Detecting BGP hijacks in 2014
|
|
|
- Allison Hicks
- 10 years ago
- Views:
Transcription
1 Detecting BGP hijacks in 2014 Guillaume Valadon & Nicolas Vivet Agence nationale de la sécurité des systèmes d information NSC - November 21th, 2014 ANSSI - Detecting BGP hijacks in /52
2 BGP Hijacking for Cryptocurrency Profit Reported by Dell SecureWorks on August «From February to May 2014, an hijacker redirected cryptocurrency miners to his own mining pool, earning an estimated $83,000.» Attack Requirements no authentication between a miner and its bitcoin pool traffic redirection using BGP prefixes hijacks ANSSI - Detecting BGP hijacks in /52
3 BGP 101
4 What is BGP (Border Gateway Protocol)? It is the routing protocol used by all Internet operators. Some BGP facts it runs on 179/TCP it informs that an operator is in charge of IP prefixes there is no guarantee that an operator is lying ANSSI - Detecting BGP hijacks in /52
5 What is BGP (Border Gateway Protocol)? It is the routing protocol used by all Internet operators. Some BGP facts it runs on 179/TCP it informs that an operator is in charge of IP prefixes there is no guarantee that an operator is lying it interconnects all Internet operators ANSSI - Detecting BGP hijacks in /52
6 What is BGP (Border Gateway Protocol)? It is the routing protocol used by all Internet operators. Some BGP facts it runs on 179/TCP it informs that an operator is in charge of IP prefixes there is no guarantee that an operator is lying it interconnects all Internet operators ANSSI - Detecting BGP hijacks in /52
7 What is BGP (Border Gateway Protocol)? It is the routing protocol used by all Internet operators. Some BGP facts it runs on 179/TCP it informs that an operator is in charge of IP prefixes there is no guarantee that an operator is lying it interconnects all Internet operators ANSSI - Detecting BGP hijacks in /52
8 What Do You Need to Use BGP? a network AS42 ANSSI - Detecting BGP hijacks in /52
9 What Do You Need to Use BGP? a network an AS number that identifies your network an IP prefix AS /16 ANSSI - Detecting BGP hijacks in /52
10 What Do You Need to Use BGP? a network an AS number that identifies your network an IP prefix a BGP router AS /16 ANSSI - Detecting BGP hijacks in /52
11 What Do You Need to Use BGP? a network an AS number that identifies your network an IP prefix a BGP router a BGP interconnection AS /16 AS transit ISP providing BGP Internet ANSSI - Detecting BGP hijacks in /52
12 Internet Resources Allocation AS & prefixes are allocated by Regional Internet Registry: Europe Asia Africa North America Latin America & Caribbean In Europe, per year, an ASN costs 50 and a / ANSSI - Detecting BGP hijacks in /52
13 Access to Internet Resources Allocation The WHOIS protocol $ whois AS4713 aut-num: AS4713 as-name: OCN descr: NTT Communications Corporation [..] country: JP admin-c: AY1361JP tech-c: TT10660JP tech-c: TT15086JP changed: [email protected] changed: [email protected] source: JPNIC ANSSI - Detecting BGP hijacks in /52
![.] country: JP admin-c: AY1361JP tech-c: TT10660JP tech-c: TT15086JP changed:](/docs-images/45/5537358/images/page_13.jpg "apnic-ftp@nic.ad.jp 19960911 changed: apnic-ftp@nic.ad.jp 20091113 source: JPNIC ANSSI - Detecting BGP hijacks in 2014 7/52")
14 Access to Internet Resources Allocation ANSSI - Detecting BGP hijacks in /52
15 AS Announces & Removes Prefixes With BGP, an operator uses: AS43515 Internet AS / /24 AS /16 ANSSI - Detecting BGP hijacks in /52
16 AS Announces & Removes Prefixes With BGP, an operator uses: UPDATE messages to announce its IP prefixes AS43515 Internet / /24 AS / / /24 AS /16 ANSSI - Detecting BGP hijacks in /52
17 AS Announces & Removes Prefixes With BGP, an operator uses: UPDATE messages to announce its IP prefixes WITHDRAW messages to remove its IP prefixes AS43515 Internet / /24 AS / / /24 AS /16 ANSSI - Detecting BGP hijacks in /52
18 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix AS1 AS2 AS3 Internet ANSSI - Detecting BGP hijacks in /52
19 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix BGP /24 AS1 AS1 AS2 AS3 Internet /24 ANSSI - Detecting BGP hijacks in /52
20 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix BGP /24 AS1 BGP /24 AS1 AS2 AS1 AS2 AS3 Internet / /24 ANSSI - Detecting BGP hijacks in /52
21 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix BGP /24 AS /24 AS1 AS3 AS1 AS2 AS4 Internet AS3 ANSSI - Detecting BGP hijacks in /52
22 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix BGP /24 AS /24 AS1 AS3 BGP /24 AS1 AS2 AS1 AS2 AS4 Internet AS /24 ANSSI - Detecting BGP hijacks in /52
23 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix AS4 AS1 AS2 Internet AS3 ANSSI - Detecting BGP hijacks in /52
24 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix /16 AS4 AS /24 AS2 Internet AS3 ANSSI - Detecting BGP hijacks in /52
25 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix /16 AS /24 AS4 BGP /16 AS4 AS /24 AS3 AS1 AS2 Internet AS3 ANSSI - Detecting BGP hijacks in /52
26 Three Simple BGP Rules 1. messages are forwarded to neighbors, after adding the ASN 2. only the shortest AS path is forwarded 3. packets are sent to the most specific prefix /16 AS /24 AS4 AS3 BGP /16 AS4 AS /24 AS3 AS1 AS Internet ANSSI - Detecting BGP hijacks in /52
27 Hijacks 101
28 What is a Prefix Hijack? BGP rule #2 in action An hijack is a conflicting BGP announcement. BGP /23 AS1 AS0 AS /23 AS0 AS1 AS2 ANSSI - Detecting BGP hijacks in /52
29 What is a Prefix Hijack? BGP rule #2 in action An hijack is a conflicting BGP announcement /23 BGP /23 AS1 AS /23 AS3 AS3 AS0 AS1 AS /23 ANSSI - Detecting BGP hijacks in /52
30 What is a Prefix Hijack? BGP rule #2 in action An hijack is a conflicting BGP announcement. AS3 BGP /23 AS1 AS / /23 AS /23 AS0 AS1 AS2 Rule #2 applies: traffic is redirected to AS3! ANSSI - Detecting BGP hijacks in /52
31 Active Countermeasure Use BGP rule #3! /23 BGP /23 AS1 AS /23 AS3 AS3 AS0 AS1 AS /23 The origin AS announces more specific prefixes. ANSSI - Detecting BGP hijacks in /52
32 Active Countermeasure Use BGP rule #3! /23 AS3 AS0 AS1 AS / /24 BGP /23 AS1 AS /23 AS /24 AS1 AS /24 AS1 AS /23 The origin AS announces more specific prefixes. ANSSI - Detecting BGP hijacks in /52
33 Active Countermeasure Use BGP rule #3! /23 AS1 AS /23 AS /24 AS1 AS /24 AS1 AS /23 AS3 AS0 AS1 AS / /24 BGP /23 The origin AS announces more specific prefixes. ANSSI - Detecting BGP hijacks in /52
34 Active Countermeasure Use BGP rule #3! /23 AS1 AS /23 AS /24 AS1 AS /24 AS1 AS /23 AS3 AS0 AS1 AS / /24 BGP /23 The origin AS announces more specific prefixes. Rule #3 applies: traffic is sent to AS0! ANSSI - Detecting BGP hijacks in /52
35 A Recent Example on October 16 Hijack against a French AS x ANSSI - Detecting BGP hijacks in /52
36 A Recent Example on October 16 Hijack against a French AS ANSSI - Detecting BGP hijacks in /52
37 Passive Countermeasure Strict filter on an interconnection /23 BGP / AS3 AS0 AS1 AS2 a BGP router can filter prefix in UPDATE messages useful filtering can only be done by the upstream provider ANSSI - Detecting BGP hijacks in /52
38 Passive Countermeasure Strict filter on an interconnection /23 BGP / AS3 AS0 AS1 AS /23 a BGP router can filter prefix in UPDATE messages useful filtering can only be done by the upstream provider ANSSI - Detecting BGP hijacks in /52
39 Passive Countermeasure Automate filter maintenance A route object: is declared by the AS in charge of an IP prefix tells who can announce the prefix with BGP the operator, its DDoS mitigation provider, its clients, $ whois -T route /22 route: /22 descr: Observatory IPv4 prefix. origin: AS mnt-by: ASOBS-MNT source: RIPE # Filtered ANSSI - Detecting BGP hijacks in /52
40 Offline Hijack Detection
41 BGP messages ANSSI - Detecting BGP hijacks in /52
42 Collecting BGP Archives AS5 AS4 BGP collector AS1 AS2 AS3 AS6 AS / /24 Routing Information Service (RIS) 13 BGP collectors all over the world 263 BGP peers BGP messages dumped into binary files 550 GB per year ANSSI - Detecting BGP hijacks in /52
43 Parsing BGP Archives Raw BGP BGP parser Need for a dedicated BGP parser fast & trusted parser written in OCaml convert BGP messages to JSON human readable / writable format ANSSI - Detecting BGP hijacks in /52
44 Parsing BGP Archives { "timestamp": , "collector": "rrc07", "as_path":" ", "announce":[" /24 "], "withdraw":[] } { "timestamp": , "collector": "rrc07", "as_path":" ", "announce":[" /24 "], "withdraw":[] } Need for a dedicated BGP parser fast & trusted parser written in OCaml convert BGP messages to JSON human readable / writable format ANSSI - Detecting BGP hijacks in /52
45 Parsing BGP Archives { "timestamp": , "collector": "rrc07", "as_path":" ", "announce":[" /24 "], "withdraw":[] } { "timestamp": , "collector": "rrc07", "as_path":" ", "announce":[" /24 "], "withdraw":[] } Need for a dedicated BGP parser fast & trusted parser written in OCaml convert BGP messages to JSON human readable / writable format ANSSI - Detecting BGP hijacks in /52
46 Parsing BGP Archives { "timestamp": , "collector": "rrc07", "as_path":" ", "announce":[" /24 "], "withdraw":[] } { "timestamp": , "collector": "rrc07", "as_path":" ", "announce":[" /24 "], "withdraw":[] } Need for a dedicated BGP parser fast & trusted parser written in OCaml convert BGP messages to JSON human readable / writable format ANSSI - Detecting BGP hijacks in /52
47 Emulating a BGP Router /8 AS /22 AS2 AS /10 AS4 AS /11 AS /22 AS42 Build the routing table fast IP lookup library similar to a router & the Linux kernel the tree is updated with each BGP messages duplicated entries are conflicts ANSSI - Detecting BGP hijacks in /52
48 Emulating a BGP Router /8 AS /22 AS2 AS /10 AS4 AS /11 AS /22 AS42 Processing an UPDATE message { "timestamp": , "peer_as":25152, "as_path":" ", "announce":[" /24 "], "withdraw":[] } ANSSI - Detecting BGP hijacks in /52
49 Emulating a BGP Router /8 AS /22 AS2 AS /10 AS4 AS /11 AS /22 AS42 Processing an UPDATE message { "timestamp": , "peer_as":25152, "as_path":" ", "announce":[" /24 "], "withdraw":[] } ANSSI - Detecting BGP hijacks in /52
50 Emulating a BGP Router /8 AS /22 AS2 AS /10 AS4 AS /11 AS /22 AS42 Processing an UPDATE message { "timestamp": , "peer_as":25152, "as_path":" ", "announce":[" /24 "], "withdraw":[] } ANSSI - Detecting BGP hijacks in /52
51 Putting Everything Together Raw BGP BGP parser Emulate BGP { } JSON Processing 50k ASes emulated routers handle different AS with 8 cores, a month is processed in 10 hours With 13 collectors, 156 months must be processed per year! ANSSI - Detecting BGP hijacks in /52
52 Faster Conflicts Detection Scaling by adding cores { } { } Raw BGP BGP parser Emulate BGP JSON Raw BGP BGP parser Emulate BGP JSON { } { } Raw BGP BGP parser Emulate BGP JSON Raw BGP BGP parser Emulate BGP JSON Conflicts detection completes in one week with 120 cores on 5 servers generates 130 GB per year conflicts from January to October 2014 ANSSI - Detecting BGP hijacks in /52
53 Faster Conflicts Detection Scaling by adding cores { } { } Raw BGP BGP parser Emulate BGP JSON Raw BGP BGP parser Emulate BGP JSON { } { } Raw BGP BGP parser Emulate BGP JSON Raw BGP BGP parser Emulate BGP JSON Conflict example { "timestamp": , "collector": "rrc07", "announce": { "prefix": " /24 ", "asn": 666, "as_path": " "}, "conflict_with": {"prefix": " /24 ", "asn": 7500 }} ANSSI - Detecting BGP hijacks in /52
54 Accessing The Data Disco? automatic data distribution & replication like HDFS MapReduce framework in Python like Hadoop ANSSI - Detecting BGP hijacks in /52
55 Accessing The Data From BIG DATA to small data one hour to extract conflicts targeting 1000 ASes close to the number of French & Japanese ASes 70 millions conflicts per country 200MB ANSSI - Detecting BGP hijacks in /52
56 Classifying Conflicts - 1/3 Using route objects Validating a single conflict { "timestamp": , "collector": "rrc07", "announce": { "prefix": " /24 ", "asn": 666, "as_path": " "}, "conflict_with": {"prefix": " /24", "asn": 7500}} ANSSI - Detecting BGP hijacks in /52
57 Classifying Conflicts - 1/3 Using route objects Validating a single conflict { "timestamp": , "collector": "rrc07", "announce": { "prefix": " /24 ", "asn": 666, "as_path": " "}, "conflict_with": {"prefix": " /24", "asn": 7500}} $ whois -T route /24 route: /24 descr: Example prefix origin: AS666 mnt-by: AS666-MNT ANSSI - Detecting BGP hijacks in /52
58 Classifying Conflicts - 1/3 Using route objects Validating a single conflict { "timestamp": , "collector": "rrc07", "announce": { "prefix": " /24 ", "asn": 666, "as_path": " "}, "conflict_with": {"prefix": " /24", "asn": 7500}} $ whois -T route /24 route: /24 descr: Example prefix origin: AS666 mnt-by: AS666-MNT ANSSI - Detecting BGP hijacks in /52
59 Classifying Conflicts - 1/3 Using route objects Validating 70 millions conflicts all of them must be verified online queries are too slow WHOIS databases are loaded daily into PostgreSQL the ip4r type is used for fast prefix lookups >>> client = Client("ripe") >>> client.check(" /24", 17676, "2014/07/28") True 0.01% conflicts removed 32% conflicts removed ANSSI - Detecting BGP hijacks in /52
60 Classifying Conflicts - 2/3 Using relations between AS objects $ whois AS15557 aut-num: as-name: descr: org: admin-c: tech-c: status: mnt-by: mnt-routes: mnt-routes: source: AS15557 LDCOMNET SFR ORG-LA7-RIPE LD699-RIPE LDC76-RIPE ASSIGNED LDCOM-MNT FMCF-MNT LDCOM-MNT RIPE $ whois AS41272 aut-num: as-name: descr: org: admin-c: tech-c: status: mnt-by: mnt-routes: source: AS41272 MOSELLE-TELE-AS MOSELLE TELECOM ORG-MT18-RIPE LD699-RIPE LDC76-RIPE ASSIGNED MOSELLE-TELE-MNT MOSELLE-TELE-MNT RIPE 2% conflicts removed 54% conflicts removed ANSSI - Detecting BGP hijacks in /52
61 Classifying Conflicts - 3/3 Using client/provider connectivity { "timestamp": , "announce": { "prefix": " /24", "asn": 666, "as_path": " " }, "conflict_with": {"prefix": " /16", "asn": 1000 } } ANSSI - Detecting BGP hijacks in /52
62 Classifying Conflicts - 3/3 Using client/provider connectivity { "timestamp": , "announce": { "prefix": " /24", "asn": 666, "as_path": " " }, "conflict_with": {"prefix": " /16", "asn": 1000 } } BGP / / Internet AS1000 AS666 ANSSI - Detecting BGP hijacks in /52
63 Classifying Conflicts - 3/3 Using client/provider connectivity { "timestamp": , "announce": { "prefix": " /24", "asn": 666, "as_path": " " }, "conflict_with": {"prefix": " /16", "asn": 1000 } } BGP / / Internet AS1000 AS666 Client/Provider relation 5% conflicts removed 3% conflicts removed ANSSI - Detecting BGP hijacks in /52
64 Classifying conflicts Summary Percentage of conflicts 90 % 60 % 30 % 0 % Validated Related Connected Abnormal France Japan 42 millions abnormal conflicts 8 millions abnormal conflicts ANSSI - Detecting BGP hijacks in /52
65 Computing durations From conflicts to events Time Before aggregation { "timestamp": , "collector": "rrc99", "type": "RELATION", "announce": { "prefix": " /24", "asn": 666 } "conflict_with": {"prefix": " /18", "asn": 1000 } } { "timestamp": , "collector": "rrc66", type": "RELATION", "announce": { "prefix": " /24", "asn": 666 } "conflict_with": {"prefix": " /18", "asn": 1000 } } ANSSI - Detecting BGP hijacks in /52
66 Computing durations From conflicts to events Time After aggregation { "conflict_with" : { "prefix" : " /18", "asn" : 1000 }, "origin" : { "prefix" : " /24", "asn" : 666 }, "begin": , "end" : , "peers" : [ "rrc99", "rrc66" ], "type" : "RELATION" } events events ANSSI - Detecting BGP hijacks in /52
67 Events Visualization A French AS 10/28/2014 localhost:2807/timeslots/as February March April May June July August September October No ANSSI - Detecting BGP hijacks in /52
68 Reducing The Number of Events Automatically Simple rules remove events that change categories remove events if ASes belongs to the same country remove events longer than 6 months remove associated events From 2154 prefixes in conflict to 557 From 4519 prefixes in conflict to 289 ANSSI - Detecting BGP hijacks in /52
69 Looking For Hijacks ANSSI - Detecting BGP hijacks in /52
70 Reducing The Number of Events Manually Interesting results similar AS names PACNET-MY Pacnet MY and PACNET Pacnet Global Ltd AS under DDoS protection the DDoS mitigation companies announces /24 typos in AS numbers 2208 and 208 hijacks that were used to steal bitcoins AS18863 was at the origin of some of these hijacks some events were never detected by operators... ANSSI - Detecting BGP hijacks in /52
71 Closing Remarks Since January 2014, there are: 69 suspicious events 102 suspicious events Around 10 hijacks per year target French operators ANSSI - Detecting BGP hijacks in /52
72 Real-time BGP Hijack Detection
73 Targeted Internet Traffic Misdirection Reported by Renesys on November, 2013 ANSSI - Detecting BGP hijacks in /52
74 Real-time Detection Goals Alerts BGP messages Hijacks Measurements ANSSI - Detecting BGP hijacks in /52
75 Detection Requirements Fetching Tasks Internet registries raw BGP data ANSSI - Detecting BGP hijacks in /52
76 Detection Requirements { } Fetching Tasks Internet registries raw BGP data Processing Tasks synchronise whois databases parse BGP data to JSON create IP prefix to origin AS mapping ANSSI - Detecting BGP hijacks in /52
77 BGP Hijack Reporting What must be reported only suspicious BGP hijacks about 50 events per week ANSSI - Detecting BGP hijacks in /52
78 BGP Hijack Reporting IRC is so 2014 What must be reported only suspicious BGP hijacks about 50 events per week < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) ANSSI - Detecting BGP hijacks in /52
79 BGP Hijack Troubleshooting < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) ANSSI - Detecting BGP hijacks in /52
80 BGP Hijack Troubleshooting < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) $ whois 2a04:8000::/29 inet6num: 2a04:8000::/29 netname: UA-UAHOSTING descr: Hosting Ukraine country: UA org: ORG-HUL6-RIPE ANSSI - Detecting BGP hijacks in /52
81 BGP Hijack Troubleshooting < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) $ whois 2a04:8000::/29 inet6num: 2a04:8000::/29 netname: UA-UAHOSTING descr: Hosting Ukraine country: UA org: ORG-HUL6-RIPE $ whois -i org ORG-HUL6-RIPE ANSSI - Detecting BGP hijacks in /52
82 BGP Hijack Troubleshooting < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) $ whois 2a04:8000::/29 inet6num: 2a04:8000::/29 netname: UA-UAHOSTING descr: Hosting Ukraine country: UA org: ORG-HUL6-RIPE $ whois -i org ORG-HUL6-RIPE aut-num: AS as-name: Ukraine-AS descr: Hosting Ukraine org: ORG-HUL6-RIPE ANSSI - Detecting BGP hijacks in /52
83 BGP Hijack Troubleshooting < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) $ whois 2a04:8000::/29 inet6num: 2a04:8000::/29 netname: UA-UAHOSTING descr: Hosting Ukraine country: UA org: ORG-HUL6-RIPE $ whois -i org ORG-HUL6-RIPE aut-num: AS as-name: Ukraine-AS descr: Hosting Ukraine org: ORG-HUL6-RIPE ANSSI - Detecting BGP hijacks in /52
84 BGP Hijack Troubleshooting < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) Analysis Result 2a04:8000::/29 belongs to the Ukrainian operator ANSSI - Detecting BGP hijacks in /52
85 BGP Hijack Troubleshooting < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) Analysis Result 2a04:8000::/29 belongs to the Ukrainian operator 2a04: 0 800::/29 belongs to the French operator French operator made a mistake in its BGP configuration ANSSI - Detecting BGP hijacks in /52
86 BGP Hijack Troubleshooting < hadron> 2a04:8000::/29 is announced from multiple origins: < hadron> SFR-BUSINESS-TEAM (AS12566) < hadron> Ukraine-AS (AS200000) < hadron> First originated from SFR-BUSINESS-TEAM (AS12566) Analysis Result 2a04:8000::/29 belongs to the Ukrainian operator 2a04: 0 800::/29 belongs to the French operator French operator made a mistake in its BGP configuration It was a false positive, the route6 object was created a few days later by the Ukrainian operator. ANSSI - Detecting BGP hijacks in /52
87 Malicious BGP Hijack < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) ANSSI - Detecting BGP hijacks in /52
88 Announces from September to October 2014 ANSSI - Detecting BGP hijacks in /52
89 Malicious BGP Hijack Infected AS_PATH < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: ANSSI - Detecting BGP hijacks in /52
90 Malicious BGP Hijack Infected AS_PATH < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: Definition infected ASes accepted the hijacking BGP update traffic to the hijacked prefix go to the hijacker s network ANSSI - Detecting BGP hijacks in /52
91 Malicious BGP Hijack Infected AS_PATH < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: Definition infected ASes accepted the hijacking BGP update traffic to the hijacked prefix go to the hijacker s network How do we launch active measurements from these ASes? ANSSI - Detecting BGP hijacks in /52
92 RIPE Atlas Measurement Project probes in around 2000 ASes probes hosted by the community user-defined measurements ping, traceroute, HTTP, TLS and DNS public API ANSSI - Detecting BGP hijacks in /52
93 ANSSI - Detecting BGP hijacks in /52
94 Atlas Meets Our Needs We always found a probe to launch our measurements! 250 possible hijacks from september to november 2014 AS_PATH are from the London based RIPE collector ANSSI - Detecting BGP hijacks in /52
95 Atlas Meets Our Needs We always found a probe to launch our measurements! 250 possible hijacks from september to november 2014 AS_PATH are from the London based RIPE collector Number of probes found in infected ASes: 20 % Hijacks 15 % 10 % 5 % 0 % Num of probes ANSSI - Detecting BGP hijacks in /52
96 Traceroute Example < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: ANSSI - Detecting BGP hijacks in /52
97 Traceroute Example < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: ANSSI - Detecting BGP hijacks in /52
98 Traceroute Example < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: Traceroute to ANSSI - Detecting BGP hijacks in /52
99 Traceroute Example < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: Traceroute to ANSSI - Detecting BGP hijacks in /52
100 Traceroute Example < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: * * * ANSSI - Detecting BGP hijacks in /52
101 Traceroute Example < hadron> /22 is announced from multiple origins: < hadron> ALPHALINK-AS (AS25540) < hadron> TEHNOGRUP (AS198596) < hadron> AS_PATH: Closing Remarks traceroute stops at AS44050 (PIN-AS) AS and AS are most certainly placeholders AS44050 (PIN-AS) is already known for previous hijacks ANSSI - Detecting BGP hijacks in /52
102 Conclusion
103 Conclusion wide scale BGP hijacks automatic detection only a few real hijacks per year regarding France and Japan early detection and reporting on-going work to identify traffic redirection Take away messages 1. packets can be redirected on the Internet 2. traffic must be encrypted and authenticated 3. monitor prefixes and be ready to send more specific ones 4. networking Best Current Practices must be enforced ANSSI - Detecting BGP hijacks in /52
104 Questions? A question == A Japanese Kit Kat Related publication BGP configuration best practices (English & French) ANSSI - Detecting BGP hijacks in /52
Routing Security Training Course
Routing Security Training Course Exercise Booklet November 2015 Introduction Your database objects For your convenience we have already created some objects in the RIPE TEST Database. You can use these
IPv6 and IPv4 Update from the RIPE NCC. Sandra Brás, Ferenc Csorba
IPv6 and IPv4 Update from the RIPE NCC Sandra Brás, Ferenc Csorba RIPE NCC IPv6 Kongress - Frankfurt 22 May 2014 Schedule IPv6 Kongress 2 RIPE/RIPE NCC. Who are we? IPv4 exhaustion IPv4 transfers IPv6
BREAKING HTTPS WITH BGP HIJACKING. Artyom Gavrichenkov R&D Team Lead, Qrator Labs [email protected]
BREAKING HTTPS WITH BGP HIJACKING Artyom Gavrichenkov R&D Team Lead, Qrator Labs [email protected] ABSTRACT OVERVIEW OF BGP HIJACKING GLOBAL AND LOCAL HIJACKING HIJACKING A CERTIFICATE AUTHORITY MITIGATIONS
How To Get An Ipv6 Allocation On Ipv4 (Ipv4) From Ipv5) From The Ipvripe Ncc (Ip6) From A Ipvv6 Ipv2 (Ip4) To Ip
What s hot at the RIPE NCC PLNOG6, March 2011 Sandra Brás Trainer, RIPE NCC [email protected] Hot topics - overview The registry system IPv4 depletion IPv6 policy update Independent resources 2 The five RIRs
Monitoring BGP and Route Leaks using OpenBMP and Apache Kafka
Monitoring BGP and Route Leaks using OpenBMP and Apache Kafka Tim Evens ([email protected]) NANOG-65 Traditional Method: VTY (cli/netconf/xml) Data is polled instead of pushed (not real-time) Large queries
Outline. Outline. Outline
Network Forensics: Network Prefix Scott Hand September 30 th, 2011 1 What is network forensics? 2 What areas will we focus on today? Basics Some Techniques What is it? OS fingerprinting aims to gather
BGP route monitoring. Mar, 25, 2008 Matsuzaki maz Yoshinobu <[email protected]>, <[email protected]>
BGP route monitoring Mar, 25, 2008 Matsuzaki maz Yoshinobu , 1 abstract BGP prefix hijack is a serious security issue in the internet, and these events have been widely
Network provider filter lab
Network provider filter lab Olof Hagsand Pehr Söderman KTH CSC Group Nr Name 1 Name 2 Name 3 Name 4 Date Instructor s Signature Table of Contents 1 Goals...3 2 Introduction...3 3 Preparations...3 4 Lab
Policy-Based AS Path Verification with Enhanced Comparison Algorithm to Prevent 1-Hop AS Path Hijacking in Real Time
, pp.11-22 http://dx.doi.org/10.14257/ijmue.2016.11.1.02 Policy-Based AS Path Verification with Enhanced Comparison Algorithm to Prevent 1-Hop AS Path Hijacking in Real Time Je-Kuk Yun 1 and Jin-Hee Song
Evangelos Kranakis, School of Computer Science, Carleton University, Ottawa 1. Network Security. Canada France Meeting on Security, Dec 06-08
Evangelos Kranakis, School of Computer Science, Carleton University, Ottawa 1 Network Security Evangelos Kranakis, School of Computer Science, Carleton University, Ottawa 2 Collaboration with Frank Akujobi
Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
BGP Techniques for Internet Service Providers
BGP Techniques for Internet Service Providers Philip Smith AfNOG 2011 Dar Es Salaam, Tanzania 5 June 2011 AfNOG 2011 1 Presentation Slides Will be available on ftp://ftp-eng.cisco.com /pfs/seminars/afnog2011-bgp-techniques.pdf
Layer Four Traceroute (and related tools) A modern, flexible path-discovery solution with advanced features for network (reverse) engineers
Layer Four Traceroute (and related tools) A modern, flexible path-discovery solution with advanced features for network (reverse) engineers So, what is path discovery and why is it important? Path discovery
BGP Prefix Hijack: An Empirical Investigation of a Theoretical Effect Masters Project
BGP Prefix Hijack: An Empirical Investigation of a Theoretical Effect Masters Project Advisor: Sharon Goldberg Adam Udi 1 Introduction Interdomain routing, the primary method of communication on the internet,
We Recommend: Click here to increase PC Speed! URL Decode Lookup. Express. DNS Records (Advanced Tool) URL Encode Trace.
Manage Microsoft Windows - Streamline Wind and Management. Free 30-day Trial www.systemtools. 212.21.112.177 has not accessed this page recently We Recommend: Click here to increase PC Speed! Ping Express
How To Stop A Ddos Attack On A Network From Tracing To Source From A Network To A Source Address
Inter-provider Coordination for Real-Time Tracebacks Kathleen M. Moriarty 2 June 2003 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations, conclusions, and
Network Level Multihoming and BGP Challenges
Network Level Multihoming and BGP Challenges Li Jia Helsinki University of Technology [email protected] Abstract Multihoming has been traditionally employed by enterprises and ISPs to improve network connectivity.
On Characterizing BGP Routing Table Growth Tian Bu, Lixin Gao, and Don Towsley University of Massachusetts, Amherst, MA 01003
On Characterizing BGP Routing Table Growth Tian Bu, Lixin Gao, and Don Towsley University of Massachusetts, Amherst, MA 0003 Abstract The sizes of the BGP routing tables have increased by an order of magnitude
Inter-domain Routing. Outline. Border Gateway Protocol
Inter-domain Routing Outline Border Gateway Protocol Internet Structure Original idea Backbone service provider Consumer ISP Large corporation Consumer ISP Small corporation Consumer ISP Consumer ISP Small
Exterior Gateway Protocols (BGP)
Exterior Gateway Protocols (BGP) Internet Structure Large ISP Large ISP Stub Dial-Up ISP Small ISP Stub Stub Stub Autonomous Systems (AS) Internet is not a single network! The Internet is a collection
Fireware How To Dynamic Routing
Fireware How To Dynamic Routing How do I configure my Firebox to use BGP? Introduction A routing protocol is the language a router speaks with other routers to share information about the status of network
RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks. Kathleen M. Moriarty. MIT Lincoln Laboratory.
: Real-time Inter-network Defense Against Denial of Service Attacks Kathleen M. Moriarty 22 October 2002 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations,
AWS Direct Connect. User Guide API Version 2013-10-22
AWS Direct Connect User Guide AWS Direct Connect: User Guide AWS Direct Connect User Guide Table of Contents What is AWS Direct Connect?... 1 Requirements... 1 How Do I...?... 2 Getting Started... 3 Getting
Arbor s Solution for ISP
Arbor s Solution for ISP Recent Attack Cases DDoS is an Exploding & Evolving Trend More Attack Motivations Geopolitical Burma taken offline by DDOS attack Protests Extortion Visa, PayPal, and MasterCard
Troubleshooting Network Performance with Alpine
Troubleshooting Network Performance with Alpine Jeffrey Papen As a Network Engineer, I am often annoyed by slow Internet performance caused by network issues like congestion, fiber cuts, and packet loss.
19531 - Telematics. 14th Tutorial - Proxies, Firewalls, P2P
19531 - Telematics 14th Tutorial - Proxies, Firewalls, P2P Bastian Blywis Department of Mathematics and Computer Science Institute of Computer Science 10. February, 2011 Institute of Computer Science Telematics
RIPE Network Coordination Centre RIPE NCC LIR Tutorial
RIPE NCC LIR Tutorial Alex Band, RIPE NCC The Internet Registry (IR) system Getting resources RIPE Database 2 What is an LIR? Local Internet Registry - responsible for obtaining, distributing and registering
CS 356 Lecture 16 Denial of Service. Spring 2013
CS 356 Lecture 16 Denial of Service Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter
BGP FORGOTTEN BUT USEFUL FEATURES. Piotr Wojciechowski (CCIE #25543)
BGP FORGOTTEN BUT USEFUL FEATURES Piotr Wojciechowski (CCIE #25543) ABOUT ME Senior Network Engineer MSO at VeriFone Inc. Previously Network Solutions Architect at one of top polish IT integrators CCIE
Visualizing Traffic on Network Topology
Visualizing Traffic on Network Topology NTT Communications, Kazunori Kamiya NTT Laboratories, Hiroshi Kurakami Agenda Company Introduction Motivation and Goals Things to consider Method of visualizing
JUNOS Secure BGP Template
JUNOS Secure BGP Template Version 1.92, 03/30/2005 Stephen Gill E-mail: [email protected] Published: 04/25/2001 Contents Credits... 2 Introduction... 2 Template... 4 References... 10 Credits Rob Thomas
Acquia Cloud Edge Protect Powered by CloudFlare
Acquia Cloud Edge Protect Powered by CloudFlare Denial-of-service (DoS) Attacks Are on the Rise and Have Evolved into Complex and Overwhelming Security Challenges TECHNICAL GUIDE TABLE OF CONTENTS Introduction....
Introduction to Routing
Introduction to Routing How traffic flows on the Internet Philip Smith [email protected] RIPE NCC Regional Meeting, Moscow, 16-18 18 June 2004 1 Abstract Presentation introduces some of the terminologies used,
Cisco IOS Flexible NetFlow Technology
Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application
Supporting Notes for the Provider Independent (PI) Assignment Request Form
Supporting Notes for the Provider Independent (PI) Assignment Request Form RIPE NCC Document-ID: ripe-491 Date: March 2009 Obsoletes: ripe-337,ripe-357, ripe-454, ripe-455 This document contains instructions
CloudFlare advanced DDoS protection
CloudFlare advanced DDoS protection Denial-of-service (DoS) attacks are on the rise and have evolved into complex and overwhelming security challenges. 1 888 99 FLARE [email protected] www.cloudflare.com
BGP Operations and Security. Training Course
BGP Operations and Security Training Course Training Services RIPE NCC April 2016 Schedule 09:00-09:30 11:00-11:15 13:00-14:00 15:30-15:45 17:30 Coffee, Tea Break Lunch Break End BGP Operations and Security
pmacct: introducing BGP natively into a NetFlow/sFlow collector
pmacct: introducing BGP natively into a NetFlow/sFlow collector Paolo Lucente the pmacct project AS286 http://www.pmacct.net/ SwiNOG #19 meeting, Berne, 29 th Sep 2009 pmacct:
Measurement Study on the Internet reachability. 3.1 Introduction. 3. Internet Backbone
3. Measurement Study on the Internet reachability Internet reachability can be assessed using control-plane and data-plane measurements. However, there are biases in the results of these two measurement
Outline. CSc 466/566. Computer Security. 18 : Network Security Introduction. Network Topology. Network Topology. Christian Collberg
Outline Network Topology CSc 466/566 Computer Security 18 : Network Security Introduction Version: 2012/05/03 13:59:29 Department of Computer Science University of Arizona [email protected] Copyright
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology Project Proposal 1 Project Proposal 2 Abstract Honeypot systems are readily used by organizations large and
Global Network Mobility RIPE 48
John Bender Don Bowman [email protected] Global Network Mobility RIPE 48 Implementing Network Mobility Summary What is Connexion by Boeing? Network and Service Challenges BGP as a mobility solution
MPLS WAN Explorer. Enterprise Network Management Visibility through the MPLS VPN Cloud
MPLS WAN Explorer Enterprise Network Management Visibility through the MPLS VPN Cloud Executive Summary Increasing numbers of enterprises are outsourcing their backbone WAN routing to MPLS VPN service
APNIC elearning: BGP Basics. Contact: [email protected]. erou03_v1.0
erou03_v1.0 APNIC elearning: BGP Basics Contact: [email protected] Overview What is BGP? BGP Features Path Vector Routing Protocol Peering and Transit BGP General Operation BGP Terminology BGP Attributes
Bell Aliant. Business Internet Border Gateway Protocol Policy and Features Guidelines
Bell Aliant Business Internet Border Gateway Protocol Policy and Features Guidelines Effective 05/30/2006, Updated 1/30/2015 BGP Policy and Features Guidelines 1 Bell Aliant BGP Features Bell Aliant offers
Approaches for DDoS an ISP Perspective. [email protected] [email protected]
Approaches for DDoS an ISP Perspective [email protected] [email protected] Home School How everyone starts It s all up to you It s inexpensive (compared to other forms of education) Quality may not
Border Gateway Protocol BGP4 (2)
Border Gateway Protocol BGP4 (2) Professor Richard Harris School of Engineering and Advanced Technology (SEAT) Presentation Outline Border Gateway Protocol - Continued Computer Networks - 1/2 Learning
Decoding DNS data. Using DNS traffic analysis to identify cyber security threats, server misconfigurations and software bugs
Decoding DNS data Using DNS traffic analysis to identify cyber security threats, server misconfigurations and software bugs The Domain Name System (DNS) is a core component of the Internet infrastructure,
How To Block A Ddos Attack On A Network With A Firewall
A Prolexic White Paper Firewalls: Limitations When Applied to DDoS Protection Introduction Firewalls are often used to restrict certain protocols during normal network situations and when Distributed Denial
APNIC IPv6 Deployment
APNIC IPv6 Deployment Ulaanbaatar, Mongolia 19 October 2015 Issue Date: Revision: Overview Deployment motivation Network deployment IPv6 Services deployment IPv6 Anycast service IPv6 Cloud service Summary
ETHEL THE AARDVARK GOES BGP ROUTING
Fable Of Contents ISP TECH TALK by Avi Freedman ETHEL THE AARDVARK GOES BGP ROUTING In this exciting column we'll actually walk through configuring a Cisco router for BGP. It's very important, however,
Quality Certificate for Kaspersky DDoS Prevention Software
Quality Certificate for Kaspersky DDoS Prevention Software Quality Certificate for Kaspersky DDoS Prevention Software Table of Contents Definitions 3 1. Conditions of software operability 4 2. General
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump www.enisa.europa.eu Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo www.enisa.europa.eu 2 What is Netflow Netflow = Netflow
BGP Routing. Course Description. Students Will Learn. Target Audience. Hands-On
Hands-On Course Description This Hands-On course on (Border Gateway Protocol), from the basics of how it works through to advanced issues such as route reflectors, policy, filtering, route selection and
Ref: A. Leon Garcia and I. Widjaja, Communication Networks, 2 nd Ed. McGraw Hill, 2006 Latest update of this lecture was on 16 10 2010
IPv4 Addressing There are several non-profit organizations in the world that have the authority for assigning IP addresses to institutions that need access to the Internet. These organizations are (for
The syslog-ng Store Box 3 F2
The syslog-ng Store Box 3 F2 PRODUCT DESCRIPTION Copyright 2000-2014 BalaBit IT Security All rights reserved. www.balabit.com Introduction The syslog-ng Store Box (SSB) is a high-reliability and high-performance
Internet Routing Protocols Lecture 04 BGP Continued
Internet Routing Protocols Lecture 04 BGP Continued Advanced Systems Topics Lent Term, 008 Timothy G. Griffin Computer Lab Cambridge UK Two Types of BGP Sessions AS External Neighbor (EBGP) in a different
Passively Detecting Remote Connectivity Issues Using Flow Accounting. 2nd EMANICS Workshop on Netflow/IPFIX usage in network management
Passively Detecting Remote Connectivity Issues Using Flow Accounting 2nd EMANICS Workshop on Netflow/IPFIX usage in network management 08.10.2009 Jacobs University Bremen, Germany Tim Kleefass, Simon Leinen
How NOC manages and controls inter-domain traffic? 5 th tf-noc meeting, Dubrovnik [email protected]
How NOC manages and controls inter-domain traffic? 5 th tf-noc meeting, Dubrovnik [email protected] Agenda Inter-domain traffic: o how does NOC monitor and control it? Common case as example: new BGP
KASPERSKY DDOS PROTECTION. Discover how Kaspersky Lab defends businesses against DDoS attacks
KASPERSKY DDOS PROTECTION Discover how Kaspersky Lab defends businesses against DDoS attacks CYBERCRIMINALS ARE TARGETING BUSINESSES If your business has ever suffered a Distributed Denial of Service (DDoS)
IPv6 Addressing. ISP Training Workshops
IPv6 Addressing ISP Training Workshops 1 Where to get IPv6 addresses p Your upstream ISP p Africa n AfriNIC http://www.afrinic.net p Asia and the Pacific n APNIC http://www.apnic.net p North America n
Outline. The Problem BGP/Routing Information. Netflow/Traffic Information. Conclusions
Outline The Problem BGP/Routing Information BGP-Inspect Information Extraction from BGP Update messages VAST Internet AS topology Visualization Netflow/Traffic Information Flamingo Internet Traffic Exploration
CS2107 Introduction to Information and System Security (Slid. (Slide set 8)
Networks, the Internet Tool support CS2107 Introduction to Information and System Security (Slide set 8) National University of Singapore School of Computing July, 2015 CS2107 Introduction to Information
Examination. IP routning på Internet och andra sammansatta nät, DD2491 IP routing in the Internet and other complex networks, DD2491
Examination IP routning på Internet och andra sammansatta nät, DD2491 IP routing in the Internet and other complex networks, DD2491 Date: December 15 2009 14:00 18:00 1. No help material is allowed - You
What network engineers can learn from web developers when thinking SDN.
What network engineers can learn from web developers when thinking SDN. NETNOD Meeting October 2015 Thomas Mangin Director at various shops ( Exa Networks, IXLeeds, LINX ) Also Developer, Network Engineer,
Table of Contents. Cisco Configuring a Basic MPLS VPN
Table of Contents Configuring a Basic MPLS VPN...1 Introduction...1 Prerequisites...1 Requirements...1 Components Used...2 Related Products...2 Conventions...2 Configure...3 Network Diagram...3 Configuration
DDoS Overview and Incident Response Guide. July 2014
DDoS Overview and Incident Response Guide July 2014 Contents 1. Target Audience... 2 2. Introduction... 2 3. The Growing DDoS Problem... 2 4. DDoS Attack Categories... 4 5. DDoS Mitigation... 5 1 1. Target
IXP Manager Workshop. 27 th Euro-IX Forum October 25 th 2015 Berlin, Germany
IXP Manager Workshop 27 th Euro-IX Forum October 25 th 2015 Berlin, Germany Barry O Donovan & Nick Hilliard, INEX Ireland s Internet Neutral Exchange Point [email protected] What is IXP Manager? Full
70-642 R4: Configuring Windows Server 2008 Network Infrastructure
70-642 R4: Configuring Windows Server 2008 Network Infrastructure Course Introduction Chapter 01 - Understanding and Configuring IP Lesson: Introducing the OSI Model Understanding the Network Layers OSI
Based on Computer Networking, 4 th Edition by Kurose and Ross
Computer Networks Internet Routing Based on Computer Networking, 4 th Edition by Kurose and Ross Intra-AS Routing Also known as Interior Gateway Protocols (IGP) Most common Intra-AS routing protocols:
The OpenDNS Global Network Delivers a Secure Connection Every Time. Everywhere.
The OpenDNS Global Network Delivers a Secure Connection Every Time. Everywhere. Network Performance Users devices create multiple simultaneous connections each time we exchange data with other Internet
Towards a Next- Generation Inter-domain Routing Protocol. L. Subramanian, M. Caesar, C.T. Ee, M. Handley, Z. Mao, S. Shenker, and I.
Towards a Next- Generation Inter-domain Routing Protocol L. Subramanian, M. Caesar, C.T. Ee, M. Handley, Z. Mao, S. Shenker, and I. Stoica Routing 1999 Internet Map Coloured by ISP Source: Bill Cheswick,
Service Description DDoS Mitigation Service
Service Description DDoS Mitigation Service Interoute, Walbrook Building, 195 Marsh Wall, London, E14 9SG, UK Tel: +800 4683 7681 Email: [email protected] Contents Contents 1 Introduction...3 2 An Overview...3
Multihoming and Multi-path Routing. CS 7260 Nick Feamster January 29. 2007
Multihoming and Multi-path Routing CS 7260 Nick Feamster January 29. 2007 Today s Topic IP-Based Multihoming What is it? What problem is it solving? (Why multihome?) How is it implemented today (in IP)?
DEFENSE NETWORK FAQS DATA SHEET
DATA SHEET VERISIGN INTERNET DEFENSE NETWORK FAQS WHAT IS A DOS OR DDOS ATTACK? A Denial of Service attack or Distributed Denial of Service attack occurs when a single host (DoS), or multiple hosts (DDoS),
Federated Threat Data Sharing with the Collective Intelligence Framework (CIF)
Federated Threat Data Sharing with the Collective Intelligence Framework (CIF) Gabriel Iovino (REN-ISAC), Kevin Benton (REN-ISAC), Yoshiaki Kasahara (Kyushu University), Yasuichi Kitamura (APAN) TIP2013