9 ms·
There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some p
by lossolo 10y ago
There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not originate from your network. It would make ddosers life harder.
- 0xdeadbeefbabe 10y agoI suspect there is some excuse.
- ryanlol 10y ago>There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. With what hardware?
- toomuchtodo 10y agoIf you're a transit provider, peering partner, or are an eyeball or content org with networking gear, this is trivial on your edge gear. There is no excuse except laziness for not doing do. https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38 (Note: This is from May 2000)
- criddell 10y agoI agree 100%. I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.
- lucb1e 10y agoMy ISP does that (XS4ALL, the Netherlands). Of course they can't know everything but if they receive abuse reports, notice your IP got blacklisted for spam or some honeypot network got a whiff of your IP address running malware variant XYZ, they put your IP address in quarantine (only 80 and 443 outgoing I think, or maybe only to the ISP's own website or something) and ask what's going on. I can tell you they're a real pain to convince to unblock you when you are 17 and have been a bad netizen. Which is a good thing.
- hueving 10y agoWhen it comes to ip spoofing based ddos attacks, the ISPs capable of tracking spoofed traffic on their network don't allow spoofed traffic. If they don't allow the spoofed traffic, you aren't participating in the DDoS.
- criddell 10y agoAbsolutely. No ISP should allow a packet with a spoofed IP leave it's network.
- marcosdumay 10y agoIt's about blocking non-spoofed attacks.
- Sanddancer 10y agoSupport costs for shutting down the average user are higher than the costs of bandwidth. Telling someone that their internet was shut off because their device was used in a botnet would lead to very long support calls and escalations.
- criddell 10y agoThen people and businesses that are DDOS'd should be able to recover damages from the ISPs.
- amluto 10y agoI used to have a regular retail network connection at the office (local DSL carrier, not some industrial-grade expensive fiber thing) that allowed spoofing. The office was multi-homed (we had a second connection from a different provider for redundancy -- it turns out that our major local incumbent provider had maybe one nine of availability), and the results were hilarious. It turns out that, because Linux considers IP addresses to belong to a computer and not to an interface, it's fairly easy to (mis-)configure things so that traffic with a source address belonging to one interface goes out the other interface. This, coupled with spoofing being allowed, meant that we sometimes accidentally spoofed ourselves, and it worked! We went for surprisingly long times without noticing that some of our TCP connections went out one pipe and back in the other. If I remember right, we would only notice it when we were confused by packet captures, when we had strange performance problems, or when we'd discover that we suddenly had two single points of failure. :)
- jacquesm 10y agoThat would penalize a whole pile of parties that probably have nothing whatsoever to do with the spoofers. It's akin to blackholing mail from yahoo.com because there are spammers on yahoo.com.
- deleted 10y ago[deleted]
- x1798DE 10y agoIsn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?
- jacquesm 10y agoNo, if you drop the BGP route the whole range disappears, not just the host that spoofs the IPs. So it kills off a whole pile of innocents as collateral damage.
- x1798DE 10y agoI don't know if I understand. At first I thought you meant that we shouldn't drop entire providers because one of their customers spoofed an IP, but of course the burden should be on those providers to make sure spoofed packets can't leave their network (since further up the chain you're getting packets that are originating from many networks). Are you talking about something else?
- niij 10y agoBGP route is on the receiving end.
- hueving 10y agoYou stop peering with providers originating spoofed traffic. The whole point is that you don't know which host is doing it (the IP is spoofed!). All you know is that a provider is allowing spoofed packets (with a probe from participating endpoints in a measuring service). That provider should be dropped and everyone on that provider should suffer collateral damage because that's the only way to economically incentivize them.
- rvern 10y agoThere is an excuse for not "securing" the network: disallowing spoofing is not desirable in the first place. There are legitimate uses to spoofing. What is not desirable is malware infecting user computers and using spoofing for DDoS attacks, but the ISP cannot know whether the packets were sent by malware or by a user. The proper way to solve the issue is to make secure systems that will not get infected easily by malware.
- packetized 10y agoWhy is disallowing spoofing not desirable in the first place? What legitimate uses to spoofing can you enumerate? Because I see none in your comment.
- illumin8 10y agoThis sounds great in principle, but it breaks down in practice. From the article, 27% of ISPs still allow spoofing on their networks. This is mostly due to them being smaller, regional ISPs without the expertise or staff to figure out how to do this. I hear you saying "just blackhole them until they figure it out," but it's not that easy. In many cases, the small regional ISP is the customer of a larger ISP, who is the customer of an even larger global ISP that you are connected to. You just see XXXgbps of traffic coming from your ISP, and have no idea which one (or more) of their customer's customer's are sending the traffic. This would be like saying "just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed?
- majke 10y agoYou use netflow to identify the offender of course!
- illumin8 10y agoLOL - there's a netflow and ipfix/ipfreely joke in there somewhere...
- lucb1e 10y ago> just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed? Sounds like a logic puzzle. I'm thinking a binary search would be the most efficient way.