Port 179 – BGP

TCP

Port 179 is the BGP (Border Gateway Protocol) port used by routers to exchange routing information between autonomous systems. BGP hijacking via port 179 can redirect internet traffic through malicious networks. Protect with MD5 TCP authentication (RFC 2385), RPKI validation, and prefix filtering.

Port Number

179

Protocol

TCP

Service

Border Gateway Protocol

Range

IANA Well-Known (0–1023)

Description

BGP peers establish TCP connections on port 179 to exchange routing tables between autonomous systems. A single misconfigured BGP announcement on port 179 can blackhole traffic for millions of users – as demonstrated by YouTube's 2008 Pakistan outage and Cloudflare's 2019 route leak. BGP sessions on port 179 must be protected with TCP MD5 signatures (RFC 2385) or TCP-AO (RFC 5925) to prevent session hijacking. RPKI (Resource Public Key Infrastructure) validates that route announcements originate from authorized ASNs. Most ISPs filter BGP sessions on port 179 to accept only configured peer addresses via ACLs.

Security risks

1Route hijacking (prefix hijacking): attacker announces more-specific prefixes via BGP, redirecting victim's traffic through attacker's network (2018 Amazon Route 53 BGP hijack stole cryptocurrency, 2022 Russia hijacked Twitter/Facebook prefixes)
2CVE-2023-38802: FRRouting BGP crash via crafted UPDATE messages – remote attacker causes denial-of-service on BGP routers running FRR (used by many SDN deployments)
3BGP session teardown: TCP RST injection on port 179 disconnects BGP peers, causing route flapping and potential black-holing of traffic for minutes
4No built-in authentication (default): BGP peers establish sessions without verifying identity. MD5 (TCP-MD5, RFC 2385) is widely used but considered weak. TCP-AO (RFC 5925) is the modern replacement
5Route leak (AS path manipulation): misconfigured or malicious ASes propagate routes they shouldn't, causing global routing disruptions (2019 Verizon/Cloudflare 3-hour outage from route leak)

Firewall guidance

Port 179 should only be reachable from explicitly configured BGP peer IPs. Use ACLs on every router: permit TCP 179 only from known peer addresses. Enable TCP-MD5 signature (or TCP-AO where supported). Deploy RPKI (Resource Public Key Infrastructure) to validate route origin. Use maximum-prefix limits to prevent route table overflow from malicious peers.

Diagnosis commands

Cisco: show all BGP peers, their state, prefixes received, and uptime

shell

show ip bgp summary

BIRD: detailed BGP session state including hold timer and import/export filters

shell

birdc show protocols all bgp1

FRRouting: BGP table statistics (total prefixes, paths, memory usage)

shell

vtysh -c 'show bgp ipv4 unicast statistics'

Capture BGP packets to debug session establishment or detect unauthorized peers

shell

tcpdump -i eth0 port 179 -c 10

Usage examples

Port 179 – BGP

shell

show ip bgp summary
neighbor 10.0.0.1 remote-as 64512
tcpdump -i eth0 tcp port 179

Common services on this port

Cisco IOS/IOS-XR BGPJuniper Junos BGPFRRouting (open-source)BIRD (Linux routing daemon)OpenBGPD

Related ports

179

BGP (this port)

646

LDP (MPLS label distribution)

1790

BFD (bidirectional forwarding detection)

History

BGP was created in 1989 (RFC 1105) to replace EGP as the inter-domain routing protocol of the internet. BGP-4 (RFC 4271, 2006) is the current version. Port 179 was assigned by IANA. BGP was designed with trust – peers are assumed to be legitimate ISPs. RPKI (RFC 6480, 2012) adds cryptographic verification of route origins. Despite being critical infrastructure, BGP security adoption is slow: only ~40% of routes are RPKI-signed globally (2024).

FAQ

How does RPKI protect against route hijacking?

RPKI creates ROAs (Route Origin Authorizations) that cryptographically bind IP prefixes to authorized ASNs. When a BGP router receives a route, it validates the origin AS against the RPKI repository. Invalid routes (wrong origin AS) are rejected or de-prioritized. Setup: sign your prefixes in your RIR portal (ARIN, RIPE), configure your routers to validate (rpki-client + FRR/BIRD validation). Only protects against origin hijacking, not path manipulation.

MD5 vs TCP-AO for BGP authentication?

TCP-MD5 (RFC 2385): widely deployed, uses shared secret for packet authentication, protects against session hijack/RST injection. Weaknesses: MD5 is cryptographically broken, no key rollover mechanism (changing keys drops the session), per-packet computation overhead. TCP-AO (RFC 5925): modern replacement with SHA-256+, key chains with rollover, MKT (Master Key Tuples) for seamless rotation. Adoption: TCP-AO support exists in Cisco IOS-XR, Junos, and Linux kernel but is not yet universal.

Specification

RFC 4271 – Port 179 specification →