I think the onus for this one is on ISPs who don't properly filter outgoing traffic. It's pretty simple, really, you have a block of IP addresses you allocate t

I think the onus for this one is on ISPs who don't properly filter outgoing traffic. It's pretty simple, really, you have a block of IP addresses you allocate to your customers, any outgoing traffic with a source outside of this block should be dropped. A simple iptables rule on the router handling that block would suffice. There is no legitimate use case for sending traffic with a spoofed source IP. I'm simply amazed that ISPs who should have the technical knowhow still haven't eradicated all kinds of network attacks that rely on spoofed source addresses(of which DNS amplification is only one).