# STL 1 Assignment 4

3 Networks (R1, R2, R3)


### R1
### h1-1, h1-2, h1-3

### R2


### R3


## BGP Network Diagram

One is for external, the other is for internal

No response from 13.0.1.1 (h3-1)

From R1 to R3 :


ping to R2 is successful
traceroute to 13.0.1.1 fails after R2
No route to 9.0.0.1, meaning there's no route to send back the ping from R3 to R1.

To repair the connectionb between R1 and R3, run the following command to add a gateway that connects both of them again:

`route add default gw 9.0.1.1`

R1 can now ping back once the hosts in R3


However at this point, R3 cannot ping the hosts in R1, if we want to do it we can add in the default gateway in R1:

`route add default gw 9.0.0.2`

(The second last command is before the command is run)

# BGP Attack 1

To check the available routes we can use the traceroute command as shown:

`traceroute -n 13.0.1.1`


Since R4 is not yet on the default website will be coming from R3


To execute the Attack:

Modified the network address from **14.0.0.0/8** to **13.0.0.0/8** in `conf/bgpd-R4.conf` in R1:
to

To start the malicious website

`./start_rogue.sh`
Note when `./website.sh` is run it is connecting to the attacker web server:

For the wireshark, we will be observing R1 connecting to R4, other than the KEEP ALIVE message, OPEN and UPDATE messages are also observed:


Now the traceroute takes 2 hop to reach 13.0.1.1 since it goes through 9.0.4.2:

## R4




# BGP Attack 2


To do a DOS, we can use `hping3` command to send out mutiple pings at the same time.

`hping3 --flood 11.0.1.1`


ONce this is done the virtual box becomes very laggy. To combat this we can do a black hole routing in order to combat the DOS attack. This can be done by using the following:

`route add 9.0.4.2 gw 127.0.0.1 lo`

Black hole routing, also known as black hole filtering or packet black hole, is a network routing technique where incoming network traffic is dropped or discarded without any notification or forwarding. In other words, when a network device encounters a black hole route, it discards all packets destined for that route, essentially "swallowing" them.

Basically, the black hole command is done to make it such that if the ping is done it show network is unreachable as seen:

continuous retransmission.

This suggests that black hole routing is preventing the DOS attack.