BGP Vortex: Update Message Floods Can Create Internet Instabilities#

Felix Stöger, ETH Zurich; Henry Birge-Lee, Princeton University; Giacomo Giuliari, Mysten Labs; Jordi Subira-Nieto and Adrian Perrig, ETH Zurich — Core

• Why: A new BGP instability attack that neither BGPSEC nor RPKI can prevent, because every message involved is a legitimate, standards-compliant BGP UPDATE — a reminder that route-origin validation alone doesn't close the routing-security gap.
• What: Discovery of the "BGP Vortex," a configuration where just three legitimate BGP UPDATE messages trigger persistent instability, weaponizable to cause router overload and forwarding loops across the Internet. All major router implementations tested were susceptible. (from abstract only)
• How: Exploits standards-compliant BGP Communities extensions (used for traffic engineering) that allow route-preference modification; the paper proposes a framework for classifying which BGP extensions are similarly dangerous versus safe to deploy. (from abstract only)
• Where applicable: General for any BGP-speaking network; the mitigation framework is for router vendors and operators using BGP Communities-based traffic engineering.