An election office wants to harden eBGP sessions to external ISPs against multihop spoofed BGP packets. Which mechanism fits?
Select an answer to reveal the explanation.
Short Explanation
TTL security is checking that the BGP packet still has nearly a full hop count—meaning it didn’t wander in from across the Internet pretending to be your ISP. Direct peers pass; random multihop spoofs fail the TTL test.
Full Explanation
Generalized TTL Security Mechanism (GTSM) / BGP TTL security expects eBGP packets to arrive with a TTL near 255 for directly connected peers, causing multihop spoofed packets to fail the check. It complements—not replaces—TCP AO/MD5 and control-plane protections. Mismatched multihop TTL settings and OSPF authentication do not harden the eBGP TCP session the same way. Use GTSM on civic ISP-facing eBGP where adjacency is one hop.