3 ms·
The problem for ISPs is that they can't really tell who's misbehaving. Does the user do lots of requests to a host? Maybe they're part of DDoS. Maybe they're up
by viraptor 3y ago
The problem for ISPs is that they can't really tell who's misbehaving. Does the user do lots of requests to a host? Maybe they're part of DDoS. Maybe they're uploading a file in many fragments. Maybe they have automation for that endpoint setup and the service being down causes repeating request. Maybe ... If the ISP listens to every abuse complaint, we could easily take down most residential ranges by claiming they're part of DDoS on their local Netflix PoP IP.
- mariusor 3y agoThe ISPs can tell that someone is missbehaving when their upstream informs them their IPs are taking part in a DDoS. This information can trickle down from the tier one that presently just blackholes the victim. Nobody says that infrastructure that was designed in the late eighties can't be improved upon with additional functionality, namely passing top down information about missbehaving network ranges and or IPs. As an ISP you already see devices on your network sending traffic in unusual patters, and when receive the warning that they are part of a DDoS you shut them down. If not, your whole range goes down, etc. Let's add a fourth to the three-napkin protocol.
- viraptor 3y agoGiven that right now we can't even verify BGP announcements which are a more critical target, I don't think we can tackle blocking. We'd need a realtime notification system which is not spoofable and has the ability to almost instantly boot anyone off the internet... and it needs to be reachable by nation-controlled ISPs. That's really a massive problem to solve and ensure it's not used for any other purpose. We haven't even established the trust/signing at that level yet. (see the nation-controlled CAs getting booted for spoofing domains)
- mariusor 3y agoAll good points, but it doesn't sound impossible. :)