Hack the protocol! (This chapter: RIPv1)


And Yet Another Weekend Post! (YAWP)

What is RIP?
Is it really Rested In Peace already ??!!!


RIP (Routing Information Protocol) is one of the oldest IGP (Interrior Gateway Protocol) and uses Hop-Count as its metric. It comes in fact in two different flavours: 1 and 2.
Version 1 is a distance vector protocol (RFC 1058) and Version 2 is a hybrid protocol (RFCs 1721 and 1722)

Routing Information Protocol Version 1 (RIPv1) RIPv1 uses local broadcasts to share routing information in a really dummy manner 😝

These updates are periodic and occurring, by default every 30 seconds.
To prevent packets from circling around a loop forever, both versions of RIP solve counting to infinity by placing a hop count limit of 15 hops on packets. Any packet that reaches the sixteenth hop will be killed.
RIPv1 is a Classfull protocol. RIP supports up to six equal-cost paths to a single destination. Equal-Cost load balancing will take place re for  paths where the metric is same (Hop count).
Routing Information Protocol (RIPv2) is a distance vector routing protocol with some great updates and featues built into it, and it is based on RIPV1.
Therefore, it is commonly called as hybrid routing protocol.RIPv2 uses multicasts instead of broadcasts. RIPv2 supports triggered updates. when a change occurs, a RIPv2 router will immediately propagate its routing information to its connected neighbours. RIPv2 is a classless protocol and it supports variable-length subnet masking (VLSM). Both RIPv1 and RIPv2 uses hop count as the metric.



Differences between RIPv1 and RIPv2




Like in our CEH-Lab we also build this one in GNS3 and link it to a Virtual Box machine running Kali. Our objective is to build a network with three routers all using RIP for routing information exchange. We will then use the Attacker-box to inject a fake route into the network in this way divert traffic away from its real target.


If you are not familiar with RIP it is hop based system where each hop is a router in the path and traffic is routed across the shortest number of hops.


This is the topology I built:




I added an NM-4E module to each of the devices, this wasn't required technically but it gives four extra Ethernet interfaces that may come in handy later.


The following table shows the configuration of each router:




SW1 and SW2 are standard GNS3-image switches, I tried to use a 3660 with a switch module installed to give more flexibility in the future but for some reason this didn't work properly so stuck with the generic GNS3 one. C3 isn't really necessary but was useful just for  connectivity verification reasons.


Here is the configuration on each router up to this point for the sake of illustration:





Once you have set up routers, you can verify that RIP is running correctly by using the


show ip route


As the help text explains, an R in the left-hand column means the device learned the route through RIP. Assuming you have the correct routes you can check connectivity by pinging other devices.