Re: Why won't providers source-filter attacks? Simple.

[Leo Bicknell <bicknell () ufp org>]

On Feb 5, 2014, at 2:46 AM, Saku Ytti <saku () ytti fi> wrote:

> If we keep thinking this problem as last-mile port problem, it won't be solved
> in next 20 years. Because lot of those ports really can't do RPF and even if
> they can do it, they are on autopilot and next change is market forced
> fork-lift change. Company may not even employ technical personnel, only buy
> consulting when making changes.

It can be solved, but not by NANOG.

Imagine if Cable labs required all DOCSIS compliant cable modems to default
to doing source address verification in the next version of DOCSIS?  It would
(eventually) get rolled out, and it would solve the problem.  Even if it doesn't
default to on, requiring the hardware to be capable would be a nice step.

The consumer last mile is actually simpler in that there are a few organizations
who "control" the standards.  Efforts need to focus on getting the BCP38 stuff
into those standards, ideally as mandatory defaults.

-- 
       Leo Bicknell - bicknell () ufp org - CCIE 3440
        PGP keys at http://www.ufp.org/~bicknell/

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail