LAST UPDATED: 2023-07-02
This report identifies accessible Border Gateway Protocol (BGP) servers on port 179/TCP. As explained in wikipedia, BGP is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the Internet. The current BGP protocol specification can be found in RFC 4271.
Please refer to RFC7454 BGP Operations and Security for best practice guidance.
4. Protection of the BGP Speaker The BGP speaker needs to be protected from attempts to subvert the BGP session. This protection SHOULD be achieved by an Access Control List (ACL) that would discard all packets directed to TCP port 179 on the local device and sourced from an address not known or permitted to become a BGP neighbor. Experience has shown that the natural protection TCP should offer is not always sufficient, as it is sometimes run in control-plane software. In the absence of ACLs, it is possible to attack a BGP speaker by simply sending a high volume of connection requests to it.
How we scan
We scan by sending a BGP
OPEN Message (a request to start a negotiation for a BGP session). We tag a service as open when we receive any BGP response, including a
Connection Reject response.
We do not perform any intrusive checks on a discovered service.
You can track accessible BGP servers on our Dashboard here.
As of July 1st 2023, we see around 394 000 accessible BGP servers.
BGP services should not be accessible publicly. Communication should be limited only to devices that are the expected BGP neighbors. Even if an
OPEN Message is rejected, an attacker can still for example attempt to DDoS the BGP service (which may be operated in the control-plane of the router, at significantly lower throughput than the data-plane).
This report lists all BGP services that respond in any way. For a subset list of services that respond positively to our
OPEN Message (which may result in BGP injection attacks), see our Open BGP Service Report.
For more information on our scanning efforts, check out our Internet scanning summary page.
This report has an IPv4 and IPv6 version.
Filename: population_bgp, population6_bgp