Subject: [RPSEC] changing the next hop

From: Iljitsch van Beijnum <[email-masked]>
Date: Sat, 9 Nov 2002 00:05:57 +0100 (CET)

I'm not sure of anyone thought of this attack before:

When connected to an internet exchange, network A announces a route
(which is probably a bogus route, but it may be a route that A can
rightfully announce) with a next hop address pointing to a router from
network B.

I'll spare this public forum the details, but I think this seemingly not
very serious attack mode can be used to do some real harm if A peers
with a good number of networks with very bad filtering. Note that B
can't do anything to protect itself against this in principle, but it
would be possible to remove the "real harm" part if and when this
happens. Also note that this attack must be launched from a router
connected to the exchange.

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Randy Bush <[email-masked]>
Date: Sat, 09 Nov 2002 09:45:36 -0800

> rightfully announce) with a next hop address pointing to a router from

old, old, old.  e.g. see nanog from about '96, when i turned off a
peer for doing so and they whined, screamed, lied, huffed, bluffed,
...

randy