Detecting and Characterizing Exposed BGP Routers

RFC 7454 on BGP operations and security recommends that network operators restrict access to TCP port 179, which routers use to receive reachability messages from their peers. Reports from commercial companies indicate that around 283k IP addresses expose TCP 179 to the Internet, potentially increasing their susceptibility to denial-of-service attacks. This paper presents a detailed insight into this underexplored problem of exposed BGP routers using an Internet-wide TCP scan of port 179. We analyze device responses at both the application layer via BGP OPEN messages and transport layer (successful TCP connections, TCP RSTs, or silent drops). We identify 141,313 IP addresses that accept TCP connections and exchange OPEN messages, corresponding to 20,432 routers across 4,194 Autonomous Systems (ASes). From the OPEN messages, we infer each router’s IP addresses, the router’s type (border or internal), and assess their criticality based on connected ASes and interface IP addresses. Using an external SNMPv3 dataset, we further examine vendor distribution among exposed routers. Our study offers new insights into router exposure: we identified 1,127 border routers, 16,124 internal routers, and 4,194 ASes associated with them, including critical routers in ASes. These insights can help network operators, policymakers, and security researchers assess the security of BGP routers and their associated ASes on the Internet.