Remote Trigger Black Hole Filtering
Remotely Triggered Blackhole Filtering We will use BGP to trigger a network wide response to an attack A simple static route and BGP will enable a network-wide destination address blackhole as fast as iBGP can update the network This provides a tool that can be used to respond to security related events and forms a foundation for other remote triggered uses Often referred to as RTBH Step 1: Prepare All the Routers with Trigger Select a small block that will not be used for anything other than blackhole filtering; test Net (192.0.2.0/24) is optimal since it should not be in use Put a static route with a /32 from Test-Net—192.0.2.0/24 to Null 0 on every edge router on the network ip route 192.0.2.1 255.255.255.255 Null0 Step 2: Prepare the Trigger Router The Trigger Router Is the Device That Will Inject the iBGP Announcement into the ISP’s Network Should be part of the iBGP mesh—but does not have to accept routes Can be a separate...