4 ms·

This sounds great in principle, but it breaks down in practice. From the article, 27% of ISPs still allow spoofing on their networks. This is mostly due to th

This sounds great in principle, but it breaks down in practice. From the article, 27% of ISPs still allow spoofing on their networks. This is mostly due to them being smaller, regional ISPs without the expertise or staff to figure out how to do this. I hear you saying "just blackhole them until they figure it out," but it's not that easy. In many cases, the small regional ISP is the customer of a larger ISP, who is the customer of an even larger global ISP that you are connected to. You just see XXXgbps of traffic coming from your ISP, and have no idea which one (or more) of their customer's customer's are sending the traffic. This would be like saying "just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed?

majke 10y ago
You use netflow to identify the offender of course!
- illumin8 10y ago
  LOL - there's a netflow and ipfix/ipfreely joke in there somewhere...
lucb1e 10y ago
> just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed? Sounds like a logic puzzle. I'm thinking a binary search would be the most efficient way.
- niij 10y ago
  I think K-means would work best-- whichever cluster is closest to the "hot zone" gets the boot. :P
  - lucb1e 10y ago
    How do you measure a hot zone, sensors at the bottom of the pool? Or at middle-depth but along the edges?
hueving 10y ago
Well you know the pee is coming from 1 of 3 (or maybe all 3) guys. You just threaten to kick them all out if they don't figure out which one is doing it. This is a serious problem and it should be treated with serious consequences.