nanog mailing list archives
Re: BCP38.info
From: David Miller <dmiller () tiggee com>
Date: Tue, 28 Jan 2014 14:46:39 -0500
On 1/28/2014 2:16 PM, Jared Mauch wrote:
On Jan 28, 2014, at 1:50 PM, Valdis.Kletnieks () vt edu wrote:On Tue, 28 Jan 2014 08:06:31 -0500, Jared Mauch said:52731 ASN7922It includes IP address where you send a DNS packet to it and another IP address responds to the query, e.g.:The data only includes those where the “source-ASN” and “dest-asn” of these packets don’t match.Hang on Jared, I'm trying to wrap my head around this. You're saying that AS7922 has over 50K IP addresses which, if you send a DNS query to that IP, you get an answer back from *an entirely different ASN*? How the heck does *that* happen?Yup.
Jared, What you detected is a misconfiguration of devices on those networks, but that misconfiguration (in and of itself) is not necessarily what is commonly referred to as "IP spoofing" in the context of BCP38. You have *not* "shown" that these ASNs "allow IP spoofing". You have collected one data point that indicates the mere possibility that these ASNs allow IP spoofing. In the example that you provided, you sent a DNS query to a Pacenet (India) IP and received a response from a Vodafone (India) IP address. The IP from which you received the invalid response is an open resolver (bad thing). It is completely plausible that whatever device is being queried has interfaces on both networks. To have "shown" that this ASN "allows IP spoofing" you must have demonstrated that this response packet, sourced from a Vodafone IP, entered the "Internet" from a Pacenet router interface. Unless I am missing something here, you haven't come close to showing that. -DMM
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- BCP38.info Jay Ashworth (Jan 25)
- Re: BCP38.info Chris Grundemann (Jan 25)
- Re: BCP38.info Tony Tauber (Jan 25)
- Re: BCP38.info Jay Ashworth (Jan 26)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info TGLASSEY (Jan 28)
- Re: BCP38.info Valdis . Kletnieks (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info David Miller (Jan 28)
- Re: BCP38.info Stephen Frost (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Chris Grundemann (Jan 25)
- <Possible follow-ups>
- Re: BCP38.info Nick Olsen (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Andrei Robachevsky (Jan 29)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Nick Olsen (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Mark Andrews (Jan 28)
- Re: BCP38.info Andrei Robachevsky (Jan 29)
- Re: BCP38.info Jared Mauch (Jan 28)