OSPF TTL Security Check

(Rene Molenaar) #1

This topic is to discuss the following lesson:

(Chris N) #2

I guess if the person spoofing is capable of spoofing a TTL of 2, they are also capable of spooing a TTL of 256 which (with the default config) would effectively override this safety mechanism in this scenario :slight_smile:

Unless the TTL is an 8 bit field, so 255 is the highest value!

(Chris N) #3

Also you said this:

might be a change for IOS 15, but now the hops value is the maximum hop value, not the decrement amount.

[quote]ttl-security all-interfaces hops ?
<1-254> maximum number of hops allowed[/quote]

So if you wanted a TTL of 155 you would use the number 155, not the number 100

(Lazaros Agapides) #4

Hello Chris

Yes, you are correct that the TTL field is an 8 bit field, so the highest value can be 255.

I hope this has been helpful!

Laz

(Lazaros Agapides) #5

Hello again Chris.

You must remember that the value configured in the ttl-security all-interfaces hops command is the number of allowed hops and not the actual value of the TTL field. The value is essentially a threshold.

The default value is actually 0. This means that it will accept any values of TTL equal to or greater than 255-0. Since routing decrements the TTL by one, this means that only OSPF packets from directly connected devices will be accepted.

If this threshold is configured at 100 hops, then only packets with a TTL higher than 255-100 = 155 will be accepted. That means that packets with a TTL within the range of 155 to the maximum of 255 will be accepted.

I hope this has been helpful!

Laz

(Arindom N) #6

Hi Rene,
Hopefully you are doing good…

I have one question When i am going through you CCIE R&S Written Table of Contents here why 3.6e:Path Preference & 3.6f:Operations not showing anything when i am trying to click there no page is opening so are you want to add any content there or its mistake by you? then 3.6g:Convergence and Scalability having content because when i clicking the + button the content is coming.

For your reference i attached the screenshot as well.

Screenshot1
Screenshot2
Thanks & Regards,
Arindom

(Lazaros Agapides) #7

Hello Arindom

Thanks for that! I have sent out a message to Rene to take a look and fix it!

Laz

(Rene Molenaar) #8

Hi Arindom,

I just moved a couple of items of 3.6f that should be there but weren’t.

3.6e is empty right now so that is a bit confusing. I’ll have to check which items can go there.

Rene

(Arindom N) #9

Hi Rene,
Thanks for replying … if you add any thing there defenately I will go through the point…

Thanks & Regards,
Arindom

1 Like