--- title: BGP Session Security: Be Very Skeptical « ipSpace.net blog description: An investigation into how well BGP implementations enforce Generalized TTL Security Mechanism (GTSM), prompted by findings from a DEFCON 31 presentation on BGP... canonical: https://daily.dev/posts/bgp-session-security-be-very-skeptical-ipspace-net-blog-me8hecwab twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BGP Session Security: Be Very Skeptical « ipSpace.net blog | daily.dev og:description: An investigation into how well BGP implementations enforce Generalized TTL Security Mechanism (GTSM), prompted by findings from a DEFCON 31 presentation on BGP... og:url: https://daily.dev/posts/bgp-session-security-be-very-skeptical-ipspace-net-blog-me8hecwab og:image: https://api.daily.dev/og/posts/me8heCWAB.png og:image:alt: BGP Session Security: Be Very Skeptical « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BGP Session Security: Be Very Skeptical « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 4 min read · 0 upvotes · 0 comments ## Summary An investigation into how well BGP implementations enforce Generalized TTL Security Mechanism (GTSM), prompted by findings from a DEFCON 31 presentation on BGP message parsing vulnerabilities. Testing reveals that FRR (used in Cumulus Linux 4.x and FRR 9.0.1) completes TCP session establishment even when incoming SYN packets have incorrect (too-low) TTL values, only dropping the BGP OPEN message afterward rather than rejecting the TCP connection outright. This means GTSM is not enforced at the TCP layer, leaving the BGP daemon exposed to crafted packets. The post also notes that most BGP routers (except Cisco IOS) accept TCP connections on port 179 from unconfigured neighbors, and some even process BGP OPEN messages before rejecting unknown peers. A proof-of-concept lab procedure is described for testing GTSM behavior on any BGP platform. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does FRR enforce GTSM by dropping TCP connections with too-low TTL before completing the handshake? FRR does not drop TCP connections with incorrect TTL at the SYN stage. Testing on both Cumulus Linux 4.x and FRR 9.0.1 shows that FRR completes the full TCP three-way handshake even when the incoming SYN has a too-low TTL. Only the BGP OPEN message is dropped afterward, leaving the TCP session open and the BGP daemon exposed to crafted packets. _Network engineers hardening BGP sessions track implementation-level findings like this on daily.dev._ ### Why do most BGP routers accept TCP connections on port 179 from unconfigured neighbors? Most modern network devices run on Linux or BSD, whose TCP stacks cannot filter incoming connections by source IP address without explicit firewall rules like iptables. Unlike Cisco IOS, which uses a proprietary TCP stack that can enforce neighbor checks natively, Linux-based BGP implementations require additional ACL configuration that most vendors do not deploy by default. _Engineers choosing BGP platforms for critical infrastructure weigh security defaults like these on daily.dev._ ## Similar posts on daily.dev - [Dear Junos, Tunnels Are Not Virtual Links « ipSpace.net blog](https://daily.dev/posts/dear-junos-tunnels-are-not-virtual-links-ipspace-net-blog-1zdexbued) · ipSpace.net Blog · 0 upvotes · 0 comments - [Exploring the BGP Neighbor CONNECT State « ipSpace.net blog](https://daily.dev/posts/exploring-the-bgp-neighbor-connect-state-ipspace-net-blog-q28k0i62x) · ipSpace.net Blog · 0 upvotes · 0 comments - [Fresh insights from old data: corroborating reports of Turkmenistan IP unblocking and firewall testing](https://daily.dev/posts/fresh-insights-from-old-data-corroborating-reports-of-turkmenistan-ip-unblocking-and-firewall-testi-j1kikiviw) · Cloudflare · 0 upvotes · 0 comments - [The OSPF MTU Mismatch Saga « ipSpace.net blog](https://daily.dev/posts/the-ospf-mtu-mismatch-saga-ipspace-net-blog-jmtvuzjm6) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/bgp-session-security-be-very-skeptical-ipspace-net-blog-me8hecwab) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BGP Session Security: Be Very Skeptical « ipSpace.net blog","url":"https://daily.dev/posts/bgp-session-security-be-very-skeptical-ipspace-net-blog-me8hecwab","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bgp-session-security-be-very-skeptical-ipspace-net-blog-me8hecwab"},"datePublished":"2026-08-11T08:55:57.923Z","dateModified":"2026-08-24T06:50:53.866Z","description":"An investigation into how well BGP implementations enforce Generalized TTL Security Mechanism (GTSM), prompted by findings from a DEFCON 31 presentation on BGP...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bgp-session-security-be-very-skeptical-ipspace-net-blog-me8hecwab","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,bgp","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"BGP Session Security: Be Very Skeptical « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bgp-session-security-be-very-skeptical-ipspace-net-blog-me8hecwab#faq","mainEntity":[{"@type":"Question","name":"Does FRR enforce GTSM by dropping TCP connections with too-low TTL before completing the handshake?","acceptedAnswer":{"@type":"Answer","text":"FRR does not drop TCP connections with incorrect TTL at the SYN stage. Testing on both Cumulus Linux 4.x and FRR 9.0.1 shows that FRR completes the full TCP three-way handshake even when the incoming SYN has a too-low TTL. Only the BGP OPEN message is dropped afterward, leaving the TCP session open and the BGP daemon exposed to crafted packets. Network engineers hardening BGP sessions track implementation-level findings like this on daily.dev."}},{"@type":"Question","name":"Why do most BGP routers accept TCP connections on port 179 from unconfigured neighbors?","acceptedAnswer":{"@type":"Answer","text":"Most modern network devices run on Linux or BSD, whose TCP stacks cannot filter incoming connections by source IP address without explicit firewall rules like iptables. Unlike Cisco IOS, which uses a proprietary TCP stack that can enforce neighbor checks natively, Linux-based BGP implementations require additional ACL configuration that most vendors do not deploy by default. Engineers choosing BGP platforms for critical infrastructure weigh security defaults like these on daily.dev."}}]} ```