Attacks on BGP Routing Ranges

• Previous message (by thread): US-CERT: Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices
• Next message (by thread): Attacks on BGP Routing Ranges
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello,

I wanted to poll everyones thoughts on how to deal with attacks directly on BGP peering ranges (/30's, /127's).

I know that sending an RTBH for our side of the upstream routing range does not resolve the issue, and it would actually make things worse by blackholing all inbound traffic on the carrier I send the null to. What are my options for carriers that are not willing to help investigate the situation or write up a firewall rule to mitigate it on the circuit? I am not a fan of naming and shaming because it has unintended consequences.

Thanks in advance for everyone's suggestions.

Ryan Hamel

• Previous message (by thread): US-CERT: Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices
• Next message (by thread): Attacks on BGP Routing Ranges
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]