4 ms·

Ah, I see. But if we ever manage to get everyone behaving properly at the IPv4 level (i.e no spoofing), it opens up a whole new realm of possibilities for manag

Ah, I see. But if we ever manage to get everyone behaving properly at the IPv4 level (i.e no spoofing), it opens up a whole new realm of possibilities for managing attacks, especially DDOS floods: at the very least, ISPs would be able to notify each other of attacks originating within their networks, possibly even with some automation over a secure protocol, to automatically block packets at the source. But I could be missing something, seeing as it's 3 in the morning... and this needs to be modeled to see if it's actually viable.

tptacek 18y ago
ISPs can already do that. I think you're underestimating how frequent these attacks are; hundreds per week. Nobody can staff against that.
- lsc 18y ago
  If an attacker can not change it's IP, it is easy for the person under attack to automate the identification of an attacker. In the case of a syn flood (that is, if the attacker is sending an amount of traffic that overloads your box or application rather than your network) it's simple enough to automatically block attacking IPs. The reason why this doesn't work now is that the attackers are usually spoofing the source.
- lsc 18y ago
  it's easy to track down an attacker if they do not spoof their IP, at least to track it to the network it came from. Its something the victim can do. tracking down the network a spoofed packet came from can be quite a bit more difficult; If you have access to all your routers, you can track it to the peer or upstream the traffic is coming from, but it might be a peer of a peer of a peer (or a customer of a customer of an upstream of an upstream) requiring quite a lot of cooperation to track down.
  - khafra 18y ago
    Don't forget the first "D" in "DDoS." The Storm botnet, at its peak, had estimates between 1 and 10 million computers. Many, many more botnets have between 100,000 and 1,000,000. It would be far easier to get ISPs to cooperate with a backscatter trace on one or a few computers spoofing random IPs than to track and shut down hundreds of thousands of computers.
  - tptacek 18y ago
    That's why ISPs automate this process, with homebrew tools and by instrumenting their backbones (with things like 1:1000 netflow).

tptacek 18y ago

ISPs can already do that. I think you're underestimating how frequent these attacks are; hundreds per week. Nobody can staff against that.

lsc 18y ago
If an attacker can not change it's IP, it is easy for the person under attack to automate the identification of an attacker. In the case of a syn flood (that is, if the attacker is sending an amount of traffic that overloads your box or application rather than your network) it's simple enough to automatically block attacking IPs. The reason why this doesn't work now is that the attackers are usually spoofing the source.
lsc 18y ago
it's easy to track down an attacker if they do not spoof their IP, at least to track it to the network it came from. Its something the victim can do. tracking down the network a spoofed packet came from can be quite a bit more difficult; If you have access to all your routers, you can track it to the peer or upstream the traffic is coming from, but it might be a peer of a peer of a peer (or a customer of a customer of an upstream of an upstream) requiring quite a lot of cooperation to track down.
- khafra 18y ago
  Don't forget the first "D" in "DDoS." The Storm botnet, at its peak, had estimates between 1 and 10 million computers. Many, many more botnets have between 100,000 and 1,000,000. It would be far easier to get ISPs to cooperate with a backscatter trace on one or a few computers spoofing random IPs than to track and shut down hundreds of thousands of computers.
- tptacek 18y ago
  That's why ISPs automate this process, with homebrew tools and by instrumenting their backbones (with things like 1:1000 netflow).