Contents
What is a bogon in cyber security?
A Bogon is an IP address (IPv4 or IPv6) that has yet to be officially assigned for use by the Internet Assigned Number Authority (IANA). As such they are unassigned and unrouted on the Internet. Bogons can be intentionally misused by hackers to hide their attacks by hiding their source IP address (hackers).
What are bogons and Martians?
“Bogons are defined as Martians (private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598) and netblocks that have not been allocated to a regional internet registry (RIR) by the Internet Assigned Numbers Authority.”
What does bogon IP address mean?
A bogon is an illegitimate IP address that falls into a set of IP addresses that have not been officially assigned to an entity by an internet registration institute, such as the Internet Assigned Number Authority (IANA). The term bogon is used as slang and is derived from the word bogus.
How do I block bogon?
Many ISPs and end-user firewalls filter and block bogons, because they have no legitimate use, and usually are the result of accidental misconfiguration or malicious intent. Bogons can be filtered by using router access-control lists (ACLs), or by BGP blackholing.
What does bogon true mean?
“Bogon” is an informal term used to describe IP packets on the public Internet that claim to be from an area of the IP address space reserved, but not yet allocated or delegated by the Internet Assigned Numbers Authority (IANA) or any of the Regional Internet Registries (RIR).
How do I block Bogons?
What is BGP bogon?
The traditional bogons are martians plus prefixes that have not been allocated by IANA to an RIR; fullbogons also include prefixes that have been allocated to an RIR, but have not been assigned by that RIR to an ISP or other end-user organization. …
How do I block bogons?
Should I block bogon networks?
Blocking bogon networks on local interfaces can be harmful as they will block traffic which is necessary for proper local network operations, especially for IPv6. If local interfaces have proper rules which only allow from specific local sources, bogon blocking is unnecessary.
Can A bogon be used to send spam?
So bogon packets cannot be used to, for example, send spam e-mails or to send HTTP/web traffic. But bogon’s can be used to launch TCP SYN attacks and are used in about 10% of DDoS attacks on the net.
What does it mean to have a Bogon IP address?
Some are reserved for private networks or for future usages. These reserved and unused IP addresses are said unallocated and called bogon IP addresses. Since bogon IP addresses refer to non-allocated IP addresses, it means they should never be used on the public Internet.
Why are bogons bad for the public Internet?
Bogons are bad for several reasons. Here is a bit more on why: “Bogon” is an informal term used to describe IP packets on the public Internet that claim to be from an area of the IP address space reserved, but not yet allocated or delegated by the Internet Assigned Numbers Authority (IANA) or any of the Regional Internet Registries (RIR).
Why are Bogon packets useful to cyber criminals?
The only reason you will see a bogon is if someone either accidentally misconfigured something or intentionally is creating them for malicious purposes. Bogon packets are useful to cybercriminals because the packets cannot be attributed to an actual host (since the source IP is bogus).