4 ms·
It's a simple fix. Just need an egress ACL. UDP packets with source IPs not from here should never make it past the edge router. Lies, damn lies and UDP packet
by w8rbt 9y ago
It's a simple fix. Just need an egress ACL. UDP packets with source IPs not from here should never make it past the edge router.
Lies, damn lies and UDP packets.
- gbhn 9y agoWhat are the reasons this has been so difficult? It seems like this must have been desirable for decades. Is the config of internal and external just tricky? Does some legitimate traffic use this so it's difficult to get everyone to switch to alternatives?
- kkirsche 9y agoThe article lists multiple related to how routing works. While great in concept it is nearly impossible in non residential spaces
- dyu 9y agoThere are some incentive misalignments. Each AS that configures it is doing it to protect its neighbors, and does not benefit from itself having configured this way. Best practice suggestions only go so far. Another aspect is, if you configure it not just with your own prefixes but also that of your peers and downstreams (and their downstreams etc), then you need a source of ground truth. (Remember that not all ASes need to announce everything they have, all the time.) This is usually an out of band database. Then you have the problem of database needing to verify the truth, and keeping all the data fresh, etc.
- kkirsche 9y agoUm, the article pretty clearly touches on why it’s difficult if not impossible for ISPs to do this.…
- raguuu 9y agotheres nothing in the article about it.
- 0xcde4c3db 9y agoMy read was that networks where traffic originates can and should prevent spoofing (edit: that is, prevent their own networks from sending spoofed traffic, not prevent others from spoofing their addresses) via egress filtering (per BCP38), whereas the stuff about FooCorp and CloudFlare is about transit/destination networks trying to prevent spoofing via ingress filtering. Did I misunderstand something?
- oarsinsync 9y agoOr just uRPF enabled on the server facing SVIs in the DC. Simples.
- ryanlol 9y agoIf we can simply ask hosts to not send packets with spoofed source addresses, then surely we can just ask them not to send any DoS attacks in the first place? Dunno, but somehow this just doesn't feel like such a realistic approach to me.