Route poisoning is a network failure or attack technique where bad routing information is deliberately or accidentally spread to make paths look unreachable or unsafe. In routing protocols, false updates can blackhole traffic, disrupt availability, or redirect data through unintended paths, affecting resilience, integrity, and trust in network control planes.
How route poisoning works
Route poisoning is not just a routing error, it is a way of making a route appear unusable so that routers stop selecting it. In practice, that means the control plane is told that a destination should be treated as unreachable, even when the network path may still exist.
This matters because routing protocols are supposed to converge on the best available path. When poisoned route information enters that process, the network can accept a false signal and move traffic away from the intended path, or stop forwarding it altogether.
Why route poisoning is dangerous
The core danger is that route poisoning targets trust in routing updates. If a network accepts misleading reachability information, the result can be a blackhole, an outage, or traffic steering through an unintended route that changes availability and integrity at the same time.
In dynamic networks, even a short-lived poisoning event can ripple across neighbors as the bad advertisement is propagated. The operational impact is often larger than the initial fault because convergence behaviour can amplify the disruption.
Common failure conditions
Route poisoning can happen accidentally through misconfiguration, stale topology information, or unstable routing peers. It can also be used deliberately by an attacker who can inject false routing updates or interfere with routing adjacencies.
The failure mode is especially serious when the poisoned information affects a shared routing domain, a critical edge, or a route that many downstream systems depend on. In those cases, one bad update can change path selection for a wide part of the environment.
How defenders reduce exposure
Defenders reduce exposure by limiting who can speak routing, validating protocol peers, and tightly monitoring routing changes for unexpected withdrawals, metric shifts, or route flapping. Separation of administrative domains and strong network segmentation also help constrain the blast radius of bad routing information.
Operational monitoring should treat routing changes as security-relevant events, not just performance noise. If a route disappears, reappears, or moves unexpectedly, the issue may be a fault, but it may also be evidence of deliberate manipulation of the control plane.
Risk and Threat Considerations
Route poisoning creates a direct availability risk because it can blackhole traffic or force packets onto unintended paths. It also creates a trust risk, since the network depends on the assumption that routing advertisements are truthful and timely.
Failure mechanism: A poisoned advertisement convinces peers that a destination is unreachable or undesirable, so they withdraw or reroute traffic based on false control-plane state.
Impact: The result can be outage, degraded reachability, asymmetric routing, traffic interception opportunities, and difficult-to-diagnose instability across the routed environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest | Route poisoning threatens trustworthy network path selection and traffic integrity. |
| DE.CM-09 — Configuration changes | Unexpected routing updates are a configuration-change signal that can reveal poisoning. | |
| GV.SC-01 — Cybersecurity supply chain risk management strategy | Routing dependencies and trust boundaries require explicit control over external and internal routing relationships. | |
| Recommendation — Protect routing integrity by constraining route sources and validating unexpected path changes. Monitor routing updates and investigate unexpected withdrawals, metric shifts, and path changes. Define trust and change-authorisation rules for routing peers and inter-domain connectivity. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Routing poisoning exploits control over network boundaries and traffic direction. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Routing anomalies need review and correlation to detect control-plane manipulation. | |
| Recommendation — Enforce boundary protections that limit who can influence routing across trust zones. Review routing logs and alerts for anomalous advertisements, withdrawals, and path churn. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Route poisoning is governed by secure management of routing infrastructure and trust paths. |
| Recommendation — Harden routing infrastructure, restrict administrative access, and validate configuration changes. | ||
| MITRE ATT&CK | T1090 — Proxy | Route manipulation can reroute traffic through unintended intermediary paths. |
| Recommendation — Map traffic redirection paths and hunt for infrastructure that alters network flow control. | ||
Practitioner Guidance
What to watch for: Investigate sudden route withdrawals, repeated metric changes, unexpected path shifts, and convergence loops. Those patterns often distinguish a poisoned update from ordinary routing churn.
Governance implication: Treat routing policy, peer trust, and change control as part of network security ownership, not only network engineering. Clear accountability matters because a poisoned route can look like a routine routing event until service impact appears.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org