nanog mailing list archives
RE: Ethernet EP - MAC Address Filtering
From: "David Luyer" <david () luyer net>
Date: Tue, 12 Feb 2002 22:01:57 +1100
My impression of "best practices" would be to: 1. implement mac-filter or mac-counters to prevent any illegally statically routed non-peer traffic.
See my response to David McGaugh's e-mail - ICMP redirects could present some serious pain here. I've seen them present pain at peering points where for some reason during a routing glitch an incorrect ICMP redirect is sent and cached by a router or host (in Australia we have news servers at some peering exchanges, run by the peering exchange), and the router or host caching the redirect then continues to route traffic via a router with an access list dropping said traffic. You could see the same if you were doing MAC-layer filtering and seeing traffic pointed directly at you due to a non-peer accepting an ICMP redirect from a peer.
2. implement traceroute scripts to check that peers are not defaulting any partial transit thru you.
Sounds like an application for a MPLS virtual network without any default or upstream routes for peer traffic, or separate routers at peering exchanges which don't have default routes or routes from peers at other peering exchanges. Rather than checking peers aren't abusing you, make sure they can't. David. -- David Luyer Phone: +61 3 9674 7525 Network Development Manager P A C I F I C Fax: +61 3 9699 8693 Pacific Internet (Australia) I N T E R N E T Mobile: +61 4 1111 BYTE http://www.pacific.net.au/ NASDAQ: PCNTF
Current thread:
- RE: Ethernet EP - MAC Address Filtering, (continued)
- RE: Ethernet EP - MAC Address Filtering Deepak Jain (Feb 11)
- RE: Ethernet EP - MAC Address Filtering Deepak Jain (Feb 11)
- RE: Ethernet EP - MAC Address Filtering Deepak Jain (Feb 11)
- Ethernet EP - MAC Address Filtering David McGaugh (Feb 11)
- Re: Ethernet EP - MAC Address Filtering David McGaugh (Feb 11)
- RE: Ethernet EP - MAC Address Filtering Deepak Jain (Feb 11)
- Ethernet EP - MAC Address Filtering David McGaugh (Feb 11)
- RE: Ethernet EP - MAC Address Filtering David Luyer (Feb 12)
- Re: Ethernet EP - MAC Address Filtering David McGaugh (Feb 11)
- Re: Ethernet EP - MAC Address Filtering Lane Patterson (Feb 11)
- RE: Ethernet EP - MAC Address Filtering David Luyer (Feb 12)