Re: [spoofing-tf] HOWTO draft

  • To: "Juan P. Cerezo" juampe@localhost
  • From: Pekka Savola pekkas@localhost
  • Date: Thu, 14 Sep 2006 08:25:56 +0300 (EEST)

On Wed, 13 Sep 2006, Juan P. Cerezo wrote:
This is the draft of the Anti-Spoofing Howto document, to be discussed on the list. There are some items to be filled yet, but people can start to comment on what's been written up to now.

I looked quickly at the first sections only.  Two comments below:

4.2.1.	 Filtering prefixes

- What to filter

Basically, IP traffic with a source address belonging to prefixes that
should not be on the routing table of routers connected to (or that
forward traffic from/to) the public Internet. The most common
characterization of these prefixes is the so-called Bogon Prefixes[1].

==> why do you recommend filtering only bogon prefixes? That's pretty useless in the grand scheme of spoofing. The more important issue is filtering out addresses which have been spoofed to be from someone else's address space.

- Where to filter On the IP hosts (if the TCP/IP stack implements this option), on the
customer (CPE) routers, on the ISP infrastructure equipment (access
routers and concentrators, DFZ routers).

==> I'd also recommend applying filtering at your peering/upstream edges: - outbound: allow out only valid addresses you give transit for (just in case you glitched somewhere, your wrong traffic won't leak out; also disables transit stealing by static routing)
 - inbound: disallow your own singlehomed addresses as source

FWIW, we've done both of these successfully for quite some time now.

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings