What is a black hole in the context of network security or network architecture?

A black hole in network security or architecture is a place in the network where packets are sent but never reach their destination and are lost without notifying the sender (for example, without ICMP "Destination Unreachable"). This can be caused by:

• Intentional: Configuration of routers or firewalls to discard traffic from certain IP addresses or ports as a security measure (routing black hole).
• Unintentional: Configuration errors, hardware failures, network overloads, or attacks like Distributed Denial of Service (DDoS), where legitimate traffic is drowned in a stream of malicious traffic.

Examples of routing black hole configurations:

# Example on Cisco IOS
route-map BLACKHOLE permit 10
 set ip next-hop 192.0.2.1  # RFC 5737 Documentation IP - unreachable address
 set community no-export    # Do not advertise this route to other AS

ip route 192.168.1.0 255.255.255.0 Null0 # Sending traffic to Null0 - a special interface that discards packets

# Example on Linux (iptables)
iptables -A INPUT -s 1.2.3.4 -j DROP # Discarding packets from a specific IP

Detecting black holes can be challenging, often requiring traffic analysis (sniffers, NetFlow/sFlow) and the use of diagnostic utilities like traceroute, which can reveal anomalies or path disruptions.

Comparison table of intentional and unintentional black holes:

Characteristic	Intentional black hole	Unintentional black hole
Purpose	Security, blocking malicious traffic	Error, failure, overload, DDoS attack
Configuration	Explicit configuration of routers/firewalls	Incorrect settings, defects, or external factors
Detection	Possible through configuration analysis, logs	Difficult, requires traffic analysis and diagnostics
Notification	Absent (for the sender)	Absent (for the sender)

Black holes negatively impact service availability because any traffic entering them is irretrievably lost.