3 ms·

Too bad this was written as a Cloudflare advert, instead of emphasizing the changes that ISPs need to make (ingress source address verification) to make these a

by cft 11y ago

Too bad this was written as a Cloudflare advert, instead of emphasizing the changes that ISPs need to make (ingress source address verification) to make these attacks much harder. https://www.ietf.org/rfc/rfc2827.txt https://www.ietf.org/rfc/rfc2827.txt

ra1n85 11y ago
Egress address verification? Are you referring to RPF, or http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page ? uRPF is a challenge. In some cases, the consequence is flows must route symmetrically through a given network. That's not always the most efficient, flexible, or cost-effective way to go, particularly if you're a large provider sloshing massive amounts of traffic through your network.
- pyvpx 11y ago
  smart edge, dumb core. if edge networks implemented uRPF, it would put a huge dent in the ease of mounting DDoS attacks. unfortunately, the economics aren't there.
  - ra1n85 11y ago
    Agreed with your first point, but not sure about your second - how many of these attacks could really be dented with uRPF? My understanding is the majority are either distributed (coming from multiple ASes) or from compromised accounts in Azure, GC, or AWS. If uRPF was stopping me from successfully attacking a destination, I would just not spoof. ACLs, uRPF, and anything stateful are still not going to 100% mitigate an attack from a broad range of addresses.
jgrahamc 11y ago
We've written about BCP 38 repeatedly: https://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks/ https://blog.cloudflare.com/understanding-and-mitigating-ntp... https://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack/ https://blog.cloudflare.com/technical-details-behind-a-400gb... https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho/ https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-o...
- sargun 11y ago
  uRPF is a pain to people who want to do any kind of creative TE with their network. For residential networks, I somewhat understand the value, but it makes dual homing unreasonable for anyone who doesn't have an ASN + BFP sessions. I'd argue rather than this, we need to be able take Flowspec (RFC5575), and make it more reasonable for transit.
betaby 11y ago
Good in theory - doesn't work in practice, at all, really. Imagine, lets say, still good MX960 with 3D 32x10GE line cards, now to apply mid size (10k lines) ACL on every port and see performance and stability. BCP38 in reality should be really-really on the edge of the consumer based ISPs, can't be applier to Tier1 and Tier2 ISPs where many believe it should be.

by cft 11y ago

ra1n85 11y ago

Egress address verification? Are you referring to RPF, or http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page ? uRPF is a challenge. In some cases, the consequence is flows must route symmetrically through a given network. That's not always the most efficient, flexible, or cost-effective way to go, particularly if you're a large provider sloshing massive amounts of traffic through your network.

pyvpx 11y ago
smart edge, dumb core. if edge networks implemented uRPF, it would put a huge dent in the ease of mounting DDoS attacks. unfortunately, the economics aren't there.
- ra1n85 11y ago
  Agreed with your first point, but not sure about your second - how many of these attacks could really be dented with uRPF? My understanding is the majority are either distributed (coming from multiple ASes) or from compromised accounts in Azure, GC, or AWS. If uRPF was stopping me from successfully attacking a destination, I would just not spoof. ACLs, uRPF, and anything stateful are still not going to 100% mitigate an attack from a broad range of addresses.

jgrahamc 11y ago

We've written about BCP 38 repeatedly: https://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks/ https://blog.cloudflare.com/understanding-and-mitigating-ntp... https://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack/ https://blog.cloudflare.com/technical-details-behind-a-400gb... https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho/ https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-o...

sargun 11y ago
uRPF is a pain to people who want to do any kind of creative TE with their network. For residential networks, I somewhat understand the value, but it makes dual homing unreasonable for anyone who doesn't have an ASN + BFP sessions. I'd argue rather than this, we need to be able take Flowspec (RFC5575), and make it more reasonable for transit.

betaby 11y ago

Good in theory - doesn't work in practice, at all, really. Imagine, lets say, still good MX960 with 3D 32x10GE line cards, now to apply mid size (10k lines) ACL on every port and see performance and stability. BCP38 in reality should be really-really on the edge of the consumer based ISPs, can't be applier to Tier1 and Tier2 ISPs where many believe it should be.