nanog mailing list archives

Re: Is it time to abandon bogon prefix filters?


From: Randy Bush <randy () psg com>
Date: Fri, 08 Aug 2008 05:14:46 +0900

How much does it help to filter the bogons? In one study conducted by
Rob Thomas of a frequently attacked site, fully 60% of the naughty
packets were obvious bogons (e.g. 127.1.2.3, 0.5.4.3, etc.)
Stated another way, you can get 60% success on bogon filtering by
ignoring the free pool

if 127.1.2.3 and 0.5.4.3 are in the free pool, we have a few more /8s in
the bank then we thought, eh? :)

btw, patrick neglected the last sentences of that paragraph, which made
me wonder what rob would actually say.  luckily, in response to my post,
rob replied that he/they would try to get some useful measures in the
near term.  i am patient.

but your post makes me inclined to beg that he/that he have a few taxa
within the bogon space.

randy


Current thread: