In
networking,
black holes refer to places in the network where incoming
traffic is silently discarded (or "dropped"), without informing the source that the data did not reach its intended recipient.
When examining the
topology of the network, the black holes themselves are invisible, and can only be detected by monitoring the lost traffic; hence the name.
Dead addresses
The most common form of black hole is simply an
IP address that specifies a host machine that is not running or an address to which no host has been assigned.
Even though
TCP/IP provides means of communicating the delivery failure back to the sender via
ICMP, traffic destined for such addresses is often just dropped.
Note that a dead address will be undetectable only to protocols that
are both connectionless and unreliable (e.g., UDP). Connection-oriented
or reliable protocols (TCP,
RUDP) will either fail to connect to a dead address or will fail to receive expected acknowledgements.
Firewalls and "stealth" ports
Most
firewalls can be configured to silently discard
packets addressed to forbidden hosts or ports, resulting in small or large "black holes" in the network.
Black hole filtering
Black hole filtering refers specifically to dropping packets at the routing level, usually using a
routing protocol to implement the filtering on several
routers at once, often dynamically to respond quickly to distributed
denial-of-service attacks.
PMTUD black holes
Some firewalls incorrectly discard all ICMP packets, including the ones needed for
Path MTU discovery to work correctly. This causes TCP connections from/to/through hosts with a lower
MTU to hang.
Black hole e-mail addresses
A black hole
e-mail address
is an e-mail address which is valid (messages sent to it will not
generate errors), but to which all messages sent are automatically
deleted, and never stored or seen by humans. These addresses are often
used as return addresses for automated e-mails.
See also
External links