GTSM

Stands for: Generalized TTL Security Mechanism

A check that accepts a protocol's packets only when they arrive with TTL 255, so they cannot have crossed a router.

RFC 5082 defines it: senders set the TTL or Hop Limit to 255, and since every router decrements it, a receiver that demands 255 drops packets forged from further away. BFD, VRRP and directly connected BGP sessions use it; it is no substitute for authentication.

RFC 5082, October 2007, which obsoletes RFC 3682, says the TTL of every packet of a GTSM-enabled session MUST be 255. Its premise is that TTL spoofing is considered nearly impossible, so an expected value gives a simple and reasonably robust defence against forged protocol packets from outside the network. A packet that has crossed even one router arrives with 254 at most.

Single-hop BFD applies it strictly: control packets leave with TTL 255 and, without authentication, are discarded on receipt if the value is anything else. VRRP version 3 does the same, which limits most of its vulnerabilities to the local network, and RFC 7454 says operators SHOULD use TTL security on directly connected BGP peerings. OSPF's multicast packets take the opposite approach, TTL 1, so that they never leave the link.

The limits are in RFC 5082 itself: GTSM is not a substitute for authentication and does not protect against an insider on the wire spoofing or replaying packets. It also cannot span several hops, which is why multihop BFD relies on authentication instead, and RFC 5880 notes that an echoed BFD packet loses one from its TTL, leaving echo spoofing possible from one hop away.

Also known as: generalized ttl security mechanism, ttl security, ttl-security, ttl 255

Sources

← All glossary entries