[atlas] "Spoofing" tests.
Tapio Sokura tapio.sokura at iki.fi
Sun Sep 15 05:08:54 CEST 2013
On 15.9.2013 5:16, Randy Bush wrote: >> A concrete demonstration on the prevalence(?) of networks allowing >> source address spoofing would help in getting this hole plugged > > a jillion spoofed botnets did not make the point pretty clearly? Yes, but because they are spoofed, it's not easy to determine which networks are the ones that allow spoofing. > what useful is actually being measured? unless it's a name and shame > game. and then you will want to know if things 'improve' over time, > which means it is not a one-shot. Name and shame can work in some cases. And yes, I'd like to see a trend, i.e. not making this a one-shot deal. Even if there is a bias towards probes being in networks that care, the way the figures change over time (derivative) should be less biased. Tapio