Better visibility into packet-dropping decisions

Posted Feb 27, 2022 23:43 UTC (Sun) by amarao (guest, #87073)
Parent article: Better visibility into packet-dropping decisions

Md5 for TCP is really a single good protection against RST attacks on BGP. You can filter ingress, but there always is a risk to miss something. Having MD allow to have month-long tcp session without risks of malicious rst.

Better visibility into packet-dropping decisions

Posted Mar 2, 2022 3:25 UTC (Wed) by MaZe (subscriber, #53908) [Link] (2 responses)

eh, most uses of tcp md5 are pretty pointless because they just use well known passwords...

Better visibility into packet-dropping decisions

Posted Mar 2, 2022 9:58 UTC (Wed) by amarao (guest, #87073) [Link]

I do understand you. When a new session is agreed with a party, a password is provided together with IP and AS number. Even md5 is considered hopelessly broken, for the sake of RST protection it is more than enough, because even 32 additional bits pushes attack from `feasible` to `unfeasible` realm.

Better visibility into packet-dropping decisions

Posted Jul 7, 2022 6:48 UTC (Thu) by gdt (subscriber, #6284) [Link]

Even using a silly MD5 password is worthwhile, since the spray of failed MD5 packets (and thus log messages) prior to the BGP connection reset make it plain that the cause is network abuse.
Cynically, if the BGP connection isn't using a long, random, unique key prior to that outage, then it will be afterwards :-)

Linux counting failed MD5 packets is excellent, as network operators investigating BGP connection issues can check that the counter is the expected zero.

For the longest time vendors were promoting IPsec as the replacement for the TCP MD5 option, but operationally the overhead of configuration and customer education was too high. More recently TCP-AO (Authentication Option) offers a similar mechanism to the MD5 option, but with modern cyrptographic algorithms.

For external BGP connections the TTL security check also offers good protection from network abuse. Customers generally seem to be able to configure that without much difficulty.