nanog mailing list archives
RE: BGP TTL check in 12.3(7)T
From: "Michel Py" <michel () arneill-py sacramento ca us>
Date: Thu, 8 Apr 2004 09:40:06 -0700
Blaine Christian wrote http://www.faqs.org/rfcs/rfc3682.html I agree that it is not a panacea... But, you must admit, it provides an incredible level of comfort. It would be wonderful to only allow internally generated traffic to talk to the core of your network with a simple TTL filter. Versus anti-spoofing filters from hell.
That's not the way I see this at all. I look at it as a good complement to anti-spoofing filters as part of defense in depth, in case said filters get SNAFUed. My primary line of defense will remain ACLs. Michel.
Current thread:
- Re: BGP TTL check in 12.3(7)T, (continued)
- Re: BGP TTL check in 12.3(7)T vijay gill (Apr 08)
- RE: BGP TTL check in 12.3(7)T Blaine Christian (Apr 08)
- RE: BGP TTL check in 12.3(7)T Pekka Savola (Apr 08)
- RE: BGP TTL check in 12.3(7)T Blaine Christian (Apr 08)
- RE: BGP TTL check in 12.3(7)T Blaine Christian (Apr 08)
- Re: BGP TTL check in 12.3(7)T David Meyer (Apr 08)
- Re: BGP TTL check in 12.3(7)T vijay gill (Apr 08)
- Re: BGP TTL check in 12.3(7)T Iljitsch van Beijnum (Apr 08)
- RE: BGP TTL check in 12.3(7)T Blaine Christian (Apr 08)
- Re: BGP TTL check in 12.3(7)T Iljitsch van Beijnum (Apr 08)
- Re: BGP TTL check in 12.3(7)T Pekka Savola (Apr 08)
- RE: BGP TTL check in 12.3(7)T Tony Li (Apr 08)
- RE: BGP TTL check in 12.3(7)T Blaine Christian (Apr 08)