3 ms·
IP spoofing is the problem. Even if you completely ban UDP protocols, it still allows for anonymous unamplified attacks. Attacking every single protocol that d
by hueving 9y ago
IP spoofing is the problem. Even if you completely ban UDP protocols, it still allows for anonymous unamplified attacks.
Attacking every single protocol that dares to respond to a query is a pretty stupid approach IMO. Look how well it's worked so far.
Additionally, unless we switch DNS to TCP only, root and authoritative name servers are always going to provide and amplification factor and there are still more than enough of them for devastating attacks.
Agree with you about monitoring, but that wouldn't be necessary if we got serious about enforcing and blacklisting ISPs that drop the ball on BCP 38.
- yrro 9y agoWho are these ISPs? I would love to see a treemap apportioning blame to the worst offenders...
- lima 9y agoHard to tell unless you're a large ISP like CloudFlare that has direct routes to most of the internet.
- nikcub 9y agoThere is the spoofer project at CAIDA: https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php 23% of the address space, about 33% of AS's. It has improved a lot but still some way to go
- hueving 9y agoThat's the problem, it's hard to trace spoofed IPs since they are spoofed.