What is GTSM?

GTSM (Generalized TTL Security Mechanism) protects sessions between adjacent routers by accepting only packets whose TTL proves they came from nearby.

Defined in RFC 5082, GTSM relies on a simple fact: every router that forwards an IPv4 packet decrements its TTL (Hop Limit in IPv6), and nobody can make a packet arrive with a higher TTL than 255. Both neighbours therefore send their packets with TTL 255, and each one drops any packet for the session that arrives with less than 255 minus the number of hops allowed. For directly connected peers that means only TTL 255 is accepted. An attacker several hops away can spoof the source address, but their packets will have been decremented on the way and arrive with a lower TTL, so they are discarded cheaply, before they can reset the TCP session or consume the router's processing on the BGP connection.

Engineers most often meet GTSM on eBGP sessions to transit providers and Internet Exchange peers, alongside prefix filtering and TCP authentication (see TCP-MD5 and TCP-AO). In FRR it's configured per neighbour with neighbor <address> ttl-security hops <n>, and it can't be combined with ebgp-multihop on the same neighbour. Both ends must enable it: if only one side does, the other side's packets still arrive with TTL 1 and the session won't establish, which is the usual mistake. GTSM limits who can attack the session from afar; it doesn't help against someone on the same link. The BGP Fundamentals lesson places GTSM among the protections every production eBGP session should have.