4 ms·
1) Hardware. ALL routers performance degrades. Sometimes up to unsuitability. 2) Software. No commonly agreed way to maintain route and route6 object. No feder
by betaby 9y ago
1) Hardware. ALL routers performance degrades. Sometimes up to unsuitability.
2) Software. No commonly agreed way to maintain route and route6 object. No federation for them
3) Administrative. Lack of network hygiene.
Keyword: BCP38
Relevant document https://tools.ietf.org/pdf/bcp38.pdf https://tools.ietf.org/pdf/bcp38.pdf
- jopsen 9y agoWouldn't it be enough to check the source IP against the ip/mask at ISP pairing sites... I suspect it might reduce out-of-network traffic a bit too.. Or ISPs could check source IPs at edge routers maybe?
- ktta 9y agoIncase of huge DoS attacks they do something similar. But with DDoS attacks the spoofed packets are coming from so many different locations that it is hard to identify them, and often it is just stuff like compromised toasters.
- buschtoens 9y ago> compromised toasters. Only on HN. Haha.
- hueving 9y agoBCP 38 on ingress at edges is trivial performance-wise (a few ACL entries in TCAM). It's just that there is no incentive to stop lazy ISPs from allowing everything since that's easier.
- betaby 9y agoIt's not few. It's a very common mistake. Say I have 20 10G ports on line card. Mid size ISP has from hundreds to thousands routes. Thus we will end up with tens of hundreds ACLs per line card. That affects performance, dramatically. Say on older yet supported Cisco 7600 you can apply about 10k entries per port, ~ 100k totaling per card. That's limit, after that performance degrades. Another question what to do on peer-peer links, like say NTT<->Centrylink? Both on them have interconnects across the globe ad sending each other hundreds of thousands prefixes on 100G ports. That's the challenge as well. Hardware is not there, it's coming slowly but not yet there. Most of the big players DO one or another form of ingress filtering on some ports. Valid point is that smaller players are arrogant ob the issue and dump all all the garbage to the upstream.
- majke 9y agoThis is why handwaving and shouting "BCP38" is not sufficient. I could live with half-baked BC38 deployment as it is now, if only I had other tools to trace malicious actors - netflow.
- hueving 9y agoDo it on ingress of regular customers or very small peering interfaces, not peering links with other ISPs. If all ISPs did this, there would be no ACL issue and BCP 38 would solve the problem. No need to make it harder than it is.