CAPEC-584
BGP Route Disabling
An adversary suppresses the Border Gateway Protocol (BGP) advertisement for a route so as to render the underlying network inaccessible. The BGP protocol helps traffic move throughout the Internet by selecting the most efficient route between Autonomous Systems (AS), or routing domains. BGP is the basis for interdomain routing infrastructure, providing connections between these ASs. By suppressing the intended AS routing advertisements and/or forcing less effective routes for traffic to ASs, the adversary can deny availability for the target network.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-584: BGP Route Disabling: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/584.html and https://cve.bz/cve/capec/584?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The adversary must have control of a router that can modify, drop, or introduce spoofed BGP updates.The adversary can convince
Resources required
BGP Router
Consequences
| Impact | Affects | Note |
|---|---|---|
| Other | Availability | Disabling a network route at the routing infrastructure level denies availability of that route. |
Mitigations
Implement Ingress filters to check the validity of received routes. However, this relies on the accuracy of Internet Routing Registries (IRRs) databases which are often not well-maintained.
Implement Secure BGP (S-BGP protocol), which improves authorization and authentication capabilities based on public-key cryptography.
Related attack patterns
- Part of
- CAPEC-582 Route Disabling
Examples
Blackholing: The adversary intentionally references false routing advertisements in order to attract traffic …
Blackholing: The adversary intentionally references false routing advertisements in order to attract traffic to a particular router so it can be dropped.
MITRE's words, unchanged: CAPEC-584 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.