4 ms·
Makes you wonder why ISPs are not discarding packets with spoofed addresses, instead of letting them escape into the greater internet. Is it too expensive to d
by daveungerer 18y ago
Makes you wonder why ISPs are not discarding packets with spoofed addresses, instead of letting them escape into the greater internet. Is it too expensive to do? My knowledge is a bit rusty, but isn't this a common router function?
- ericwaller 18y agoThere's no way to know the address is spoofed without replying to it. It's the same idea as "spoofing" the return address on a letter.
- lsc 18y agothis guy is suggesting that the mailman check the return address when he picks up the mail. It's actually a good idea (and fairly common amongst competent ISPs.) the wikipedia explains it well, I think: http://en.wikipedia.org/wiki/Ingress_filtering http://en.wikipedia.org/wiki/Ingress_filtering
- daveungerer 18y agoSorry, that's not what I meant, and I may have forgotten some terminology, so let me attempt to make myself clearer: The first edge router that a packet encounters, coming from the source, knows what the valid addresses are. The router simply needs to ask itself: "If I were to receive a return packet destined for the claimed return address, would I know what to do with it?" If invalid ones were dropped, then you can at most spoof another address in the same network. But either way, it can be traced back to the correct edge router. I'm looking for someone experienced in these matters to explain why this theory isn't / can't be put into practice.
- lsc 18y agoIt's called BCP38 and decent ISPs and competent network admins do it. I do it on the port level for all my IPv4 addresses (that is, all packets leaving a xen vps of mine are dropped unless they come from the address I assigned them.) and I will do it for IPv6 when I build out the routing infrastructure for my new location. It's really pretty easy to do... especially just edge level like you are talking about. The problem is that it costs me some time/money (even if it's only a little) to do it, and it mostly benefits other people. So some ISPs still don't do it. http://www.faqs.org/rfcs/bcp/bcp38.html http://www.faqs.org/rfcs/bcp/bcp38.html but it's really easy. on my router I look at all outgoing packets, and I ask "Does this IP have a source address that is reasonable? (one of my IPs, or an IP of someone for whom I am carrying traffic.)" If my router sees a outgoing packet with a source address not associated with me, it's obviously spoofed, so it drops the packet. If everyone did this, spoofing would only be possible within your own network. Every time an ISP does this, the world becomes a little better for all of us. But spoofing will still be a problem until all ISPs do this, and that probably won't happen for a while. (you also do this to incoming packets, if it is an incoming packet coming in from the internet and it has a source of one of my IP addresses, something has obviously gone horribly wrong. drop the packet. but this only protects you from the most obvious spoofs. It is very important if you do IP based security.)
- daveungerer 18y agoThanks, exactly what I was looking for. Now, if only we could start a movement to only use BCP38 compliant ISPs. And then convince our ISPs to reject all packets from other ISPs that have been shown to be non-compliant, in case any survived. EDIT: The way I put it may be a bit extreme, but the idea is there.
- lsc 18y agoI'm not sure it's too extreme. take it to NANOG. We'd need the support of big players, much more than one-and-a-half rack operations like me. (though bcp38 compliance is much more common amongst the big players. Heck, the provider I'm moving away from doesn't do it, something I didn't know before I signed a contract. For that matter, I only do it on outgoing IPv4. I don't do it on incoming packets or IPv6. This will be corrected in the network upgrade that is in progress now, but still.) The big problem with your proposal is verification. It seems... difficult to verify that another network properly implemented BCP38 without actually putting a probe on that network.
- chairface 18y agoI am by no means an expert, but shouldn't it be possible for the source's ISP to tell whether the source address is spoofed? edit: Looks like the OP managed a better explanation than I could since I loaded the page. Please disregard.
- tptacek 18y agoIn a likely worst case, it doesn't matter, because the traffic is coming from a botnet and could be entirely legitimate from an IPv4 perspective.
- daveungerer 18y agoCan you please expand? Not sure I understand. Also read my post a bit lower down where I attempted to clarify my question. Would appreciate your perspective.
- knowtheory 18y agoi.e. if you've got a botnet, you can still syn flood a host, and simply not respond with an ack. In such an event all of the bots on the botnet have valid IPs and are representing themselves correctly, it's just that they're not behaving as they should with regard to the TCP handshake cycle. So i gather that your suggestion would cut down on ip spoofing syn floods (but maybe not, i don't really know the full story :) ), but that wouldn't stop botnets.
- daveungerer 18y agoAh, I see. But if we ever manage to get everyone behaving properly at the IPv4 level (i.e no spoofing), it opens up a whole new realm of possibilities for managing attacks, especially DDOS floods: at the very least, ISPs would be able to notify each other of attacks originating within their networks, possibly even with some automation over a secure protocol, to automatically block packets at the source. But I could be missing something, seeing as it's 3 in the morning... and this needs to be modeled to see if it's actually viable.
- tptacek 18y agoISPs can already do that. I think you're underestimating how frequent these attacks are; hundreds per week. Nobody can staff against that.