WHAT IS ROUTING IN COMPUTER NETWORKING

Routing is the process of selecting a path for traffic in a network or between or across multiple networks. Broadly, routing is performed in many types of networks, including circuit-switched networks, such as the public switched telephone network, and computer networks, such as the Internet.

Routing Metrics and Costs

Routing metrics and costs are used for determining the best route to the destination. The factors used by the protocols to determine the shortest path, these factors are known as a metric.

Metrics are the network variables used to determine the best route to the destination. For some protocols use the static metrics means that their value cannot be changed and for some other routing protocols use the dynamic metrics means that their value can be assigned by the system administrator.

The most common metric values are given below:

• Hop count: Hop count is defined as a metric that specifies the number of passes through internetworking devices such as a router, a packet must travel in a route to move from source to the destination. If the routing protocol considers the hop as a primary metric value, then the path with the least hop count will be considered as the best path to move from source to the destination.
• Delay: It is a time taken by the router to process, queue and transmit a datagram to an interface. The protocols use this metric to determine the delay values for all the links along the path end-to-end. The path having the lowest delay value will be considered as the best path.
• Bandwidth: The capacity of the link is known as a bandwidth of the link. The bandwidth is measured in terms of bits per second. The link that has a higher transfer rate like gigabit is preferred over the link that has the lower capacity like 56 kb. The protocol will determine the bandwidth capacity for all the links along the path, and the overall higher bandwidth will be considered as the best route.
• Load: Load refers to the degree to which the network resource such as a router or network link is busy. A Load can be calculated in a variety of ways such as CPU utilization, packets processed per second. If the traffic increases, then the load value will also be increased. The load value changes with respect to the change in the traffic.
• Reliability: Reliability is a metric factor may be composed of a fixed value. It depends on the network links, and its value is measured dynamically. Some networks go down more often than others. After network failure, some network links repaired more easily than other network links. Any reliability factor can be considered for the assignment of reliability ratings, which are generally numeric values assigned by the system administrator.

TYPES OF ROUTING

• Static Routing
• Default Routing
• Dynamic Routing

Static Routing

• Static Routing is also known as Nonadaptive Routing.
• It is a technique in which the administrator manually adds the routes in a routing table.
• A Router can send the packets for the destination along the route defined by the administrator.
• In this technique, routing decisions are not made based on the condition or topology of the networks

Advantages Of Static Routing

Following are the advantages of Static Routing:

• No Overhead: It has ho overhead on the CPU usage of the router. Therefore, the cheaper router can be used to obtain static routing.
• Bandwidth: It has not bandwidth usage between the routers.
• Security: It provides security as the system administrator is allowed only to have control over the routing to a particular network.

Disadvantages of Static Routing:

Following are the disadvantages of Static Routing:

• For a large network, it becomes a very difficult task to add each route manually to the routing table.
• The system administrator should have a good knowledge of a topology as he has to add each route manually.

Default Routing

• Default Routing is a technique in which a router is configured to send all the packets to the same hop device, and it doesn’t matter whether it belongs to a particular network or not. A Packet is transmitted to the device for which it is configured in default routing.
• Default Routing is used when networks deal with the single exit point.
• It is also useful when the bulk of transmission networks have to transmit the data to the same hp device.
• When a specific route is mentioned in the routing table, the router will choose the specific route rather than the default route. The default route is chosen only when a specific route is not mentioned in the routing table.

Dynamic Routing

• It is also known as Adaptive Routing.
• It is a technique in which a router adds a new route in the routing table for each packet in response to the changes in the condition or topology of the network.
• Dynamic protocols are used to discover the new routes to reach the destination.
• In Dynamic Routing, RIP and OSPF are the protocols used to discover the new routes.
• If any route goes down, then the automatic adjustment will be made to reach the destination.

The Dynamic protocol should have the following features:

• All the routers must have the same dynamic routing protocol in order to exchange the routes.
• If the router discovers any change in the condition or topology, then router broadcast this information to all other routers.

Advantages of Dynamic Routing:

• It is easier to configure.
• It is more effective in selecting the best route in response to the changes in the condition or topology.

Disadvantages of Dynamic Routing:

• It is more expensive in terms of CPU and bandwidth usage.
• It is less secure as compared to default and static routing.

What Is Routing Information Protocol?

The Routing Information Protocol is one of the oldest distance-vector routing protocols which employs the hop count as a routing metric. RIP prevents routing loops by implementing a limit on the number of hops allowed in a path from source to destination.

Routing Information Protocol (RIP) is a distance-vector routing protocol. Routers running the distance-vector protocol send all or a portion of their routing tables in routing-update messages to their neighbors.

You can use RIP to configure the hosts as part of a RIP network. This type of routing requires little maintenance and also automatically reconfigures routing tables when your network changes or network communication stops. RIPv2 was added to the IBM® i product so you can send and receive RIP packets to update routes throughout your network.

In the following figure, a static route is added to the central system (AS1) that describes the connection to the network 10.1.1.x by way of AS2. This is a static route (added by your network administrator) with route redistribution set to yes. This setting causes this route to be shared with other routers and systems so that when they have traffic for 10.1.1.x, they route the traffic to your central IBM i platform (AS1). AS2 has the routed system started so that it sends and receives RIP information. In this example, AS1 is sending the message that AS2 has a direct connection to 10.1.2.x.

The following process describes the routing of traffic in the preceding figure.

• AS1 receives this RIP packet from AS2 and processes it. If AS1 does not have a route to 10.1.2.x, it will store this route. If it does have a path to 10.1.2.x that is the same number of hops or fewer, it will discard this new route information. In this example, AS1 keeps the route data.
• AS1 receives information from R1 with route information to 10.1.5.x. AS1 keeps this route information.
• AS1 receives information from R2 with route information to 10.1.3.x. AS1 keeps this route information.
• The next time AS1 sends RIP messages, it will send information to R1 that describes all the connections AS1 knows about that R1 might not know about. AS1 sends route information about 10.1.1.x, 10.1.2.x, and 10.1.3.x. AS1 does not send information about 10.1.4.x to R1 because AS1 knows that R1 is connected to 10.1.4.x and does not need a route. Similar information is sent to R2 and AS3.

HOW ROUTING INFORMATION PROTOCOL WORKS

In brief the RIP protocol works as follows.

• Each router initializes its routing table with a list of locally connected networks.
• Periodically, each router advertises the entire contents of its routing table over all of its RIP-enabled interfaces.
  • Whenever a RIP router receives such an advertisement, it puts all of the appropriate routes into its routing table and begins using it to forward packets. This process ensures that every network connected to every router eventually becomes known to all routers.
  • If a router does not continue to receive advertisements for a remote route, it eventually times out that route and stops forwarding packets over it. In other words, RIP is a “soft state” protocol.
• Every route has a property called a metric, which indicates the “distance” to the route’s destination.
  • Every time a router receives a route advertisement, it increments the metric.
  • Routers prefer shorter routes to longer routes when deciding which of two versions of a route to program in the routing table.
  • The maximum metric permitted by RIP is 16, which means that a route is unreachable. This means that the protocol cannot scale to networks where there may be more than 15 hops to a given destination.

RIP also includes some optimizations of this basic algorithm to improve stabilization of the routing database and to eliminate routing loops.

• When a router detects a change to its routing table, it sends an immediate “triggered” update. This speeds up stabilization of the routing table and elimination of routing loops.
• When a route is determined to be unreachable, RIP routers do not delete it straightaway. Instead they continue to advertise the route with a metric of 16 (unreachable). This ensures that neighbors are rapidly notified of unreachable routes, rather than having to wait for a soft state timeout.
• When router A has learnt a route from router B, it advertises the route back to B with a metric of 16 (unreachable). This ensures that B is never under the impression that A has a different way of getting to the same destination. This technique is known as “split horizon with poison reverse.”
• A “Request” message allows a newly-started router to rapidly query all of its neighbors’ routing tables.

ROUTING INFORMATION PROTOCOL VULNERABILITIES AND SOLUTIONS

RIP, one of the oldest distance-vector routing protocols, uses router hop count as the metric. Version 1, introduced in 1988, has some limitations, including the fact that it only supports classful networks. Because of these limitations, RIPv2 and RIPng (next generation) have been introduced. However, many routers still run RIPv1, allowing malicious actors to use the outdated protocol to their advantage.

Routers running RIPv1 send an initial request for a list of routes when the device is powered on. The list of routes is sent to the router by other devices listening for requests. Then, updates are sent at regular intervals.

Attackers exploit this by crafting malicious requests for routes and by spoofing the source IP to match the one of the targeted system. For each request, multiple 504-byte payloads are sent to the targeted IP address.

In the attacks observed by PLXsert, the attackers had sent the requests to RIPv1 routers that were accessible over the Internet. Experts have pointed out that routers with a large number of routes in their RIPv1 routing table are prefered by cybercriminals.

The amplification factor depends on this number of routes. For a reflector that responds with ten 504-byte payloads and one 164-byte payload, researchers have determined that the amplification factor for a single RIPv1 request is 131.24 (over 21,000%).

In theory, malicious actors could increase the amplification factor through RIPv1 poisoning, by forcing the targeted router to learn extra routes. However, experts say there are several factors that make such attacks ineffective.

Akamai has scanned the Internet and it has identified more than 53,000 devices — mostly located in the United States — that respond to RIPv1 queries. However, the company says many of them are not suitable as amplification DDoS sources because they respond with only one route.

In the May 16 attack observed by researchers, only roughly 500 devices had been used. Most of them sent predominantly 504-byte packets, resulting in a DDoS attack that peaked at 12.8 Gbps and 3.2 Mpps. A large part of this traffic came from Tokyo, Frankfurt, London, Hong Kong, and two locations in the United States.

“As attackers discover more sources, it is possible that this vector has the potential to create much larger attacks than what we’ve observed thus far,” Akamai said in its advisory.

According to PLXsert, most of the devices abused in the attack were SOHO routers running custom firmware such as DD-WRT, and NAS devices like BlueArc Titan. Experts have pointed out that the victims identified in the May 16 attack had not been using enterprise-grade routing hardware.

Of the 53,000 Web-accessible routers identified by experts, the most common were Netopia devices likely provided by ISPs in the initial boom of ADSL broadband Internet, ZTE ZXV10 routers, and TP-LINK TD-8xxx routers.

While many of the devices detected by experts are not suitable for amplification DDoS attacks, more than 24,000 of them offer at least an 83 percent amplification rate. The devices that don’t provide any amplification can still be abused for reflection, to diversify attack traffic from a single source.

RIPv1 reflection DDoS attacks can be mitigated by switching to RIPv2 or later, and by enabling authentication. In cases where RIPv1 is required, users can mark the WAN side interface as passive if the protocol is not needed on this interface. Finally, Akamai recommends restricting RIP via an access control list (ACL) to known routers.

Drop your comment