ExaBGP - A new Tool to Interact with BGP

ExaBGP is a new application designed to provide an easy way for programmers and system admistrators to interact with BGP networks. The program is designed to allow the injection of arbitrary routes into a network, including IPv6 and FlowSpec.

Introduction
 
Many security professionals are currently using NetFlow to monitor their network and react to DDOS attacks. By centralising their traffic information in one place, they are able to corrolate the information and detect more and more advanced attacks.
 
Many networks then use BGP to blackhole the destination IP of the attack at their edge, protecting their network core but still allowing the attacker to succeed. 

RFC 5575 , better known as FlowSpec, was designed to help security professionals react to such attacks in a more fine grained manner, by allowing precise filtering rules to be deployed, through BGP, to routers with advanced ASICS features.

ExaBGP is currently the only open source implementation of a route injector able to generate and propagate Flow Routes. 

Getting Started
 
ExaBGP is available on Google Code   and will run on most Unix flavours with any recent version of python 2 (2.4 to 2.7).
 
Simply untar the code into /opt, or any directory of your choice, then edit one of the template files in the etc/bgp folder to reflect what you want to do, and finally test your configuration calling “bin/bgpd” with your configuration as the first parameter.

What does it look like ...  

The configuration contains the usual BGP information fields; Cisco, Juniper, Quagga and BIRD users should find their mark very quickly.

A mixed IPv4/Flow configuration would look like the following:
 
neighbor 192.168.127.128 {
  description "a quagga test peer";
  router-id 192.168.127.1;
  local-address 192.168.127.1;
  local-as 65000;
  peer-as 65000;
  graceful-restart;
 

  static {
    route 10.0.3.0/24 {
      next-hop 10.0.255.254;
      community [ 30740:30740 30740:0 ];
      local-preference 200;
    }
    route 10.0.5.0/24 next-hop 10.0.255.254 local-preference 200;
  }
  flow {
    route slow-down-the-proxy-for-the-office {
      match {
        source 10.0.0.1/32;
        destination 192.168.0.1/32;
        destination-port >8080&<8088 =3128;
        source-port >1024;
        protocol tcp;
      }
      then {
        rate-limit 9600;
      }
    }
  }
}

 
We would love to hear from you...

The program wiki  has more information on how to install and configure the application.

You can as well email or jabber the author at thomas.mangin AT exa-networks.co.uk

About the author

Thomas Mangin is Technical Director at Exa Networks Limited, a  B2B ISP based in the north of England.

Homepage: http://thomas.mangin.com/