RIP
Routing Information ProtocolRIP is routing by rumour. Each router simply tells its neighbours the list of networks it can reach and how many hops away they are, and they pass it on with one added to each count. It is simple to the point of being fragile — and largely of historical interest now.
RIP shares a list of destinations and hop counts with its neighbours — easy to run, slow to converge, and capped at 15 hops.
How it works
Every 30 seconds a router broadcasts its whole routing table to its neighbours.
A neighbour that accepts a route adds one to the count and advertises it onward.
The lowest hop count wins — regardless of whether that link is fast or slow.
No router ever sees the topology — only what its neighbours claim. That is why a failure takes minutes to propagate, and why a hop count of 16 has to mean “unreachable” to stop a count-to-infinity loop.
What RIP does, step by step
Every thirty seconds a router sends its full list of known networks and their hop counts.
A neighbour records any better route it hears, adding one hop, and points at the sender as next hop.
A route not refreshed within 180 seconds is marked unreachable, then removed.
Split horizon, poison reverse and hold-down timers exist purely to stop bad news circulating forever.
In cybersecurity
RIP believes whatever a neighbour says and, in its first version, had no authentication at all — so on any reachable segment it is trivially poisoned.
An unauthenticated update advertising a low hop count pulls traffic to the attacker.
It supports a shared key — plain text in the original spec, and MD5 at best.
RIPv1 broadcasts the entire routing table to the segment, mapping the network for anyone listening.
Minutes of stale routing after a failure is a denial of service in its own right.
Never send updates out of a port that faces users or servers.
On any modern network the honest security advice is to not run RIP at all.