• BGP does not use its own transport protocol; instead, it relies entirely on a long-lived TCP connection over port 179. While this design makes BGP reliable, it introduces a critical security vulnerability: TCP session hijacking.

    One eBGP session between AS 65001 and AS 65002 running over a single TCP connection

    Figure 1 – One eBGP session, one long-lived TCP connection

    The TCP Hijacking Vulnerability

    Launch the lab below to jump into hands-on practice! Execute the required configurations directly in the terminal, complete each task, and claim your flag.

    Because a BGP TCP session often stays open for months or years, an attacker capable of sniffing traffic or spoofing IP addresses can inject a malicious TCP RST (Reset) packet.

    Upon receiving the spoofed reset, the router assumes the neighbor initiated a teardown, immediately killing the BGP session and dropping all associated routes.

    To mitigate this attack, BGP leverages TCP MD5 Authentication (RFC 2385).

    Answer the question below

    Enter the flag:

    How BGP MD5 Authentication Works

    When authentication is enabled on a BGP peering:

    • The Mechanism: Every TCP segment carries an MD5 hash digest computed from a shared secret password combined with the TCP/IP header fields.

    • Silent Drop: The receiving router recalculates the hash. If the signature is missing or invalid, the packet is silently dropped at the TCP layer before BGP ever processes it.

    • Zero Wire Exposure: The actual secret password is never transmitted across the wire.

    Let's configure this in a lab to analyze the exact error messages and behaviors when things break.

    Answer the question below

    On which TCP port does BGP establish its long-lived session?