# BFD Control (Diagnostic)

## Port: 3784

## Proto: UDP

## Amplification factor: ~5x

## Reflector count: ~700

---

- Bidirectional Forwarding Detection (BFD) is used to rapidly detect path transit failures, RFC 5880 is the standard and RFC 5881 is the adendum for IPv4/v6 network layer.
  - It's control packets are often used to replace tranditional slower failure detection methods such as Open Shortest Path First (OSPF)'s implementation.

- BFD itself (RFC 5880) is not at fault for CWE-406, the BFD encapsulation over IPv4/v6 with UDP (RFC 5881) is.

- Vulnerable to CWE-406 as per usual in this repo.

### Example Requests / Responses

- Request: **36 data bytes**

  - ASCII: `nothing human readable`

  - `> ~# echo -ne '\x56\xc8\xf4\xf9\x60\xa2\x1e\xa5\x4d\xfb\x03\xcc\x51\x4e\xa1\x10\x95\xaf\xb2\x67\x17\x67\x81\x32\xfb\x57\xfd\x8e\xd2\x22\x72\x03\x34\x7a\xbb\x98'|nc -u 70.51.197.238 3784 -w2`

- Response: **262 bytes**, **340 bytes average**

  - ASCII character space: `nothing human readable and it's random on every request`

  - Raw bytes (example only because of random discriminator): ` `

### Documentation

- RFC 5880: <https://tools.ietf.org/html/rfc5880>
- RFC 5881: <https://tools.ietf.org/html/rfc5881>
- Learn about BFD's use: <https://www.cisco.com/en/US/technologies/tk648/tk365/tk480/technologies_white_paper0900aecd80244005.html>

### Mitigations

- Tricky due to the randomisation done on the discriminator payload, you can map out the BFD Control message header and detect specific bytes, however by blocking it you may unintentially break some applications and networks that rely on it for IP link failover.
- Also to note BFD echo occurs on port 3785, not 3784.
