6 ms·
Why are ISPs letting spoofed traffic leave their network? I don't work at that level, but I thought this was a solved problem.
by skymt 13y ago
Why are ISPs letting spoofed traffic leave their network? I don't work at that level, but I thought this was a solved problem.
- codexon 13y ago1. Because it costs time and money. 2. It doesn't help yourself. So for many companies the cost can't be justified to the shareholders.
- sargun 13y agoI imagine you're suggesting most ISPs implement BCP38? A lot of organizations implement BCP38, but the overhead of BCP38 can actually be a lot, especially once you get far above the DSLAM / CMTS. Not only is it not free, it is not straightforward. In some more complex network architectures, you don't even know what the sources of downstream packets might be (case: downstream has two transits, and they don't want to bring ingress traffic via transit B, because transit B has ridiculous pricing).
- cma 13y agoIts value is way higher than its overhead, but the overhead is paid by the guy who essentially doesn't benefit from it.
- _delirium 13y agoI agree there's a payer/benefit mismatch, since filtering your own egress only protects other people's networks. But I would've thought it would still end up being incentivized somehow through things like peering or transit contracts. I don't have a good insight into how such contracts work, so I could be way off. My assumption was that in at least some such situations the other party would care if you're feeding them bogus stuff through the link, even if you don't care, so they would be motivated to require that you do egress filtering on your end as a condition of getting the link.
- devicenull 13y agobecause it's profitable? there are providers that allow this because it gets them a lot of sales.