3 ms·
Isn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?
by x1798DE 10y ago
Isn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?
- jacquesm 10y agoNo, if you drop the BGP route the whole range disappears, not just the host that spoofs the IPs. So it kills off a whole pile of innocents as collateral damage.
- x1798DE 10y agoI don't know if I understand. At first I thought you meant that we shouldn't drop entire providers because one of their customers spoofed an IP, but of course the burden should be on those providers to make sure spoofed packets can't leave their network (since further up the chain you're getting packets that are originating from many networks). Are you talking about something else?
- niij 10y agoBGP route is on the receiving end.
- hueving 10y agoYou stop peering with providers originating spoofed traffic. The whole point is that you don't know which host is doing it (the IP is spoofed!). All you know is that a provider is allowing spoofed packets (with a probe from participating endpoints in a measuring service). That provider should be dropped and everyone on that provider should suffer collateral damage because that's the only way to economically incentivize them.