Discussion

and the traffic to these networks is dropped silently. (When there is a reason to have
the router send ICMP unreachable messages, use a next hop of reject instead.)
Routes with a discard next hop are placed in the forwarding table with a next-hop
type of dscd (discard).
Verify that the routes are in the routing table:
aviva@router1> show route
inet.0: 23 destinations, 23 routes (22 active, 0 holddown, 1 hidden)
+ = Active Route, - = Last Active, * = Both
1.0.0.0/8 *[Static/5] 00:03:41
Discard
2.0.0.0/8 *[Static/5] 00:00:02
Discard
They are installed in the forwarding table as discard routes:
aviva@router1> show route forwarding-table
Routing table: inet
Internet:
Destination Type RtRef Next hop Type Index NhRef Netif
1.0.0.0/8 user 0 dscd 12 3
2.0.0.0/8 user 0 dscd 12 3
A good security practice is to blackhole addresses that have not yet been allocated
by one of the domain registries, such as ARIN or RIPE (see http://www.iana.
org/assignments/ipv4-address-space). This recipe shows two of those addresses. For a
complete list, see http://www.cymru.com/gillsr/documents/junos-discard-routes.txt.
Because these addresses are not allocated and no traffic should be destined for them
anyway, you might wonder why you should bother blackholing traffic to them. One
reason is to limit a malicious hacker’s ability to attack your router with a DoS attack
from external spoofed sources. It also reduces the potential for outbound spoofing
from your network. Certain spammers may also use unallocated space to send spam,
first by announcing a prefix from unallocated space and sending their spam, then
quickly withdrawing the route. Another reason to blackhole unallocated addresses is to
reduce the possibility of prefix hijacking. For example, an AS might announce a /16,
and the spammer can announce some unused (or even used) space within the /16.
As a note of caution, unallocated-addresses space changes from time to time as new
allocations are made. You need to pay close attention to the changes and change
your filters accordingly so as not to block legitimate traffic.
See Also
Internet Assigned Numbers Authority (IANA) (http://www.iana.org/assignments/ipv4-
address-space) and Team Cymru (http://www.cymru.com/gillsr/documents/junosdiscard-routes.txt)
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.
Blackholing Routes | 265