BGP Vortex: Update Message Floods Can Create Internet Instabilities
summary
Shows a concrete exploit where three BGP UPDATE messages using standard BGP Communities (a local-preference-lowering and a do-not-forward tag) forces three ASes into perpetual route oscillation, causing widespread update floods and router overload. Experiments trigger 340 viable BGP vortices among 20 major providers, produce 5,000–32,000 updates/s in median, and delay data-plane recovery by 30–40s; Cisco IOS XR, FRR and BIRD all oscillate. Mitigation: disallow communities that violate Gao‑Rexford preference rules.
AI-written summary · about
chapters (9)
- 0:00Welcome
- 1:34Routing instabilities explained
- 3:01Border Gateway Protocol fundamentals
- 6:14BGP communities and traffic engineering
- 8:20BGP vortex attack
- 13:18Measuring BGP vortex prevalence
- 15:29Impact on route convergence
- 18:41Mitigations against BGP vortices
- 20:28Conclusion
related talks
35mRoute to Bugs: Analyzing the Security of BGP Message Parsing
21mStealth BGP Hijacks with uRPF Filtering
12mxBGP: Faster Innovation in Routing Protocols
13mHow the BGP Protocol Makes the Internet Work — and Could Make It Disappear
29mUsing the Internet as Your Load-Balancer
11mRunning BGP in Data Centers at Scale
32mLet's talk about routing security
34mHow We Drained Every Backbone Router Simultaneously