutions and government agencies.

Protecting your network from BGP exploits requires a multi-layered approach. Here are some essential measures to consider:

1. Implement BGP Security Best Practices: Ensure your BGP routers are correctly configured and follow best practices, such as filtering and validating BGP updates.

2. BGP Monitoring and Alerting: Deploy robust monitoring tools to detect anomalies and suspicious activities in BGP routing. Real-time alerts can help you respond swiftly to potential threats.

3. Peer Authentication and Route Validation: Establish secure peering relationships and implement mechanisms to authenticate BGP peers. Additionally, consider implementing Resource Public Key Infrastructure (RPKI) to validate the legitimacy of BGP routes.

BGP Port 179 Exploit

What is the BGP protocol in networking? The operation of the Internet Edge and BGP is crucial to ensure that Internet services are available. Unfortunately, this zone is a public-facing infrastructure exposed to various threats, such as denial-of-service, spyware, network intrusion, web-based phishing, and application-layer attacks. BGP is highly vulnerable to multiple security breaches due to the lack of a scalable means of verifying the authenticity and authorization of BGP control traffic.

As a result, a bad actor could compromise BGP and inject believable BGP messages into the communication between BGP peers. As a result, they were injecting bogus routing information or breaking the peer-to-peer connection.

In addition, outsider sources can also disrupt communications between BGP peers by breaking their TCP connection with spoofed RST packets. To do this, you need to undergo BGP vulnerability testing. One option is to use the port 179 BGP exploit to collect data on the security posture of BGP implementations.

port 179 BGP exploit
Diagram: BGP at the WAN Edge. Port 179 BGP exploit

Metasploit: A Powerful Penetration Testing Tool:

Metasploit, developed by Rapid7, is an open-source penetration testing framework that provides a comprehensive set of tools for testing and exploiting vulnerabilities. One of its modules focuses specifically on BGP port 179, enabling ethical hackers and security professionals to assess the security posture of their networks.

Exploiting BGP with Metasploit:

Metasploit offers a wide range of BGP-related modules that can be leveraged to simulate attacks and identify potential vulnerabilities. These modules enable users to perform tasks such as BGP session hijacking, route injection, route manipulation, and more. By utilizing Metasploit’s BGP modules, network administrators can proactively identify weaknesses in their network infrastructure and implement appropriate mitigation strategies.

Benefits of Metasploit BGP Module:

The utilization of Metasploit’s BGP module brings several benefits to network penetration testing:

  1. Comprehensive Testing: Metasploit’s BGP module allows for thorough testing of BGP implementations, helping organizations identify and address potential security flaws.
  2. Real-World Simulation: By simulating real-world attacks, Metasploit enables security professionals to gain deeper insights into the impact of BGP vulnerabilities on their network infrastructure.
  3. Enhanced Risk Mitigation: Using Metasploit to identify and understand BGP vulnerabilities helps organizations develop effective risk mitigation strategies, ensuring the integrity and availability of their networks.

Border Gateway Protocol Design

Service Provider ( SP ) Edge Block

Service Provider ( SP ) Edge comprises Internet-facing border routers. These routers are the first line of defense and will run external Border Gateway Protocol ( eBGP ) to the Internet through dual Internet Service Providers ( ISP ).

Border Gateway Protocol is a policy-based routing protocol deployed at the edges of networks connecting to 3rd-party networks and has redundancy and highly available methods such as BGP Multipath. However, as it faces the outside world, it must be secured and hardened to overcome numerous blind and semi-blind attacks it can face, such as DoS or Man-in-the-Middle Attacks.

 Man-in-the-middle attacks

Possible attacks against BGP could be BGP route injection from a bidirectional man-in-the-middle attack. In theory, BGP route injection seems simple if one compares it to a standard ARP spoofing man-in-the-middle attack, but in practice, it does not. To successfully insert a “neighbor between neighbors,” a rogue router must successfully TCP hijack BGP.

 Requires the following:

  1. Correctly matching the source address and source port.
  2. Matching the destination port.
  3. Guess the TTL if a BGP TTL hacks if applied.
  4. Match the TCP sequence numbers.
  5. Bypassing MD5 authentication ( if any ).

 Although this might seem like a long list, it is possible. The first step would be to ARP Spoof the connection between BGP peers using Dsniff or Ettercap. After successfully spoofing the session, launch tools from CIAG BGP, such as TCP hijack. The payload is a BGP Update or a BGP Notification packet fed into the targeted session.

 Blind DoS attacks against BGP routers

A DoS attack on a BGP peer would devastate the overall network, more noticeably for exit traffic, as BGP deployment occurs at the network’s edges. On the other hand, a DoS attack could bring down a BGP peer and cause route flapping or dampening. A widespread DoS attack floods the target BGP service, enabling MD5 authentication using SYN TCP packets with MD5 signatures. The attack overloads the targeted peer with loads of MD5 authentication processing, which consumes all its resources that should process standard control and data plane function packets.

 

Countermeasures – Protecting the Edge.

One way to lock down BGP is to implement the “BGP TTL hack,” known as the BGP TTL security check. This feature protects eBGP sessions ( not iBGP ) and compares the value in the received IP packet’s Time-to-Live ( TTL ) field with a hop count locally configured on each eBGP neighbor. All packets with values less than the expected value are silently discarded.

One security concern with BGP is the possibility of a malicious attacker injecting false routing information into the network. A TTL (Time to Live) security check can be implemented to mitigate this risk.

TTL Security Check

The TTL security check involves verifying the TTL value of a BGP update message. The TTL value is a field in the IP header specifying the maximum number of hops a packet can travel before being discarded. When a BGP update message is received, the TTL value is checked to ensure that the message has traveled fewer hops than expected. If the TTL value is higher than expected, the message is discarded.

Implementing a TTL security check can help prevent attacks such as route hijacking and route leaks. Route hijacking is an attack where a malicious actor announces false routing information to redirect traffic to a different destination. Route leaks occur when a network announces routes that it does not control, leading to potential traffic congestion and instability.

BGP - TTL Security
BGP – TTL Security

Importance of BGP TTL Security Check:

1. Mitigating Route Leaks: Route leaks occur when BGP routers inadvertently advertise routes to unauthorized peers. By implementing TTL security checks, routers can verify the authenticity of received BGP packets, preventing unauthorized route advertisements and mitigating the risk of route leaks.

2. Preventing IP Spoofing: TTL security check is crucial in preventing IP spoofing attacks. By verifying the TTL value of incoming BGP packets, routers can ensure that the source IP address is legitimate and not spoofed. This helps maintain the trustworthiness of routing information and prevents potential network attacks.

3. Enhancing BGP Routing Security: BGP TTL security check adds an extra layer of security to BGP routing. By validating the TTL values of incoming packets, network operators can detect and discard packets with invalid TTL values, thus preventing potential attacks that manipulate TTL values.

Implementation of BGP TTL Security Check:

To implement BGP TTL security checks, network operators can configure BGP routers to verify the TTL values of received BGP packets. This can be done by setting a minimum TTL threshold, which determines the minimum acceptable TTL value for incoming BGP packets. Routers can then drop packets with TTL values below the configured threshold, ensuring that only valid packets are processed.

It is possible to forge the TTL field in the IP packet header. To forge accurately, the TTL count of matching the TTL count of the configured neighbor is nearly impossible. The trusted peer would most likely be compromised for this to take place. After you enable the check, the configured BGP peers send all their updates with a TTL of 255. This router only accepts BGP packets with a TTL value of 252 or more significant in the command syntax below.

port 179 bgp exploit metasploit
Diagram: BGP Security.
Neighbor 192.168.1.1 TTL-security hops 2The external BGP neighbor may be up to 2 hops away. 

Routers learned from SP 1 should not be leaked to SP 2 and vice versa. The following should be matched and applied to an outbound route map.

ip as-path access-list 10 permit ^$Permit only if there is no as-path prepend
ip as-path access-list 10 deny .*Deny if there is an as-path prepend

A final note on BGP security

  • BGP MD5-based authentication should be used for eBGP neighbors.

  • Route flap dampening.

  • Layer 2 and ARP-related defense mechanism for shared media.

  • Bogon list and Infrastructure ACL to provide inbound packet filtering.

  • Packet filtering to block unauthorized hosts’ access to TCP port 179.

  • Implement extensions to BGP, including Secure BGP ( S-BGP ), Secure Origin BGP ( so-BGP ) and Pretty Secure BGP ( psBGP).

BGP is one of the protocols that makes the Internet work. Most hackers and attackers worldwide target BGP due to its criticality and importance to the Internet. Attackers are primarily interested in finding vulnerabilities in systems like BGP and exploiting them. If they are successful, they can cause significant disruption to the Internet by finding a loophole in BGP. This is the primary reason for securing a BGP.

Before securing BGP, there are a few primary areas to focus on:

  • Authentication: BGP neighbors in the same AS or two different ASs must be authenticated. BGP sessions and routing information should be shared only with authenticated BGP neighbors.
  • Message integrity: BGP messages should not be illegally modified during transport.
  • Availability: BGP speakers should be protected from Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attacks.
  • Prefix origination validation: Implementing a mechanism to distinguish between invalid and legitimate routes for BGP destinations is necessary.
  • AS path verification: Verify that no illegal entity falsifies an AS_PATH (modifies it with a wrong AS number or deletes it). This can result in traffic black holes for the destination prefix as the route selection process uses AS_PATH.

A Final Note on BGP Security

BGP (Border Gateway Protocol) is a protocol used to exchange routing information between different Autonomous Systems (AS) on the Internet. It is crucial for the Internet to function correctly, but it introduces various security challenges.

BGP Hijacking

One of the most significant security challenges with BGP is the possibility of BGP hijacking. BGP hijacking occurs when an attacker announces illegitimate routes to a BGP speaker, causing traffic to be diverted to the attacker’s network. This can lead to severe consequences, such as loss of confidentiality, integrity, and availability of the affected network.

Various security mechanisms have been proposed to prevent BGP hijacking. One of the most commonly used mechanisms is the Resource Public Key Infrastructure (RPKI). RPKI is a system that enables network operators to verify the legitimacy of BGP advertisements. RPKI associates a public key with a route object in the BGP routing table. If the public key associated with a route object matches the public key of the originating AS, the route is considered legitimate.

BGPsec

Another mechanism to prevent BGP hijacking is the use of BGPsec. BGPsec is a security extension to BGP that provides cryptographic protection to BGP messages. BGPsec ensures that BGP messages are not tampered with during transit and that the origin of the BGP messages can be verified.

In addition to BGP hijacking, BGP is also susceptible to other security threats, such as BGP route leaks and BGP route flaps. Various best practices should be followed to mitigate these threats, such as implementing route filtering, route reflectors, and deploying multiple BGP sessions.

In conclusion, BGP is a critical Internet protocol that introduces various security challenges. To ensure the security and stability of the Internet, network operators must implement appropriate security mechanisms and best practices to prevent BGP hijacking, route leaks, and other security threats.

A Final Note on BGP Port 179

BGP (Border Gateway Protocol) is a crucial component of the internet infrastructure, facilitating the exchange of routing information between different networks. One of the most critical aspects of BGP is its use of well-known port numbers to establish connections and exchange data. Port 179 holds a significant role among these port numbers.

Port 179 is designated explicitly for BGP communication. It serves as the default port for establishing TCP connections between BGP routers. BGP routers utilize this port to exchange routing information and ensure the optimal flow of network traffic.

BGP Sessions

Port 179’s importance in BGP cannot be overstated. It acts as the gateway for BGP sessions to establish connections between routers. BGP routers use this port to communicate and share information about available routes, network prefixes, and other relevant data. This allows routers to make informed decisions about the most efficient path-forwarding traffic.

When a BGP router initiates a connection, it sends a TCP SYN packet to the destination router on port 179. If the destination router is configured to accept BGP connections, it responds with a SYN-ACK packet, establishing a TCP connection. Once the connection is established, BGP routers exchange updates and inform each other about network changes.

Port 179 is typically used for external BGP (eBGP) sessions, where BGP routers from different autonomous systems connect to exchange routing information. However, it can also be used for internal BGP (iBGP) sessions within the same autonomous system.

Port 179 is a well-known port.

It is worth noting that port 179 is a well-known port, meaning it is standardized and widely recognized across networking devices and software. This standardization ensures compatibility and allows BGP routers from different vendors to communicate seamlessly.

While port 179 is the default port for BGP, it is essential to remember that BGP can be configured to use other port numbers if necessary. This flexibility allows network administrators to adapt BGP to their specific requirements, although it is generally recommended to stick with the default port for consistency and ease of configuration.

In conclusion, port 179 enables BGP routers to establish connections and exchange routing information. It is the gateway for BGP sessions, ensuring efficient network traffic flow. Understanding the significance of port 179 is essential for network administrators working with BGP and plays a vital role in maintaining a robust and efficient internet infrastructure.

Note: BGP operation is unaffected by the client/server model except for those who connect to port 179 and those who source from port 179. The client or server can be on either side of the BGP session. In some designs, however, assigning TCP server and client roles to specific devices might be desirable. Such a client/server interaction with BGP can be found in hub-spoke topologies such as DMVPN – DMVPN phases,  where the hub is configured as a route-reflector and the spokes are configured as route-reflector clients. BGP dynamic neighbors can be used to ensure that the hub listens and accepts connections from various potential IP addresses, so it becomes a TCP server waiting passively for the spokes to open TCP connections.

Summary: Port 179

In the vast realm of networking, BGP (Border Gateway Protocol) plays a crucial role in facilitating the exchange of routing information between different autonomous systems. As network administrators and enthusiasts, understanding the significance of BGP Port 179 is essential. In this blog post, we delved into the intricacies of BGP Port 179, exploring its functions, common issues, and best practices.

Section 1: The Basics of BGP Port 179

BGP Port 179 is the designated port the BGP protocol uses for establishing TCP connections between BGP speakers. It serves as the gateway for communication and exchange of routing information. BGP Port 179 acts as a doorway through which BGP peers connect, allowing them to share network reachability information and determine the best paths for data transmission.

Section 2: Common Issues and Troubleshooting

Like any networking protocol, BGP may encounter various issues that can disrupt communication through Port 179. One common problem is establishing BGP sessions. Misconfigurations, firewall rules, or network connectivity issues can prevent successful connections. Troubleshooting BGP Port 179 involves analyzing logs, checking routing tables, and verifying BGP configurations to identify and resolve any problems that may arise.

Section 3: Security Considerations and Best Practices

Given its critical role in routing and network connectivity, securing BGP Port 179 is paramount. Implementing authentication mechanisms like MD5 authentication can prevent unauthorized access and potential attacks. Applying access control lists (ACLs) to filter incoming and outgoing BGP traffic can add an extra layer of protection. Regularly updating BGP software versions and staying informed about security advisories are crucial best practices.

Section 4: Scaling and Performance Optimization

As networks grow in size and complexity, optimizing BGP Port 179 becomes vital for efficient routing. Techniques such as route reflection and peer groups help reduce the computational load on BGP speakers and improve scalability. Implementing route-dampening mechanisms or utilizing BGP communities can enhance performance and fine-tune routing decisions.