BGP and OSPF are core routing protocols used in medium to large networks. While they are not commonly exploited in small internal pentests, understanding how they work helps pentesters assess misconfigurations, route manipulation risks, and advanced attack surfaces in enterprise environments. These protocols determine how traffic flows across networks—so weaknesses can lead to traffic hijacking, redirection, or large-scale outages.

Understanding OSPF (Open Shortest Path First)

OSPF is an interior gateway protocol (IGP) used within a single organization’s network. It uses link-state routing and relies on exchanging network topology information through LSAs (Link State Advertisements).

OSPF routers calculate the shortest path to every network using Dijkstra’s algorithm.

Key OSPF Concepts

• Areas: OSPF networks are divided into areas for scalability (Area 0 is the backbone).

• LSAs: Routers exchange LSAs to learn topology.

• Neighbors: Routers form adjacencies to exchange routing information.

• Cost: Each link has a cost (usually based on bandwidth).

• Authentication: OSPF supports none, plaintext, or MD5 authentication.

Weak or no authentication can expose OSPF to manipulation.

Capturing and Analyzing OSPF Traffic

OSPF uses multicast to announce routes.

Capture OSPF Traffic

sudo tcpdump -i eth0 proto ospf

Wireshark Filter

ospf

Visible packets include:

• Hello packets

• Database descriptions

• LSAs

• Link-state updates

These show the network’s internal structure.

OSPF Misconfigurations and Weaknesses

Common weaknesses include:

• No OSPF authentication

• Plaintext authentication

• Misconfigured areas

• Unprotected router interfaces

• Route injection vulnerabilities

A rogue OSPF router can manipulate the routing table.

Rogue OSPF Router Example

sudo ospf6d

If OSPF authentication isn’t enforced, attackers can:

• Inject fake routes

• Redirect traffic

• Create routing loops

• Blackhole traffic

This can cause MITM or DoS across internal networks.

Understanding BGP (Border Gateway Protocol)

BGP is an exterior gateway protocol (EGP) used to exchange routes between different organizations or ISPs. BGP holds the global internet routing table and determines how traffic flows between networks across the world.

BGP is TCP-based (port 179) and highly trust-dependent.

How BGP Works

• Routers form “peering” sessions

• Exchange entire route tables

• Announce new prefixes and withdraw old ones

• Choose routes based on path attributes

Because BGP relies on trust, false announcements can redirect large volumes of traffic.

Capturing and Analyzing BGP Traffic

BGP traffic is visible on port 179.

Capture BGP Traffic

sudo tcpdump -i eth0 port 179

Wireshark Filter

bgp

Displays:

• Open messages

• Keepalives

• Route updates

• Withdrawals

These reveal how routing decisions are made.

BGP Attack Concepts (High-Level)

BGP attacks usually occur at ISP or data-center level, but understanding them is valuable.

Common attack scenarios include:

BGP Hijacking

An attacker advertises IP prefixes they do not own.
Traffic is rerouted to the attacker’s network.

BGP Route Injection

Attackers inject bogus routes to redirect or blackhole traffic.

BGP Session Reset

Sending spoofed RST packets to TCP port 179 can break BGP sessions.

BGP MITM

Misusing route manipulation to pass traffic through attacker-controlled routers.

These attacks can disrupt entire regions of the internet.

BGP Security Weaknesses

• No built-in authentication

• No route validation

• Relies heavily on trust

• Poor filtering practices

• Missing RPKI/ROA validation

Pentesters analyze border routers for weak controls.

Why BGP/OSPF Matter for Pentesters

Understanding routing protocols helps pentesters:

• Identify insecure routing domains

• Detect unauthenticated dynamic routing

• Recognize route injection attack paths

• Evaluate whether routing plays a role in MITM feasibility

• Understand how attackers could disrupt or manipulate network traffic

In advanced environments, routing weaknesses can lead to widespread compromise.

When BGP/OSPF Attacks Apply

These techniques apply to:

• Enterprise pentests

• ISP assessments

• Data center environments

• Cloud hybrid networks

• Red team simulations

In smaller networks, routing attacks are less common—but understanding them is still valuable.

Intel Dump

• OSPF is an internal routing protocol using LSAs, areas, and link-state updates

• OSPF misconfigurations allow rogue routers to inject routes

• BGP is a global routing protocol vulnerable to hijacking and route injection

• Tools: tcpdump, Wireshark, routing daemons like FRRouting

• Routing weaknesses can enable MITM, DoS, blackholing, and large-scale redirection