4 ms·

Thanks. > but once you get customers that can bring their own IPs (...) You know these IPs though, since you route to your customer. So you could drop the of

Thanks. > but once you get customers that can bring their own IPs (...) You know these IPs though, since you route to your customer. So you could drop the offending packets. (I may be getting over my head here).

vgb2k18 5y ago
> I may be getting over my head here) It may be so, however my own need for clarification was the same as yours. If ISP xyz operates a /16 ip block, and only forwards source packets from its /16... Then, I guess, my question: how do spoofed packers usually travel past their first hops on their route to the target? [edit] after-thought: I imagine attackers might easily spoof their source as any of their ISPs /16 or /8. Feels like that's not entire story here though.
- tw04 5y ago
  I think you're still missing the point. Let's say I run John Doe's chop shop. I have purchased my own /24 (192.168.1.0/24). I want redundant connectivity so I have service from Comcast and qwest. I use bgp to decide every I'm routing my IP through Comcast or qwest at any given moment so they both need to allow traffic from that IP space even though it may not be from me. X100000. So it's easier to just not filter at all.
  - paledot 5y ago
    "I have 192.168.1.0/24 to sell you..."
    - exikyut 5y ago
      "Ignore that guy. I'll offer you 172.16.0.0/12 for the same price."
toast0 5y ago
The routing need not be symmetric. If I've got two /24s and two ISPs, maybe I advertise each /24 on only one ISP, for traffic engineering purposes (I want to steer some of my clients to send through one ISP and some clients to send through another), but that doesn't mean I want or need to send the return traffic back through the same way it came in. Also, the routing/BGP configuration is often separate from the filtering config, so making sure things are synchronized can cause problems. It's far less time intensive as an ISP to just not filter once it starts getting complex. After all, you don't get a lot of customer service calls when you let ill-advised packets through, but you do get calls when you break things by dropping packets your clients were authorized to send.

vgb2k18 5y ago

> I may be getting over my head here) It may be so, however my own need for clarification was the same as yours. If ISP xyz operates a /16 ip block, and only forwards source packets from its /16... Then, I guess, my question: how do spoofed packers usually travel past their first hops on their route to the target? [edit] after-thought: I imagine attackers might easily spoof their source as any of their ISPs /16 or /8. Feels like that's not entire story here though.

tw04 5y ago
I think you're still missing the point. Let's say I run John Doe's chop shop. I have purchased my own /24 (192.168.1.0/24). I want redundant connectivity so I have service from Comcast and qwest. I use bgp to decide every I'm routing my IP through Comcast or qwest at any given moment so they both need to allow traffic from that IP space even though it may not be from me. X100000. So it's easier to just not filter at all.
- paledot 5y ago
  "I have 192.168.1.0/24 to sell you..."
  - exikyut 5y ago
    "Ignore that guy. I'll offer you 172.16.0.0/12 for the same price."

toast0 5y ago

The routing need not be symmetric. If I've got two /24s and two ISPs, maybe I advertise each /24 on only one ISP, for traffic engineering purposes (I want to steer some of my clients to send through one ISP and some clients to send through another), but that doesn't mean I want or need to send the return traffic back through the same way it came in. Also, the routing/BGP configuration is often separate from the filtering config, so making sure things are synchronized can cause problems. It's far less time intensive as an ISP to just not filter once it starts getting complex. After all, you don't get a lot of customer service calls when you let ill-advised packets through, but you do get calls when you break things by dropping packets your clients were authorized to send.