Internet routing security: RPKI, route leaks, incident response
You reproduce route hijacks and leaks between lab ASes, prevent them with RPKI and filtering, and learn from real-world incidents.
Level 501 · 16 lessons · 15 practice labs
Lessons
Threats
- How prefix hijacks work: the more-specific prefix
- Route leaks and the valley-free rule
- Lessons from real incidents: global outage examples
- Short task: reproduce a hijack in the lab and measure its impact
RPKI
- RPKI: ROAs and route origin validation
- Running a validator and connecting it to routers over RTR
- Dropping invalid routes
- ASPA and BGPsec: towards validating the path
- Short task: turn on route origin validation in your network
Operational security
- Generating filters from IRR data (bgpq4)
- Global good practice: filtering, anti-spoofing, coordination
- BGP anomaly monitoring and alerting
- RTBH and FlowSpec against DDoS
- Blocking spoofed sources: BCP 38 and uRPF
- Short task: announce a blackhole for an address under attack
Wrap-up
- Capstone: respond to a route hijack and write the report
Practice labs
- A more-specific prefix stole the traffic: Show with traceroute and the BGP table where traffic goes because another AS in the lab topology announces a more-specific prefix, and list the affected addresses.
- A customer AS became transit: Find the customer AS re-announcing routes between its two providers, stop the leak that breaks the valley-free rule with a filter and show the paths returning to normal.
- Tell the hijack story with a timeline: From lab BGP logs and routing-table dumps, work out when a prefix hijack started, how it spread and when it ended, and produce a timeline showing the affected ASes.
- Is this route valid?: Query the local validator to classify given prefix and origin-AS pairs as valid, invalid or unknown, and explain each with the ROAs.
- The router cannot see the validator: Find why the RTR session between router and validator will not come up, fix it and show routes marked with their RPKI state.
- Your own ROA dropped your route: Find the maxLength mistake making Pinecrest Bank’s newly announced sub-prefix invalid, fix the test ROA and show the route back while the drop-invalid policy stays on.
- Generate the customer filter from IRR data: Generate a prefix list for a customer AS-set from the lab IRR data, apply it to the router and show disallowed prefixes being rejected.
- Private addresses arriving from outside: Build an inbound filter on the provider session removing private and reserved address blocks, and show the test announcements being dropped.
- Stale filters: refresh them automatically: Write a small script that regenerates customer filters when IRR data changes, shows the diff and applies only after approval, and show it working on a test change.
- The blackhole announcement has no effect: Find why the blackhole announcement for the lab load-test target is not applied at the provider (missing community, prefix-length filter), fix it and show the traffic dropping there.
- Stop spoofed sources at the edge: Turn on uRPF or equivalent source filtering on the customer interface, and show spoofed test packets dropping while legitimate traffic passes.
- Cut only the attack traffic: Announce a FlowSpec rule dropping only the port and protocol used by the lab load test, and show by measurement that normal traffic to the same target is unaffected.
- Alert when the origin AS changes: Write a small script that reads the router’s BGP table regularly and alerts when a watched prefix changes origin AS, and trigger it with the lab test hijack.
- Contain the leak in the first ten minutes: Detect a route leak starting in the lab, limit its effect with filters and more-specific announcements in your own network, and log every step with its time.
- Leak post-mortem: who, when, how: Rebuild from the records a lab route leak that began with a customer’s misconfiguration and diverted Caravan Travel’s traffic, write a short report on root cause, impact and lasting fixes, and apply the fixes.
About this course
You reproduce route hijacks and leaks between lab ASes, prevent them with RPKI and filtering, and learn from real-world incidents.
What you will learn
- Threats
- RPKI
- Operational security
- Wrap-up
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.