7 ms·
Simple - egress filtering: https://en.wikipedia.org/wiki/Egress_filtering https://en.wikipedia.org/wiki/Egress_filtering If every large network operator did t
by johnklos 5y ago
Simple - egress filtering:
https://en.wikipedia.org/wiki/Egress_filtering https://en.wikipedia.org/wiki/Egress_filtering
If every large network operator did this, then shutting down abusive hosts used to generate the kind of traffic needed for attacks like these would be possible.
You'd make a list of all the IPs for each large provider from which excess traffic is coming, and you'd send them to each large provider, and they'd either block the IPs completely (requiring customers to fix their compromised machines before they could get back on the Internet), or at very least they would block all traffic to the destination of the attack.
Some silly people think this isn't possible, but if large providers are forced to do it, then they can easily tell smaller ones they'll be blocked if they don't also do this, and so on, and we'd have a slightly more responsible Internet again.
Too bad we have shitty, huge companies that don't care about doing the right thing :(
- yjftsjthsd-h 5y ago> Some silly people think this isn't possible, but if large providers are forced to do it, then they can easily tell smaller ones they'll be blocked if they don't also do this, and so on, and we'd have a slightly more responsible Internet again. > Too bad we have shitty, huge companies that don't care about doing the right thing :( There's no call to be dismissive of anyone who disagrees with you; maybe you're "silly" for believing that companies will threaten each other for no reason (that they care about).
- Jweb_Guru 5y agoNope, they are basically right and it's a source of endless frustration to security researchers that these very simple problems are still thinks that have to be dealt with in 2021.
- malikNF 5y agoUsually I would agree. But not in this instance. It really is silly some isps are not doing this by default, just fixing this will reduce so many types of ddos attacks. The current size of ddos attacks are just insane. And thabks to these attacks decentralized nature of the internet is eroding everyday.
- Hikikomori 5y agoNo, the solution is ingress filtering and a lot of ISPs do it these days, see bcp38.
- johnklos 5y agoHuh? Ingress filtering is filtering traffic coming in to your network. How are you supposed to know whether traffic coming from a certain peer actually legitimately originates from that peer? Egress filtering is filtering traffic that exits your network. It's your network, so you should know with absolute certainty whether it's real - either the source is one of your networks, or it isn't, and if it's not, you drop it. Please explain how ingress filtering is supposed be the better solution.
- Hikikomori 5y agoWe are almost talking about the same thing. But it's better to accomplish this on all your customer links, otherwise they can still spoof within your network. Read up on bcp38? This is from the first hit on Google: Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
- deleted 5y ago[deleted]
- toast0 5y ago> Some silly people think this isn't possible, but if large providers are forced to do it, then they can easily tell smaller ones they'll be blocked if they don't also do this, and so on, and we'd have a slightly more responsible Internet again. You go ahead and force a large provider to do it, and let us know how. From what I can tell from reading NANOG mailing list posts off and on for decades is that most of the larger providers really won't be bothered to do this, and there's not any effective leverage to force them.
- rasz 5y agoTelcos also tried claiming its impossible to secure SS7, and here we are in 2021 finally getting Stir/Shaken implemented https://www.fcc.gov/spoofed-robocalls https://www.fcc.gov/spoofed-robocalls
- mr_toad 5y ago> Too bad we have shitty, huge companies that don't care about doing the right thing :( The situation is not really different from dumping waste in the nearest stream. It’s naive to think that companies wont just act in their own best interest unless they are forced to clean up their act.
- stingraycharles 5y agoSo what you’re saying is that legislation would help here?