Join our Newsletter — 33% off our NHI Course

Routing Protocol Poisoning

Routing protocol poisoning is an attack that corrupts routing information so traffic is sent along the wrong path. It targets protocols such as RIP, OSPF or BGP by injecting false route updates, altered metrics or forged advertisements, which can cause traffic interception, blackholing or rerouting through an attacker-controlled system.

How Routing Protocol Poisoning Works

Routing protocol poisoning corrupts the control plane of the network itself. By injecting false advertisements or altered route metrics, an attacker can persuade routers to prefer a path that should not exist, or to treat a valid destination as unreachable.

The technique matters because routing decisions are usually treated as trusted infrastructure signals. When those signals are manipulated, the network may still appear operational while traffic is quietly redirected, dropped, or stretched across a path the organisation did not intend.

Why Routing Protocol Poisoning Is Dangerous

The danger is not limited to simple outage. A poisoned route can create interception opportunities, cause traffic blackholing, or force traffic through an attacker-controlled relay where it can be observed, altered, or delayed. In distributed systems, this can also destabilise internal service reachability and make normal fault isolation much harder.

Poisoning is especially harmful when routing updates are accepted with insufficient validation, weak neighbour trust, or poor segmentation between administrative domains. The attacker does not need to break the application layer if they can change how packets move across the network.

How Organisations Check Exposure

Exposure checks should start with a complete inventory of which routing protocols are actually in use, where they are running, and which devices can inject or accept route updates. That inventory should be paired with an internet exposure review, because externally reachable routing surfaces and management planes materially widen the attack path.

Vendor advisories and protocol guidance are also important because the defensive details depend on the specific routing stack, the deployment model, and the trust relationships between peers. In practice, teams should review router configurations, neighbour authentication settings, route filtering, and any boundary between internal and external routing domains.

For distributed environments, a control-plane reference such as Distributed Systems Security Guide helps connect routing integrity to broader concerns such as consensus, node trust, and route-table poisoning.

Detection, Recovery, and Trust Restoration

Detection usually depends on comparing expected route behaviour with actual forwarding outcomes. Sudden next-hop changes, unexpected path asymmetry, unexplained reachability loss, and route flaps are all signals that the control plane may have been manipulated. Monitoring should also cover route origin changes and the appearance of unfamiliar peers or advertisements.

After containment, recovery should not stop at restoring the routing table. Teams need to confirm that no attacker-controlled path remains active, that compromised peers have been isolated, and that any management credentials or routing trust material used to alter the environment have been reviewed and rotated where compromise is plausible.

For standards-based protocol oversight, operators should consult the relevant protocol registry and standards bodies, including IANA for registries and IETF for protocol specifications and routing security work.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
CIS Controls v8 CIS-12 — Network Infrastructure Management Routing poisoning exploits weak routing infrastructure governance and trust boundaries.
Recommendation — Harden and monitor routing infrastructure, including peer trust, route filtering, and change control.
NIST SP 800-53 Rev 5 SC-7 — Boundary Protection Route poisoning crosses trust boundaries and can redirect traffic outside intended network paths.
AC-4 — Information Flow Enforcement Manipulated routing changes how information flows between network segments and peers.
Recommendation — Enforce boundary protections and control inter-domain traffic paths to reduce route manipulation risk. Apply information flow policies to restrict which routing updates and paths are accepted.
MITRE ATT&CK T1557 — Adversary-in-the-Middle Poisoned routes can place an attacker on the path for interception or alteration.
Recommendation — Detect route manipulation that enables adversary-in-the-middle positioning and path redirection.
NIST CSF 2.0 PR.DS-01 — Data-at-rest is protected Not selected
DE.CM-09 — Network connections are monitored to detect potential cybersecurity events Route poisoning is often revealed through abnormal network path behaviour and connection changes.
Recommendation — Monitor routing and path changes so poisoned advertisements and unexpected next-hops are detected quickly.