4 ms·
You don't change the resolver. ISPs need to drop UDP packets leaving their networks where the (spoofed) headers declare that they did not originate there. That
by mdpye 14y ago
You don't change the resolver. ISPs need to drop UDP packets leaving their networks where the (spoofed) headers declare that they did not originate there. That way an attacker can't spoof the originator to have the responses directed at someone else.
Edit: clarity on actual vs declared origin
- dasil003 14y agoIt also seems like a tractable problem in that upstream providers can test for the vulnerability and shut down uplinks for non-compliant customers.
- jiggy2011 14y agoThat would cost some amount of money for an ISP to implement, and you need to get the major ISPs (most of them are not in the USA, many are in places like China) to all apply it.