5 ms·

Is it really that trivial to fake source IP? I think pretty much any ISP wouldn't let such packets through (or am I missing something?), and you are also easier

by comboy 11y ago

Is it really that trivial to fake source IP? I think pretty much any ISP wouldn't let such packets through (or am I missing something?), and you are also easier to find then (well, if you are not careful that is).

__jal 11y ago
If this was a botnot, any one ISP is only seeing a tiny fraction of the load. Even if it were from a single source, it also isn't that hard to find an ISP that doesn't care. (They cost slightly more, but if you're a bad actor, presumably it is worth it.) Edit: "I think pretty much any ISP wouldn't let such packets through" If you google "BCP38", you will find well over a decade of network operators discussing specifically this topic and the reasons why ISPs (and other networks) don't, not to mention all the fun the kvetching and meta-kvetching that accompanies any technical discussion that's lasted so long.
- cft 11y ago
  After you have been a target of ~50 Gbps NTP reflection attacks that nearly destroyed our company, it's hard to be impartial in these discussions.
  - cmdrfred 11y ago
    50gbps? Who did you piss off, damn.
r1ch 11y ago
On residential ISPs it's generally not so easy, but I think pretty much every dedicated server provider I've used has allowed spoofed source IPs.
gcommer 11y ago
It is, way too many ISPs still don't filter packets with obviously spoofed IP addresses. That said, even if the attackers in this event didn't spoof the IP address, they would almost certainly have still had a very wide distribution of addresses. > DNS root name servers that use IP anycast observed this traffic at a significant number of anycast sites. DNS root name servers are BGP anycasted: without knowing the maintenance routes, any packets you send will get routed to the topologically nearest instance. So, since the traffic source managed to hit multiple, geographically disperse anycast sites we can infer that they were able to generate traffic from worldwide traffic sources.
w8rbt 11y ago
Yes, it is (especially UDP). Many networks still don't filter properly. "The solution to this problem, described in RFC2827, which was written some 13 years ago by Paul Ferguson and Daniel Senie, is to block IP packets entering the internet which have source IP addresses which are forged..." http://tools.ietf.org/html/rfc2827.html http://tools.ietf.org/html/rfc2827.html http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
kaeso 11y ago
Reality check: ~30% of active AS worldwide don't drop spoofed packets originating from their networks. http://spoofer.cmand.org/summary.php http://spoofer.cmand.org/summary.php
- tkinom 11y ago
  It is a bit like polluting the ocean by dumping wastes. It cost less for the polluters if they are not caught. For "typical AS router", is it easy or cheap to block spoofed packets? I wonder if that test software/website can/should "OUT / Shame" the AS routing subnets as "Major Internet Polluters" and publish a monthly reports to shame that 30% polluters.
dboreham 11y ago
Certainly both our upstream providers allow through alien source address packets. This has caused me some head scratching on occasion, as in "how the #^$&#^ is this even working??". I suspect the reason is that it is non-trivial to collect and manage the list of kosher subnets once you exceed a certain size.

by comboy 11y ago

__jal 11y ago

If this was a botnot, any one ISP is only seeing a tiny fraction of the load. Even if it were from a single source, it also isn't that hard to find an ISP that doesn't care. (They cost slightly more, but if you're a bad actor, presumably it is worth it.) Edit: "I think pretty much any ISP wouldn't let such packets through" If you google "BCP38", you will find well over a decade of network operators discussing specifically this topic and the reasons why ISPs (and other networks) don't, not to mention all the fun the kvetching and meta-kvetching that accompanies any technical discussion that's lasted so long.

cft 11y ago
After you have been a target of ~50 Gbps NTP reflection attacks that nearly destroyed our company, it's hard to be impartial in these discussions.
- cmdrfred 11y ago
  50gbps? Who did you piss off, damn.

r1ch 11y ago

On residential ISPs it's generally not so easy, but I think pretty much every dedicated server provider I've used has allowed spoofed source IPs.

gcommer 11y ago

It is, way too many ISPs still don't filter packets with obviously spoofed IP addresses. That said, even if the attackers in this event didn't spoof the IP address, they would almost certainly have still had a very wide distribution of addresses. > DNS root name servers that use IP anycast observed this traffic at a significant number of anycast sites. DNS root name servers are BGP anycasted: without knowing the maintenance routes, any packets you send will get routed to the topologically nearest instance. So, since the traffic source managed to hit multiple, geographically disperse anycast sites we can infer that they were able to generate traffic from worldwide traffic sources.

w8rbt 11y ago

Yes, it is (especially UDP). Many networks still don't filter properly. "The solution to this problem, described in RFC2827, which was written some 13 years ago by Paul Ferguson and Daniel Senie, is to block IP packets entering the internet which have source IP addresses which are forged..." http://tools.ietf.org/html/rfc2827.html http://tools.ietf.org/html/rfc2827.html http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page

kaeso 11y ago

Reality check: ~30% of active AS worldwide don't drop spoofed packets originating from their networks. http://spoofer.cmand.org/summary.php http://spoofer.cmand.org/summary.php

tkinom 11y ago
It is a bit like polluting the ocean by dumping wastes. It cost less for the polluters if they are not caught. For "typical AS router", is it easy or cheap to block spoofed packets? I wonder if that test software/website can/should "OUT / Shame" the AS routing subnets as "Major Internet Polluters" and publish a monthly reports to shame that 30% polluters.

dboreham 11y ago

Certainly both our upstream providers allow through alien source address packets. This has caused me some head scratching on occasion, as in "how the #^$&#^ is this even working??". I suspect the reason is that it is non-trivial to collect and manage the list of kosher subnets once you exceed a certain size.