3 ms·

Are there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, o

Are there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, on the server side, BGP hijacking and anycast routing are enabled by the same bug or feature, depending how you look at it.

AnimalMuppet 9y ago
There are probably legitimate uses. It seems to me that the abuses far outweigh the legitimate uses, though...
mehrdadn 9y ago
> Are there any valid technical use-cases for IP spoofing? Testing?
mjevans 9y ago
Locally, yes. Spoofing IPs is one way of having a multi-homed cluster always respond on a given IP. (Higher layers figure out what's really going on, and co-ordinate responses correctly to end clients.) In the sense of where bcp38 should be applied? I agree that it should be POSSIBLE, through some administrative means, to prove an entity does in fact own a given address range and to request the additional privilege of sending data as if it were from that range. This would be how a non-ISP obtains an independent entity allocation and sets up multi-homing. It's also how data-centers would allow a co-located server to do the same (and should require the same steps). At the more backbone levels it should be possible to automatically determine IF ingress packets are from authorized sources. Failure to do this, and failure to respond in a timely manor to filtering invalid ingress, should result in 1) those packets being rejected (and visible rejection notices sent back) 2) if the issue persists, the source of that address being blocked /entirely/ from the Internet, as a non-administered system. Grace time should likely depend on the severity of the issue (volume of problem traffic/load on the upstream filtering capacity).
omribahumi 9y ago
There’s one reason I could think of. Combining two Internet lines together to get a faster connection. I blogged about this a few years back https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmetric-lines-together/ https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmet...
- sinnet3000 9y ago
  Pretty cool! Are you still doing that??
  - omribahumi 9y ago
    Nope. The company was shut down
mindslight 9y ago
Of course there are, just like there are many valid reasons for leaving a return address off of postal mail. Imagine the anonymity of the type of P2P networks that could be built if end users could still rely on ip->saddr not being required. Broadcast a request for a specific file, and then willing/able peers could anonymously stream fountain-coded bulk data, and nobody would be able to tell who actually supplied the file.
zaarn 9y ago
There are some legit uses to faking the source of an UDP address. Usually clustering or failover. Can also be useful when you have multiple gateways to the internet. There is also, always, penetration testing where you legit want to do it to see if the network holds up to it.
tinus_hn 9y ago
Bgp hijacking is possible because bgp isn’t really authenticated. It would be difficult to authenticate but if that were done it would not prevent anycast routing.

AnimalMuppet 9y ago

There are probably legitimate uses. It seems to me that the abuses far outweigh the legitimate uses, though...

mehrdadn 9y ago

> Are there any valid technical use-cases for IP spoofing? Testing?

mjevans 9y ago

Locally, yes. Spoofing IPs is one way of having a multi-homed cluster always respond on a given IP. (Higher layers figure out what's really going on, and co-ordinate responses correctly to end clients.) In the sense of where bcp38 should be applied? I agree that it should be POSSIBLE, through some administrative means, to prove an entity does in fact own a given address range and to request the additional privilege of sending data as if it were from that range. This would be how a non-ISP obtains an independent entity allocation and sets up multi-homing. It's also how data-centers would allow a co-located server to do the same (and should require the same steps). At the more backbone levels it should be possible to automatically determine IF ingress packets are from authorized sources. Failure to do this, and failure to respond in a timely manor to filtering invalid ingress, should result in 1) those packets being rejected (and visible rejection notices sent back) 2) if the issue persists, the source of that address being blocked /entirely/ from the Internet, as a non-administered system. Grace time should likely depend on the severity of the issue (volume of problem traffic/load on the upstream filtering capacity).

omribahumi 9y ago

There’s one reason I could think of. Combining two Internet lines together to get a faster connection. I blogged about this a few years back https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmetric-lines-together/ https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmet...

sinnet3000 9y ago
Pretty cool! Are you still doing that??
- omribahumi 9y ago
  Nope. The company was shut down

mindslight 9y ago

Of course there are, just like there are many valid reasons for leaving a return address off of postal mail. Imagine the anonymity of the type of P2P networks that could be built if end users could still rely on ip->saddr not being required. Broadcast a request for a specific file, and then willing/able peers could anonymously stream fountain-coded bulk data, and nobody would be able to tell who actually supplied the file.

zaarn 9y ago

There are some legit uses to faking the source of an UDP address. Usually clustering or failover. Can also be useful when you have multiple gateways to the internet. There is also, always, penetration testing where you legit want to do it to see if the network holds up to it.

tinus_hn 9y ago

Bgp hijacking is possible because bgp isn’t really authenticated. It would be difficult to authenticate but if that were done it would not prevent anycast routing.