routing protocols are many, can be divided or classified in several ways:
Not that there's some better than others, depends on where we want to implement, router, etc ... Well, if there are some better than others ...
is more, a router can implement multiple routing protocols simultaneously, such as RIP and OSPF can be used simultaneously to find a route for the other or both ...
course
Router1 and Router2 if you want to exchange routes, both must use the same routing protocol, eg
Case a)
R1: RIP and OSPF uses
R2: Use EIGRP and RIP
Routing tables will be exchanged through the RIP routing protocol is the "common" to use both.
Case b)
OSPF uses R1 and R2
RIP, EIGRP uses
Well may not be exchanged because there are no protocols Common routing.
Case c)
R1: RIP and OSPF uses
R2: RIP and OSPF uses
exchange routes via OSPF. Ahhh! And why not use RIP??
For a new concept to be added to this ... the administrative distance.
The administrative distance is a numeric value that represents the degree of confidence provided by a routing protocol, the lower the better administrative distance is assumed to be the routing protocol.
RIP uses the default administrative distance of 120 while OSPF uses 110, so it is assumed that OSPF is better than the routes discovered by OSPF are better than those discovered by RIP and OSPF will use those place.
Case d)
R1: Use RIP, OSPF, static routes R3 and is directly connected to R2 and R4
R2: Use RIP, OSPF, static routes to R6 and R1 is directly connected to R5 and
knows how to reach R1 R2, R3 and R4 R2
knows how to reach R1, R5 and R6
see, R1 is not aware that there is a network ... R6, and in the same way, R2 does not know of the existence of R4
This is because unless REDISTRIBUTE static routes the routing protocol not discover for themselves
still can complicate the matter, imagine using OSPF R1 knows that there is an X network, but uses RIP to talk with R2 ....
What about network X??
Well, as with static routes, the networks discovered by other protocols routing are not distributed without more ... come on, to the point ... If you use multiple routing protocols and / or static routes, you need to redistribute it under the other routing protocols we use or the router on the other side "will not know that there ...
is also important to clarify that the administrative distance is 1 static routes and directly connected networks is 0 (zero), so if a router discovers that to go to a network is best reached by X but there is a static route that says it is for Y, where it says go for the static route and not by discovered by the routing protocol in question ...
And what is the best route??
Well this will solve the routing protocols by METRIC .
The metric is another numeric value that tells the router the "what it takes to" go from one point to another, as well as administrative distances, the lowest metric (cost) a better way.
metrics are highly dependent on the routing protocol used, the measure must be taken as the least number of jumps, using the bandwidth and also taking into account factors such as congestion, delay, reliability, or even a "mixture of them," we ejmplo a router that can decide whether a fact is on one place or another by many factors, depend on the protocol routing chosen.
- Internal, external, border
distance vector link state
Not that there's some better than others, depends on where we want to implement, router, etc ... Well, if there are some better than others ...
is more, a router can implement multiple routing protocols simultaneously, such as RIP and OSPF can be used simultaneously to find a route for the other or both ...
course
Router1 and Router2 if you want to exchange routes, both must use the same routing protocol, eg
Case a)
R1: RIP and OSPF uses
R2: Use EIGRP and RIP
Routing tables will be exchanged through the RIP routing protocol is the "common" to use both.
Case b)
OSPF uses R1 and R2
RIP, EIGRP uses
Well may not be exchanged because there are no protocols Common routing.
Case c)
R1: RIP and OSPF uses
R2: RIP and OSPF uses
exchange routes via OSPF. Ahhh! And why not use RIP??
For a new concept to be added to this ... the administrative distance.
The administrative distance is a numeric value that represents the degree of confidence provided by a routing protocol, the lower the better administrative distance is assumed to be the routing protocol.
RIP uses the default administrative distance of 120 while OSPF uses 110, so it is assumed that OSPF is better than the routes discovered by OSPF are better than those discovered by RIP and OSPF will use those place.
Case d)
R1: Use RIP, OSPF, static routes R3 and is directly connected to R2 and R4
R2: Use RIP, OSPF, static routes to R6 and R1 is directly connected to R5 and
knows how to reach R1 R2, R3 and R4 R2
knows how to reach R1, R5 and R6
see, R1 is not aware that there is a network ... R6, and in the same way, R2 does not know of the existence of R4
This is because unless REDISTRIBUTE static routes the routing protocol not discover for themselves
still can complicate the matter, imagine using OSPF R1 knows that there is an X network, but uses RIP to talk with R2 ....
What about network X??
Well, as with static routes, the networks discovered by other protocols routing are not distributed without more ... come on, to the point ... If you use multiple routing protocols and / or static routes, you need to redistribute it under the other routing protocols we use or the router on the other side "will not know that there ...
is also important to clarify that the administrative distance is 1 static routes and directly connected networks is 0 (zero), so if a router discovers that to go to a network is best reached by X but there is a static route that says it is for Y, where it says go for the static route and not by discovered by the routing protocol in question ...
And what is the best route??
Well this will solve the routing protocols by METRIC .
The metric is another numeric value that tells the router the "what it takes to" go from one point to another, as well as administrative distances, the lowest metric (cost) a better way.
metrics are highly dependent on the routing protocol used, the measure must be taken as the least number of jumps, using the bandwidth and also taking into account factors such as congestion, delay, reliability, or even a "mixture of them," we ejmplo a router that can decide whether a fact is on one place or another by many factors, depend on the protocol routing chosen.
Well, I think enrutamieto basic protocols and exposed ... Now we will work on the post title: ATTACK ROUTING PROTOCOLS
In this example we will attack RIP v2, for this we will say a little something before anything RIPv2,
RIPv2
• It is a distance vector routing protocol
· Use as the number of hops metric
· Use multitast (224.0.0.9) to communicate with other routers RIPv2
· Can be authenticated, ie, you can use Passwords and authentication methods, PAP or CHAP to receive or pass routes
• Your Account to infinity is 15 jumps, that is, between one destination and another can not be more than 15 hops and the route is unreachable
· Use Horizonte Divided (Split Horizon) that is, a path should not be enacted by the same interface it was received with it are eliminated certain types of routing loops.
· Use or use, poisoned route to avoid routing loops, that is, mark a path with 16 hops if the router does not know how to reach it.
• Report to the origin with the possible ICMP enrutamieto incicdencias of
· Use timers for convergence and remove loops, ie
or every 30 seconds sends regular updates
or If you find a route that has "fallen" keeps it in a kind of "freeze" before removing it completely, this time is 120 sec.
or 180 seconds to remove it "Real"
Can use subnet masks, subnetting and VLSM
Can use or uses, triggered updates to avoid waiting times indicating timers
· Use or use source validation route, ie only accept updates (or send) to certain IP's
· Uses UDP port 520.
Vaaaleee main thing is .... What we should not forget (now Christian) is:
• The convergence of a RIP network could take several minutes (due to timers) although triggered updates using the convergence of the network can be much faster.
• The maximum number of hops is 15
· Uses multicast addresses to "pass" the tables and / or routes
· It may be used passwords (MD5 encrypted or not) to validate an update
· Use validation source (IP) of received updates.
Steps RIPv2 attack are:
· Listening RIP traffic, it will find out:
or IP's Origin of updates
o If you use passwords or not to validate the updates
or if the password is encrypted will have to break it too, though as you progress you can "pass" the MD5 hash no more to avoid breaking the password can always be a long time.
• Send updates false source IP authenticated or validated, that we will have achieved by sniffer
• The false update will be routed to a network "other" machine, another router or "similar" which is under the attacker's control
· Listen redirected the traffic in
· Back to route packets to the real destination.
AND RIP RIP ( Requiescant In Pace, Routing Information Protocol ) hahaha ...
To do this we simply need a Linux machine capable of forwarding a packet generator and our beloved IPTABLES anyone to make a POSTROUTING network traffic.
There is another method but cool, using Zebra or Quagga CISCO devices that emulate a Linux, we could configure our machine as another router over the network using Quagga, enable RIPv2 and make it work ... but suffice us first.
's scenario (not to be very complicated) is:
have 4 routers, three of them running RIP are located in the Central and the two branches, the fourth router connects to the PBX with external resources, including Internet and this is not RIP (although it could have, of course ... does not matter)
NETWORK plant is 172.28.0.x/24 and connect remote offices, remote means the term as "another network with other routers, could be easily located in the same building, in plants different or in nearby buildings ...
NETWORK 1 Office is 192.168.200.x/24
The Network is 10.0.0.x/24 Office 2
Resource Network is 192.168.4.x/24 in which corporate resources are located, for example DNS, databases, etc ... and remote network access, in the case ... Internet.
RIP routers are involved in the Central Office by the sniffer will go "guessing" the topology and different Ip's of the means that connect us.
The attacker will be located in the central office This is a convenience since it already is in the middle, but then discuss what would happen if he were in office instead of at the plant.
I want to make note that although the attacker is already in the environment, traffic between offices and / or between offices and resources and / or inter-office and Internet will not go through him, since he would have to modify the table routers and routing the assumption that they are properly configured (so to speak) or at least well protected without physical access to them.
also think it would be better than a different network resources were otherwise connected to Central as well:
Indeed, it might be, and indeed it will, ea!! Anyway, the "effect" is the same, but I have not got a router with 4 interfaces (4 interfaces darling I say, not a router with 4 port switch routing ....) to do "real" between the interfaces ...
why the graph above and not the latter ....
Well, stage hand (lucky we are to see it instead of imagining it, lol) so now we need :
• 4 Routers, at least 3 of them running RIPv2
· At least one machine on each network
• Connecting to the Internet to offer services to branches
• A central Linux (attacker)
• A packet generator
• A sniffer
· Another router on the attacking machine (which is the same as Linux, thankfully, with quagga or zebra, or alternatively, send the routes "mean-spirited 'every 30 seconds ...)
All this "we have", well I have it now ... (I imagine como está mi casa, joder!!!!)
Para evitar lo de “convertir” Linux en un router emulando la IOS de cisco, esto puede quedar para otra ocasión, usaremos el generador de paquetes y para mantener la convergencia, nos ocuparemos de enviar el paquete RIP con frecuencia, COMO!!! Que no entiendes por qué hay que enviarlo de vez en cuando???
Pues hombre... ya hemos hablado de los cambios de topología, de la convergencia, etc... recuerda que RIP envía actualizaciones cada 30 segundos... si no lo hacemos con la máquina atacante los otros routers entenderán que esa red o ese router ya no está y dejaran enactment of their existence .... clear, no??
In this example we will attack RIP v2, for this we will say a little something before anything RIPv2,
RIPv2
• It is a distance vector routing protocol
· Use as the number of hops metric
· Use multitast (224.0.0.9) to communicate with other routers RIPv2
· Can be authenticated, ie, you can use Passwords and authentication methods, PAP or CHAP to receive or pass routes
• Your Account to infinity is 15 jumps, that is, between one destination and another can not be more than 15 hops and the route is unreachable
· Use Horizonte Divided (Split Horizon) that is, a path should not be enacted by the same interface it was received with it are eliminated certain types of routing loops.
· Use or use, poisoned route to avoid routing loops, that is, mark a path with 16 hops if the router does not know how to reach it.
• Report to the origin with the possible ICMP enrutamieto incicdencias of
· Use timers for convergence and remove loops, ie
or every 30 seconds sends regular updates
or If you find a route that has "fallen" keeps it in a kind of "freeze" before removing it completely, this time is 120 sec.
or 180 seconds to remove it "Real"
Can use subnet masks, subnetting and VLSM
Can use or uses, triggered updates to avoid waiting times indicating timers
· Use or use source validation route, ie only accept updates (or send) to certain IP's
· Uses UDP port 520.
Vaaaleee main thing is .... What we should not forget (now Christian) is:
• The convergence of a RIP network could take several minutes (due to timers) although triggered updates using the convergence of the network can be much faster.
• The maximum number of hops is 15
· Uses multicast addresses to "pass" the tables and / or routes
· It may be used passwords (MD5 encrypted or not) to validate an update
· Use validation source (IP) of received updates.
Steps RIPv2 attack are:
· Listening RIP traffic, it will find out:
or IP's Origin of updates
o If you use passwords or not to validate the updates
or if the password is encrypted will have to break it too, though as you progress you can "pass" the MD5 hash no more to avoid breaking the password can always be a long time.
• Send updates false source IP authenticated or validated, that we will have achieved by sniffer
• The false update will be routed to a network "other" machine, another router or "similar" which is under the attacker's control
· Listen redirected the traffic in
· Back to route packets to the real destination.
AND RIP RIP ( Requiescant In Pace, Routing Information Protocol ) hahaha ...
To do this we simply need a Linux machine capable of forwarding a packet generator and our beloved IPTABLES anyone to make a POSTROUTING network traffic.
There is another method but cool, using Zebra or Quagga CISCO devices that emulate a Linux, we could configure our machine as another router over the network using Quagga, enable RIPv2 and make it work ... but suffice us first.
's scenario (not to be very complicated) is:
have 4 routers, three of them running RIP are located in the Central and the two branches, the fourth router connects to the PBX with external resources, including Internet and this is not RIP (although it could have, of course ... does not matter) NETWORK plant is 172.28.0.x/24 and connect remote offices, remote means the term as "another network with other routers, could be easily located in the same building, in plants different or in nearby buildings ...
NETWORK 1 Office is 192.168.200.x/24
The Network is 10.0.0.x/24 Office 2
Resource Network is 192.168.4.x/24 in which corporate resources are located, for example DNS, databases, etc ... and remote network access, in the case ... Internet.
RIP routers are involved in the Central Office by the sniffer will go "guessing" the topology and different Ip's of the means that connect us.
The attacker will be located in the central office This is a convenience since it already is in the middle, but then discuss what would happen if he were in office instead of at the plant.
I want to make note that although the attacker is already in the environment, traffic between offices and / or between offices and resources and / or inter-office and Internet will not go through him, since he would have to modify the table routers and routing the assumption that they are properly configured (so to speak) or at least well protected without physical access to them.
also think it would be better than a different network resources were otherwise connected to Central as well:
Indeed, it might be, and indeed it will, ea!! Anyway, the "effect" is the same, but I have not got a router with 4 interfaces (4 interfaces darling I say, not a router with 4 port switch routing ....) to do "real" between the interfaces ...
why the graph above and not the latter ....
Well, stage hand (lucky we are to see it instead of imagining it, lol) so now we need :
• 4 Routers, at least 3 of them running RIPv2
· At least one machine on each network
• Connecting to the Internet to offer services to branches
• A central Linux (attacker)
• A packet generator
• A sniffer
· Another router on the attacking machine (which is the same as Linux, thankfully, with quagga or zebra, or alternatively, send the routes "mean-spirited 'every 30 seconds ...)
All this "we have", well I have it now ... (I imagine como está mi casa, joder!!!!)
Para evitar lo de “convertir” Linux en un router emulando la IOS de cisco, esto puede quedar para otra ocasión, usaremos el generador de paquetes y para mantener la convergencia, nos ocuparemos de enviar el paquete RIP con frecuencia, COMO!!! Que no entiendes por qué hay que enviarlo de vez en cuando???
Pues hombre... ya hemos hablado de los cambios de topología, de la convergencia, etc... recuerda que RIP envía actualizaciones cada 30 segundos... si no lo hacemos con la máquina atacante los otros routers entenderán que esa red o ese router ya no está y dejaran enactment of their existence .... clear, no??
0 comments:
Post a Comment