Hacker News Reader

Comment by mehrdadn | Hacker News Reader

Is egress filtering really that egregious?

Nope, not in the age of software defined networks. It's crazy to me this is still a problem. I worked at an ISP and VPS provider years ago on a tiny engineering team. We employed anti-spoofing at multiple layers; from the hypervisor out to the edge. It's usually just an extra line in a much larger, more complicated network config. In fact, if I were ranking the networking challenges from most to least mental cycles it would be near the bottom.

No, it's not. It's just time consuming. If you're a large ISP with several disconnected IP subnets, then it's hard to get right.

This is quite an over simplification but a large amount of the filtering, if placed close to the client, is a single line of config.

"ip verify unicast source reachable-via rx" in the Cisco world.

This should be the default.

I don't follow. Seems to me that whatever program/firmware on the router knows where to send incoming packets must also be able to trivially check and filter the addresses of outgoing ones.

Does it profit the ISPs to avoid/neglect egress filtering?

Who stands to gain from this and how much are they willing to kickback for "looking the other way"?

Bad/undesired decisions don’t require blatant corruption. This seems a simple case of poor incentives. If an ISP does egress filtering well, essentially no one notices. If they screw it up, customers lose connectivity and some portion of those customers will likely leave for a competitor. There’s risk with no reward.

Couldn't there perhaps be a financial incentive by reducing the amount of superfluous data on their networks?

Apparently not given the lack of action.

I’m not sure DDOS traffic is really significant from an egress standpoint.

There is so called "bulletproof" hosting which usually includes being able to spoof IP. So yes, there are economic incentives.

Reply on news.ycombinator.com