<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-bgp-security-analysis
description: >-
  Analyze BGP routing security including prefix hijack detection, route leak identification,
  RPKI validation, BGP session monitoring, and AS path anomaly detection to protect
  inter-domain routing integrity.
domain: cybersecurity
subdomain: network-security
tags:
  - bgp
  - rpki
  - routing
  - prefix-hijack
  - as-path
  - route-leak
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.002", "T1590.006", "T1020"]
  nist-csf: ["DE.CM-1", "DE.AE-2", "PR.IP-1"]
  uuid: a1b2c3d4-1003-4a00-b003-f00d00000003
---

# Performing BGP Security Analysis

## Overview

BGP is the backbone routing protocol of the internet and lacks built-in authentication.
BGP hijacks, route leaks, and prefix manipulation can redirect or intercept traffic at
scale. This skill covers RPKI ROA validation, BGP session monitoring, prefix origin
verification, AS path anomaly detection, and route leak identification.

Mode: `[MODE: BLUE]` for monitoring; `[MODE: RECON]` for route intelligence.

## Prerequisites

| Requirement | Details |
|---|---|
| RIPE RIS / RouteViews BGP data feeds or local BGP collector | Required |
| bgpq4 or bgpq3 for IRR filter generation | Required |
| rpki-client or Routinator for RPKI validation | Required |
| Zeek or custom BGP session monitor | Required |
| Access to RIPE Stat, BGPStream, or Looking Glass servers | Required |

## Key Concepts

### RPKI Validation with Routinator

```bash
# Install and run Routinator
routinator init --accept-arin-rpa
routinator server --rtr 0.0.0.0:3323 --http 0.0.0.0:8323

# Query validation status
curl -s http://localhost:8323/api/v1/validity/AS13335/1.1.1.0/24 | jq .

# Check ROA coverage for a prefix
routinator vrps --format json | jq '.roas[] | select(.prefix == "1.1.1.0/24")'
```

### BGP Prefix Hijack Detection

```bash
# Monitor BGP announcements via BGPStream
bgpstream -w 1700000000,1700003600 \
  -p routeviews -p ris \
  -k "1.1.1.0/24" \
  -e prefix-hijack

# Check origin AS for a prefix via RIPE Stat
curl -s "https://stat.ripe.net/data/routing-status/data.json?resource=1.1.1.0/24" | \
  jq '.data.last_seen.origin[]'

# Generate prefix filters from IRR
bgpq4 -4 -l prefix_list AS13335 -A
```

### Suricata BGP Session Monitoring

```
# Alert on unexpected BGP session establishment
alert tcp any any -> $HOME_NET 179 ( \
  msg:"BGP - unexpected session from non-peer"; \
  flow:to_server,established; \
  content:"|ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff|"; \
  offset:0; depth:16; \
  threshold:type limit, track by_src, count 1, seconds 3600; \
  sid:3001010; rev:1; \
  metadata:mitre_attack_technique T1557.002;)

# Detect BGP OPEN message from unauthorized source
alert tcp any any -> $HOME_NET 179 ( \
  msg:"BGP - OPEN message from non-configured peer"; \
  flow:to_server,established; \
  content:"|ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff|"; \
  content:"|01|"; offset:18; depth:1; \
  sid:3001011; rev:1;)
```

### Route Leak Analysis

```bash
# Identify route leaks — prefix seen from unexpected upstream
# Compare expected AS path with observed
curl -s "https://stat.ripe.net/data/bgp-state/data.json?resource=AS64500" | \
  jq '.data.bgp_state[] | select(.path | length > 5)'

# Check AS path for customer-provider violations
bgpstream -w 1700000000,1700003600 -e route-leak
```

## Workflow

### Step 1: Inventory Owned Prefixes and Expected Origins

Document all your announced prefixes, origin ASNs, and expected upstream paths.

### Step 2: Enable RPKI Validation

```bash
# Validate all prefixes against ROA database
routinator vrps --format json > /tmp/rpki_vrps.json
cat /tmp/rpki_vrps.json | jq '.roas | length'
```

### Step 3: Monitor for Anomalies

Set up BGPStream alerts for your prefixes and peer ASNs.

### Step 4: Respond to Incidents

Contact upstream providers, publish ROAs if missing, and document timeline.

## Detection

```yaml
title: Bgp Security Analysis Detection
id: b4102c6f-5a7d-4670-b74b-efe08396e8f0
status: experimental
description: Detects suspicious activity related to performing bgp security analysis techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1557.002
  - attack.t1590.006
  - attack.t1020
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Bgp Security Analysis Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.002, T1590.006, T1020 |

## Verification

- [ ] RPKI ROAs published for all announced prefixes
- [ ] BGP session monitoring alerts on unauthorized peers
- [ ] Prefix hijack detection tested with simulated announcement
- [ ] Route leak detection validated against known incidents
- [ ] AS path filters generated and deployed on border routers
- [ ] Alerting pipeline delivers BGP anomalies to SOC

## References

- [NIST SP 800-189: Resilient Interdomain Traffic Exchange](https://csrc.nist.gov/publications/detail/sp/800-189/final)
- [RPKI Documentation — RIPE NCC](https://rpki.readthedocs.io/)
- MITRE ATT&CK T1557.002 — ARP Cache Poisoning (routing analog)
- [BGPStream Project](https://bgpstream.caida.org/)
