Subject: RE: [RPSEC] Topic 9: Section 4.10 Network Mapping Threat

From: "Reddington, Thomas B (Tom)" <[email-masked]>
Date: Sun, 16 Mar 2003 21:42:14 -0500

> I would say that there's a difference between reachability 
> information and
> topology information. I might have 1000 subnets, but if I 
> advertise them
> all as one large aggregate, then block pings and traceroutes, and most
> other icmp into my network that could be used for mapping it 
> out in any
> way, I've hidden my topology pretty effectively.

NO. You must block all outgoing ICMP (ttl and probably others if I thought) of all 1000 subnets to be effective. If you do this, what does it do to your management operations and partnerships? Aggregation does nothing for you. I can still devine your internal structure.

There are also ways to gerenate network topology from reachability (traceroute) information. 

> 
> And there may be reasons for me to want to do this--for 
> instance, I might
> not want people to find out what my broadcast addresses are, 
> to prevent
> various sorts of DOS attacks.
> 
> Discovering topology information isn't an attack, it's a 
> threat, possibly,
> a prelude to other possible attacks. At least it seems to me 
> that it might
> be valuable information that some networks may want to hide 
> for various
> reasons.
> 
 This is valuable information that any network would want to hide for security reasons. It is a precursor to an attack whether it be delayed or immediate or covert or overt.

> :-)
> 
> Russ
> 
>
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/rpsec
> 
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Sun, 16 Mar 2003 22:56:29 -0500 (EST)

My point, in general, though, is that it is possible to obsfucate your
internal structure, through various means.... This is, as agree, valuable
information, so it appears to be a threat, even if the routing protocol
can't do anything about the threat. Whether or not it's a specific routing
protocol threat is another issue.

Anyway, the question originall was: Is it an attack to, through some means,
block the advertisment of a given prefix, which then prevents someone from
reaching a legitimate destination. It still seems to me that it could be.

:-)

Russ

> > https://www1.ietf.org/mailman/listinfo/rpsec

__________________________________
[email-masked] CCIE <>< Grace Alone