3 ms·
The vast majority of DDOS these days is due to IP spoofing, which is what is possible if you don't ingress filter. It's a simple and 100% effective technique ag
by throwaway2048 9y ago
The vast majority of DDOS these days is due to IP spoofing, which is what is possible if you don't ingress filter. It's a simple and 100% effective technique against IP spoofing, the problem is everyone on the internet needs to do it...
And something like 90%+ of IP endpoints have, that last remaining percentages is a real bitch though
http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
- pixl97 9y ago>The vast majority of DDOS these days is due to IP spoofin Um, no. Amplification attacks, and direct attacks from compromised hosts, such as IoT, are the majority of the traffic. BCP38 at the edge doesn't protect against devices spoofing their internal network address from someone else in their same subnet/routing block.
- virmundi 9y agoHow often do those kinds of attacks occur? I'm actually curious. From my research it's more common that DDoS are intersubnet rather than intra. If this is the case, why not make Comcast prevent spoofing within its own network? They're at a good place to know legit IPs. If I'm correct, we're going to need this sooner rather than later. As IoT gets rolled out (had to remove my new AC from the WiFi since it was just easier to let the install hook it up than explaining why it's a bad idea), we need to have someone be accountable for security. IoT manufactures should be on the hook, but so to the network admins.
- marcosdumay 9y agoNearly all amplification attacks require IP spoofing. Attacks from compromised hosts is another thing entirely. But even on those, IP spoofing makes it impossible to block the attack at the ISP level.