Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

Cam, why would you ban UDP when you fix source routing at layer 3 instead? The amplification attacks depend on IP transit providers routing packets from ports with a source route in that packet that arrive from an interface where they could not possibly have originated. Every router knows from static inspection of its route tables which interface a packet with the bogus packets source route would get sent to it if were the destination. And it knows what interface the packet came in on. It could instantly squelch the packet right then and there if there was a mismatch.

View on HN

> Every router knows from static inspection of its route tables which interface a packet with the bogus packets source route would get sent to it if were the destination.

It's considerably more complicated than that. Also, as much as we might try, BCP38 adoption is terrible.

Given the social and technical problems with BCP38 adoption I doubt we'll see source address verification in our lifetime. It's a mess. The SAVI WG at the IETF Is working on this, but it's a very tough problem.

Internet network flows take mysterious ways. Well, not really, but it is difficult and there are szenarios where carriers would be different for inbound/outbound traffic to a certain destination. Thus, I don't think the premise that routers should know if the source of a packet is valid really holds true.

This exact suggestion is referenced in the article.

"To prevent the spoofed reflection attacks, all network operators should implement anti-spoof address filtering [RFC2827]. This prevents the trigger of the DRDoS."

http://tools.ietf.org/html/rfc2827

"This paper discusses a simple, effective, and straightforward method for using ingress traffic filtering to prohibit DoS attacks which use forged IP addresses to be propagated from 'behind' an Internet Service Provider's (ISP) aggregation point."

that doesn't help you when the spoofed packets come in on a default route because somebody else's network is poorly configured. Nor does it help the person the spoofed attack is directed at.

This sounds like a job for a coordinated botnet to experiment with. A master controller sends hosts in the botnet a list of a few other devices it controls. The infected host A sends infected host B a spoofed UDP packet (or a series of packets with different spoofing options). Host B then sends the master controller which packets it received and now a map can be made of which networks allow spoofing.

Reply on news.ycombinator.com