Thanks.
> but once you get customers that can bring their own IPs (...)
You know these IPs though, since you route to your customer. So you could drop the offending packets. (I may be getting over my head here).
> but once you get customers that can bring their own IPs (...)
You know these IPs though, since you route to your customer. So you could drop the offending packets. (I may be getting over my head here).
Also, the routing/BGP configuration is often separate from the filtering config, so making sure things are synchronized can cause problems.
It's far less time intensive as an ISP to just not filter once it starts getting complex. After all, you don't get a lot of customer service calls when you let ill-advised packets through, but you do get calls when you break things by dropping packets your clients were authorized to send.
It may be so, however my own need for clarification was the same as yours. If ISP xyz operates a /16 ip block, and only forwards source packets from its /16... Then, I guess, my question: how do spoofed packers usually travel past their first hops on their route to the target?
[edit] after-thought: I imagine attackers might easily spoof their source as any of their ISPs /16 or /8. Feels like that's not entire story here though.