3 ms·
Egress address verification? Are you referring to RPF, or http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page ? uRPF is a chal
by ra1n85 11y ago
Egress address verification? Are you referring to RPF, or http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page ?
uRPF is a challenge. In some cases, the consequence is flows must route symmetrically through a given network. That's not always the most efficient, flexible, or cost-effective way to go, particularly if you're a large provider sloshing massive amounts of traffic through your network.
- pyvpx 11y agosmart edge, dumb core. if edge networks implemented uRPF, it would put a huge dent in the ease of mounting DDoS attacks. unfortunately, the economics aren't there.
- ra1n85 11y agoAgreed with your first point, but not sure about your second - how many of these attacks could really be dented with uRPF? My understanding is the majority are either distributed (coming from multiple ASes) or from compromised accounts in Azure, GC, or AWS. If uRPF was stopping me from successfully attacking a destination, I would just not spoof. ACLs, uRPF, and anything stateful are still not going to 100% mitigate an attack from a broad range of addresses.