BGP hijacking mitigations
BGP hijacking remains a critical threat to global internet routing. Below are practical mitigations, focusing on RPKI, BGPsec, real-time monitoring, and ISP cooperation.
Technique | Effectiveness | Deployment difficulty |
---|---|---|
RPKI (ROAs) | High (origin validation) | Medium (RIR coordination) |
BGPsec | Very High (path validation) | Low (limited support) |
Prefix Filtering (IRR) | Medium | Easy (manual effort) |
BGP Monitoring (ARTEMIS) | High (auto-mitigation) | Medium (setup required) |
MANRS Compliance | High (industry cooperation) | Medium (policy change) |
Deploy RPKI (Resource Public Key Infrastructure)
RPKI cryptographically validates that an AS (Autonomous System) is authorized to announce specific IP prefixes. How to Implement RPKI
For Network Operators (AS Owners)
Create ROAs (Route Origin Authorizations)
Use a RIR portal (ARIN, RIPE, APNIC) to authorize the prefixes.
Example (RIPE NCC):
Prefix: 192.0.2.0/24
Max Length: 24
ASN: AS12345
Publish ROAs in the RPKI repository to ensure global validation.
For ISPs & transit providers
Enable RPKI Validation on BGP Routers
Cisco IOS-XR:
router bgp 65000
rpki server 203.0.113.1
port 323
address-family ipv4 unicast
rpki origin-as validation enable
BIRD (Linux):
roa4 table r4;
protocol rpki {
roa4 { table r4; };
remote "203.0.113.1" port 323;
}
protocol bgp {
ipv4 {
import where roa_check(r4, net, bgp_path.last) = ROA_VALID;
};
}
FRRouting (RPKI-Validator):
rpki
rpki cache 203.0.113.1 323
!
address-family ipv4 unicast
rpki validation
Limitations of RPKI:
Does not prevent path hijacks (only origin validation).
Adoption is still incomplete (~40% of routes are RPKI-validated as of 2024).
Use BGPsec (Path Validation)
BGPsec extends RPKI to validate the entire AS path (not just origin).
Currently limited support (Cisco, Juniper, BIRD).
Requires all ASes in the path to support it (rare in practice).
Example (Cisco IOS-XR):
router bgp 65000
bgpsec
address-family ipv4 unicast
bgpsec enable
Implement Prefix Filtering & IRR (Internet Routing Registry)
Filter invalid prefixes at peering edges.
Use IRRDB (Internet Routing Registry Database) to automate filtering.
Example (BGP Peering Filter):
ip prefix-list PL_ACCEPTED_ROUTES seq 10 permit 192.0.2.0/24 le 24
route-map RM_PEER_IN permit 10
match ip address prefix-list PL_ACCEPTED_ROUTES
!
router bgp 65000
neighbor 203.0.113.2 route-map RM_PEER_IN in
Monitor BGP in Real-Time
BGP Monitoring Tools
Tool | Purpose |
---|---|
BGPStream (RIS/Live) | Detects hijacks in real-time. |
ARTEMIS (NVIDIA) | Automated hijack mitigation. |
Cloudflare Radar | Tracks routing anomalies. |
RIPE Stat | Historical BGP data. |
Detect Anomalies via RTT & TTL
Round-Trip Time (RTT) changes → Possible hijack.
Unexpected TTL jumps → Suspicious path alteration.
Script Example (Python + scapy):
from scapy.all import *
def detect_ttl_anomaly(pkt):
if IP in pkt and pkt[IP].ttl != expected_ttl:
print(f"TTL anomaly detected from {pkt[IP].src}")
sniff(filter="ip", prn=detect_ttl_anomaly)
Collaborate with MANRS (Mutually Agreed Norms for Routing Security)
Join MANRS to:
Commit to anti-spoofing filters.
Enable RPKI validation.
Share real-time incident reports.
Deploy automated mitigation
ARTEMIS (Open-Source)
Automatically withdraws hijacked routes.
Integrates with RPKI/IRRDB.
Cloudflare magic transit
Dynamically reroutes traffic during hijacks.
ISP best practices
For Large ISPs:
Mandate RPKI for all customers.
Filter invalid prefixes at edges.
For Small ISPs:
At least implement prefix-lists (manual IRR filtering).
Patch BGP routers (e.g., Junos, IOS vulnerabilities).