Best Practice Detail

13-8-8525

Network Operators and Service Providers should apply the same filtering methods used in NRIC BP 8043 more aggressively to stop the attack if the routing table is under attack from malicious BGP updates. When under attack, the attack vector is usually known and the performance impacts of the filter are less of an issue than when preventing an attack. The malicious routes will expire from the table, be replaced by legitimate updates, or in emergencies, can be manually deleted from the tables. Contact peering partner to coordinate response to attack.

Status: Rollover New

References/Comments: RIPE-181, "A Route-Filtering Model for Improving Global Internet Routing Robustness" www.iops.org/Documents/routing.html.

Historical events:

• Network Operators
• Internet/Data
• Cyber Security
• Network Elements
• Network Operations
• CSRIC VII: Rollover New In CSRIC VII