What is TTL Security Mechanism (TTLS) in BGP and what threat does it mitigate?

• A. TTLS relays BGP sessions through TTL proxies to enhance security.
• B. TTLS enables route filtering using TTL-based path vector.
• C. TTLS encrypts BGP updates based on TTL.
• D. TTLS requires TTL=1 for eBGP sessions; it mitigates remote spoofed connections attempting to form BGP sessions.

Answer: (D)

TTL Security Mechanism uses the IP TTL field to bind a BGP session to the directly connected neighbor, so the router only accepts BGP TCP connections that come from a one-hop path. By configuring the session to require a TTL value of 1, any attempt to form a BGP session from a remote network (i.e., more than one hop away) is dropped, because the packet would have traversed at least one router and its TTL would not match the expected value. This significantly reduces the risk of remote spoofed connections where an attacker tries to impersonate a neighbor by forging the source IP to hijack or misrepresent routes. TTLS does not encrypt BGP updates, nor does it involve TTL proxies or a TTL-based path vector; its purpose is specifically to guard against spoofed, non-direct-neighbor session attempts by leveraging the hop-count constraint.