Hacker News Reader

Comment by superkuh | Hacker News Reader

>Let's take a deep breath and discuss why such large DDoS attacks are even possible on the modern internet.

Because all traffic is treated at face value and not deep filtered and throttled according to some company's whims.

Cloudflare wants to change this. Cloudflare wants centralization. Cloudflare wants blacklists.

They are not suggesting centralization. They are suggesting bcp38 [0] This comes up quite often and people argue back and forth why they (the ISP's) can't or won't do this. Bcp38 simply requires ISP's to egress filter out IP traffic that does not belong to them.

[0] - https://tools.ietf.org/html/bcp38

Is egress filtering really that egregious?

Nope, not in the age of software defined networks. It's crazy to me this is still a problem. I worked at an ISP and VPS provider years ago on a tiny engineering team. We employed anti-spoofing at multiple layers; from the hypervisor out to the edge. It's usually just an extra line in a much larger, more complicated network config. In fact, if I were ranking the networking challenges from most to least mental cycles it would be near the bottom.

No, it's not. It's just time consuming. If you're a large ISP with several disconnected IP subnets, then it's hard to get right.

This is quite an over simplification but a large amount of the filtering, if placed close to the client, is a single line of config.

"ip verify unicast source reachable-via rx" in the Cisco world.

This should be the default.

I don't follow. Seems to me that whatever program/firmware on the router knows where to send incoming packets must also be able to trivially check and filter the addresses of outgoing ones.

Does it profit the ISPs to avoid/neglect egress filtering?

Who stands to gain from this and how much are they willing to kickback for "looking the other way"?

Bad/undesired decisions don’t require blatant corruption. This seems a simple case of poor incentives. If an ISP does egress filtering well, essentially no one notices. If they screw it up, customers lose connectivity and some portion of those customers will likely leave for a competitor. There’s risk with no reward.

Couldn't there perhaps be a financial incentive by reducing the amount of superfluous data on their networks?

Apparently not given the lack of action.

I’m not sure DDOS traffic is really significant from an egress standpoint.

There is so called "bulletproof" hosting which usually includes being able to spoof IP. So yes, there are economic incentives.

The status quo already leads to centralization and gives Cloudflare a tremendous market.

Reply on news.ycombinator.com