--- title: Is BGP TTL Security Any Good? « ipSpace.net blog | daily.dev description: A hands-on evaluation of BGP TTL Security (GTSM, RFC 5082) across Arista EOS, Cisco IOSv, Cisco Nexus 9300v, and Cumulus Linux. Arista EOS and Cisco Nexus use... canonical: https://daily.dev/posts/is-bgp-ttl-security-any-good-ipspace-net-blog-fkxwb3r28 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Is BGP TTL Security Any Good? « ipSpace.net blog | daily.dev og:description: A hands-on evaluation of BGP TTL Security (GTSM, RFC 5082) across Arista EOS, Cisco IOSv, Cisco Nexus 9300v, and Cumulus Linux. Arista EOS and Cisco Nexus use... og:url: https://daily.dev/posts/is-bgp-ttl-security-any-good-ipspace-net-blog-fkxwb3r28 og:image: https://api.daily.dev/og/posts/FKXwb3r28.png og:image:alt: Is BGP TTL Security Any Good? « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Is BGP TTL Security Any Good? « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 8 min read · 0 upvotes · 0 comments ## Summary A hands-on evaluation of BGP TTL Security (GTSM, RFC 5082) across Arista EOS, Cisco IOSv, Cisco Nexus 9300v, and Cumulus Linux. Arista EOS and Cisco Nexus use iptables rules to drop TCP SYN packets with too-low TTL before they reach the kernel, while Cisco IOSv drops them in the TCP stack. Cumulus Linux (FRR) accepts the TCP session but gets stuck in BGP OPEN exchange, accumulating half-closed connections — because FRR sets the minimum TTL only after the session is accepted. Juniper has never implemented GTSM natively and relies on manually written ACLs. For robust DoS protection, hardware ACLs checking TCP port and IP TTL on external interfaces are recommended, and GTSM cannot be applied to IBGP sessions in most implementations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Arista EOS implement BGP TTL security (GTSM)? Arista EOS implements GTSM by adding an iptables rule that drops TCP packets from a BGP peer when the TTL is below 254, before the packet reaches the BGP daemon. The rule looks like: `-A BGP -s /32 -m ttl --ttl-lt 254 -j DROP`. This means low-TTL TCP SYN packets are silently discarded at the firewall layer, not processed by the TCP stack. _Network engineers hardening BGP sessions track platform-specific GTSM behavior like this on daily.dev._ ### Why does FRR BGP on Cumulus Linux not properly enforce GTSM TTL security? FRR sets the minimum TCP TTL requirement on a BGP session only after the TCP connection has already been accepted by the Linux kernel. This means a TCP SYN with a too-low TTL can complete the three-way handshake before FRR enforces the TTL check, leaving the session stuck in BGP OPEN exchange and eventually timing out — producing a backlog of half-closed FIN_WAIT1 connections. The root cause is an architectural limitation of how FRR interacts with the Linux TCP stack. _Engineers running FRR-based routers in production keep up with security behavior gaps like this on daily.dev._ ### Can GTSM be used to protect IBGP sessions? Most BGP implementations cannot apply GTSM to IBGP sessions. Because IBGP peers are typically multiple hops apart inside the network, the TTL-255 assumption that GTSM relies on does not hold. The recommended alternatives are deploying ACLs at the network edge or using IP addresses not advertised externally (such as RFC 1918 loopback addresses) for IBGP sessions and BGP router IDs. _Architects designing internal BGP topologies find discussions on IBGP security trade-offs on daily.dev._ ## Similar posts on daily.dev - [Arista cEOS Does Not Apply ACLs to Control-Plane Traffic « ipSpace.net blog](https://daily.dev/posts/arista-ceos-does-not-apply-acls-to-control-plane-traffic-ipspace-net-blog-ieh2uzhm7) · ipSpace.net Blog · 0 upvotes · 0 comments - [The Boston Diaries](https://daily.dev/posts/the-boston-diaries-mmjluio74) · Lobsters · 1 upvotes · 0 comments - [Dear Junos, Tunnels Are Not Virtual Links « ipSpace.net blog](https://daily.dev/posts/dear-junos-tunnels-are-not-virtual-links-ipspace-net-blog-1zdexbued) · ipSpace.net Blog · 0 upvotes · 0 comments - [BGP-Free Core with SR-MPLS « ipSpace.net blog](https://daily.dev/posts/bgp-free-core-with-sr-mpls-ipspace-net-blog-h7kronzy3) · ipSpace.net Blog · 0 upvotes · 0 comments - [Exploring the BGP Neighbor CONNECT State « ipSpace.net blog](https://daily.dev/posts/exploring-the-bgp-neighbor-connect-state-ipspace-net-blog-q28k0i62x) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/is-bgp-ttl-security-any-good-ipspace-net-blog-fkxwb3r28) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Is BGP TTL Security Any Good? « ipSpace.net blog","url":"https://daily.dev/posts/is-bgp-ttl-security-any-good-ipspace-net-blog-fkxwb3r28","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/is-bgp-ttl-security-any-good-ipspace-net-blog-fkxwb3r28"},"datePublished":"2026-08-11T08:52:40.975Z","dateModified":"2026-08-11T09:03:45.335Z","description":"A hands-on evaluation of BGP TTL Security (GTSM, RFC 5082) across Arista EOS, Cisco IOSv, Cisco Nexus 9300v, and Cumulus Linux. Arista EOS and Cisco Nexus use...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/is-bgp-ttl-security-any-good-ipspace-net-blog-fkxwb3r28","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,bgp","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Is BGP TTL Security Any Good? « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/is-bgp-ttl-security-any-good-ipspace-net-blog-fkxwb3r28#faq","mainEntity":[{"@type":"Question","name":"How does Arista EOS implement BGP TTL security (GTSM)?","acceptedAnswer":{"@type":"Answer","text":"Arista EOS implements GTSM by adding an iptables rule that drops TCP packets from a BGP peer when the TTL is below 254, before the packet reaches the BGP daemon. The rule looks like: `-A BGP -s /32 -m ttl --ttl-lt 254 -j DROP`. This means low-TTL TCP SYN packets are silently discarded at the firewall layer, not processed by the TCP stack. Network engineers hardening BGP sessions track platform-specific GTSM behavior like this on daily.dev."}},{"@type":"Question","name":"Why does FRR BGP on Cumulus Linux not properly enforce GTSM TTL security?","acceptedAnswer":{"@type":"Answer","text":"FRR sets the minimum TCP TTL requirement on a BGP session only after the TCP connection has already been accepted by the Linux kernel. This means a TCP SYN with a too-low TTL can complete the three-way handshake before FRR enforces the TTL check, leaving the session stuck in BGP OPEN exchange and eventually timing out — producing a backlog of half-closed FIN_WAIT1 connections. The root cause is an architectural limitation of how FRR interacts with the Linux TCP stack. Engineers running FRR-based routers in production keep up with security behavior gaps like this on daily.dev."}},{"@type":"Question","name":"Can GTSM be used to protect IBGP sessions?","acceptedAnswer":{"@type":"Answer","text":"Most BGP implementations cannot apply GTSM to IBGP sessions. Because IBGP peers are typically multiple hops apart inside the network, the TTL-255 assumption that GTSM relies on does not hold. The recommended alternatives are deploying ACLs at the network edge or using IP addresses not advertised externally (such as RFC 1918 loopback addresses) for IBGP sessions and BGP router IDs. Architects designing internal BGP topologies find discussions on IBGP security trade-offs on daily.dev."}}]} ```