3 ms·
Couldn’t most of the UDP packet spoofing be mitigated if we mandated ISPs and networking equipment to drop packets with addresses that couldn’t have possibly or
by cebert 3y ago
Couldn’t most of the UDP packet spoofing be mitigated if we mandated ISPs and networking equipment to drop packets with addresses that couldn’t have possibly originated from downstream?
- liquidpele 3y agoMost firewalls and gateway routers already do. The issue is more for internet connected services, where backbone routing can’t do that for scale/redundancy routing reasons.
- musicale 3y agoIndeed it could, as recommended in BCP38 (mentioned in m3047's comment) and BCP84: https://www.internetsociety.org/deploy360/anti-spoofing/ https://www.internetsociety.org/deploy360/anti-spoofing/ m3047 also notes: > The simple way to avoid amplification with UDP is not to send a reply