Inferring BGP Blackholing Activity in the Internet
| dc.contributor.author | Giotsas, Vasileios | |
| dc.contributor.author | Smaragdakis, Georgios | |
| dc.contributor.author | Dietzel, Christoph | |
| dc.contributor.author | Richter, Philipp | |
| dc.contributor.author | Feldmann, Anja | |
| dc.contributor.author | Berger, Arthur | |
| dc.date.accessioned | 2019-12-03T12:26:28Z | |
| dc.date.available | 2019-12-03T12:26:28Z | |
| dc.date.issued | 2017-11-01 | |
| dc.description | © Owner/Author 2017. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in IMC '17 Proceedings of the 2017 Internet Measurement Conference, http://dx.doi.org/10.1145/3131365.3131379. | en |
| dc.description.abstract | The Border Gateway Protocol (BGP) has been used for decades as the de facto protocol to exchange reachability information among networks in the Internet. However, little is known about how this protocol is used to restrict reachability to selected destinations, e.g., that are under attack. While such a feature, BGP blackholing, has been available for some time, we lack a systematic study of its Internet-wide adoption, practices, and network e cacy, as well as the profile of blackholed destinations. In this paper, we develop and evaluate a methodology to automatically detect BGP blackholing activity in the wild. We apply our method to both public and private BGP datasets. We find that hundreds of networks, including large transit providers, as well as about 50 Internet exchange points (IXPs) o er blackholing service to their customers, peers, and members. Between 2014–2017, the number of blackholed prefixes increased by a factor of 6, peaking at 5K concurrently blackholed prefixes by up to 400 Autonomous Systems. We assess the effect of blackholing on the data plane using both targeted active measurements as well as passive datasets, finding that blackholing is indeed highly effective in dropping traffic before it reaches its destination, though it also discards legitimate traffic. We augment our findings with an analysis of the target IP addresses of blackholing. Our tools and insights are relevant for operators considering offering or using BGP blackholing services as well as for researchers studying DDoS mitigation in the Internet. | en |
| dc.description.sponsorship | EC/H2020/679158/EU/Resolving the Tussle in the Internet: Mapping, Architecture, and Policy Making/ResolutioNet | en |
| dc.description.sponsorship | EC/H2020/644960/EU/Towards a flexible software-defined network ecosystem/ENDEAVOUR | en |
| dc.description.sponsorship | BMBF, 01IS14009D, Verbundprojekt: BDSec - Big Data Security | en |
| dc.description.sponsorship | BMBF, 01IS14013A, BBDC - Berliner Kompetenzzentrum für Big Data | en |
| dc.description.sponsorship | DFG, FE 570/4-1, Gottfried Wilhelm Leibniz-Preis 2011 | en |
| dc.identifier.isbn | 978-1-4503-5118-8 | |
| dc.identifier.uri | https://depositonce.tu-berlin.de/handle/11303/10426 | |
| dc.identifier.uri | http://dx.doi.org/10.14279/depositonce-9378 | |
| dc.language.iso | en | en |
| dc.rights.uri | http://rightsstatements.org/vocab/InC/1.0/ | en |
| dc.subject.ddc | 000 Informatik, Informationswissenschaft, allgemeine Werke | de |
| dc.subject.other | BGP | en |
| dc.subject.other | blackholing | en |
| dc.subject.other | DDoS mitigation | en |
| dc.title | Inferring BGP Blackholing Activity in the Internet | en |
| dc.type | Conference Object | en |
| dc.type.version | acceptedVersion | en |
| dcterms.bibliographicCitation.doi | 10.1145/3131365.3131379 | en |
| dcterms.bibliographicCitation.originalpublishername | Association for Computing Machinery (ACM) | en |
| dcterms.bibliographicCitation.originalpublisherplace | New York, NY | en |
| dcterms.bibliographicCitation.pageend | 14 | en |
| dcterms.bibliographicCitation.pagestart | 1 | en |
| dcterms.bibliographicCitation.proceedingstitle | IMC '17 Proceedings of the 2017 Internet Measurement Conference | en |
| tub.accessrights.dnb | free | en |
| tub.affiliation | Fak. 4 Elektrotechnik und Informatik::Inst. Telekommunikationssysteme::FG Internet Measurement and Analysis (IMA) | de |
| tub.affiliation.faculty | Fak. 4 Elektrotechnik und Informatik | de |
| tub.affiliation.group | FG Internet Measurement and Analysis (IMA) | de |
| tub.affiliation.institute | Inst. Telekommunikationssysteme | de |
| tub.publisher.universityorinstitution | Technische Universität Berlin | en |