4 ms·

Why don't ISPs block packets with a source IP originating outside their network? It would shut down attacks like this in an instant, and it would save them mone

Why don't ISPs block packets with a source IP originating outside their network? It would shut down attacks like this in an instant, and it would save them money on peering costs for floods of junk traffic.

deleted 9y ago
[deleted]
tyingq 9y ago
A great idea that dates back almost 20 years, but hasn’t gained any traction. https://tools.ietf.org/html/rfc2827 https://tools.ietf.org/html/rfc2827 and https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38 It’s very similar to the issue with VOIP and caller ID spoofing. No idea why either hasn’t moved at all.
- viraptor 9y ago
  VoIP and Cid spoofing is simply due to gov not enforcing rules against it. There are valid technical reasons to allow Cid spoofing sometimes, but if you're with a reasonable provider, you usually have to sign some disclaimer that you won't abuse it and take the legal responsibility. The are probably existing laws against the abuse depending on your country. They're just not enforced. It's much easier to trace than IP traffic as well. Every internet telco will have full logs of each connection.
  - MichaelGG 9y ago
    There are a lot of technical reasons. At the wholesale level there is no way to know if a source is valid. Even AT&T routes to dozens of providers for some calls and has no idea what is going where. Even local calls from someone in your own city might end up on someone else's VoIP network to get connected. It is true though if the FCC started handing down fines that VoIP providers would require insurance/bonding all the way up. That would not fix it all but would be a large jump forward. We also need end-users to force the issue. File suits and complaints. Every time we'd receive a complaint the resolution was "we blocked that number" and "we have no further info". If there was someone pushing a lawsuit through then suddenly everyone up the supplier chain would hand over their customer info right to the real end-user. Instead, the FCC runs silly programs like their Anti-Robo-Dialer thing.
    - viraptor 9y ago
      > At the wholesale level there is no way to know if a source is valid. Only the first party needs to know the answer. The enforcing org can ask the first telco: was it your subscriber who initiated? If yes, fine the subscriber. If not, repeat with the telco that sent the call. If the last telco knowingly helped, fine it as well. > Even AT&T routes to dozens of providers for some calls and has no idea what is going where. Lol. :-) Every single connection initiated exists in very detailed CDRs. That includes the path used as well, since they have to deal with billing other telcos for handling their calls and finding the right (cheap) path at the right time. Telcos either have full records, or they lost money. I can't think of a business with more detailed record of every single transaction they make. Probably even accounting is less strict.
hannob 9y ago
Most of them do. Which the article fails to mention unfortunately. You not only need the tools, you also need to be in a network that allows you to forge sender IPs. Filtering those has been advocated for a long time (BCP38), but unfortunately there are still networks that don't do it.
ZWoz 9y ago
Theres easy answer: money. Transit ISPs asking LoA (Letter of Authorization) or whois records (like AS-SETs) from my small ISP don't ask them from big chinese or russian ISPs. Now, those chinese/russian ISPs themselves allow unfiltered route announcements probably because 1) They don't care and setting up proper system is inconvenient 2) They make money with it (known shady clients[0]) --------- [0] - https://en.wikipedia.org/wiki/Russian_Business_Network https://en.wikipedia.org/wiki/Russian_Business_Network
swiley 9y ago
I don't think a multihomed ISP can do that, but I'll be the first to admit that I don't understand internet routing all that well.
- jlgaddis 9y ago
  It's harder for a transit ISP, but your average, typical ISP isn't providing transit for a huge number of other AS's. We ($work) are pretty small but we provide transit for a handful of other AS's and I have extensive filtering everywhere. Downstream customers can advertise networks that are allocated/assigned to them and I'll accept IP traffic from those source addresses. If they send us traffic with random source IP addresses, though, it gets dropped by the router of ours that they are connected to.
mirimir 9y ago
It's not uncommon to announce an IP address from one ISP through another ISP. As long as they agree, anyway.

deleted 9y ago

[deleted]

tyingq 9y ago

A great idea that dates back almost 20 years, but hasn’t gained any traction. https://tools.ietf.org/html/rfc2827 https://tools.ietf.org/html/rfc2827 and https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38 It’s very similar to the issue with VOIP and caller ID spoofing. No idea why either hasn’t moved at all.

viraptor 9y ago
VoIP and Cid spoofing is simply due to gov not enforcing rules against it. There are valid technical reasons to allow Cid spoofing sometimes, but if you're with a reasonable provider, you usually have to sign some disclaimer that you won't abuse it and take the legal responsibility. The are probably existing laws against the abuse depending on your country. They're just not enforced. It's much easier to trace than IP traffic as well. Every internet telco will have full logs of each connection.
- MichaelGG 9y ago
  There are a lot of technical reasons. At the wholesale level there is no way to know if a source is valid. Even AT&T routes to dozens of providers for some calls and has no idea what is going where. Even local calls from someone in your own city might end up on someone else's VoIP network to get connected. It is true though if the FCC started handing down fines that VoIP providers would require insurance/bonding all the way up. That would not fix it all but would be a large jump forward. We also need end-users to force the issue. File suits and complaints. Every time we'd receive a complaint the resolution was "we blocked that number" and "we have no further info". If there was someone pushing a lawsuit through then suddenly everyone up the supplier chain would hand over their customer info right to the real end-user. Instead, the FCC runs silly programs like their Anti-Robo-Dialer thing.
  - viraptor 9y ago
    > At the wholesale level there is no way to know if a source is valid. Only the first party needs to know the answer. The enforcing org can ask the first telco: was it your subscriber who initiated? If yes, fine the subscriber. If not, repeat with the telco that sent the call. If the last telco knowingly helped, fine it as well. > Even AT&T routes to dozens of providers for some calls and has no idea what is going where. Lol. :-) Every single connection initiated exists in very detailed CDRs. That includes the path used as well, since they have to deal with billing other telcos for handling their calls and finding the right (cheap) path at the right time. Telcos either have full records, or they lost money. I can't think of a business with more detailed record of every single transaction they make. Probably even accounting is less strict.

hannob 9y ago

Most of them do. Which the article fails to mention unfortunately. You not only need the tools, you also need to be in a network that allows you to forge sender IPs. Filtering those has been advocated for a long time (BCP38), but unfortunately there are still networks that don't do it.

ZWoz 9y ago

Theres easy answer: money. Transit ISPs asking LoA (Letter of Authorization) or whois records (like AS-SETs) from my small ISP don't ask them from big chinese or russian ISPs. Now, those chinese/russian ISPs themselves allow unfiltered route announcements probably because 1) They don't care and setting up proper system is inconvenient 2) They make money with it (known shady clients[0]) --------- [0] - https://en.wikipedia.org/wiki/Russian_Business_Network https://en.wikipedia.org/wiki/Russian_Business_Network

swiley 9y ago

I don't think a multihomed ISP can do that, but I'll be the first to admit that I don't understand internet routing all that well.

jlgaddis 9y ago
It's harder for a transit ISP, but your average, typical ISP isn't providing transit for a huge number of other AS's. We ($work) are pretty small but we provide transit for a handful of other AS's and I have extensive filtering everywhere. Downstream customers can advertise networks that are allocated/assigned to them and I'll accept IP traffic from those source addresses. If they send us traffic with random source IP addresses, though, it gets dropped by the router of ours that they are connected to.

mirimir 9y ago

It's not uncommon to announce an IP address from one ISP through another ISP. As long as they agree, anyway.