nanog mailing list archives
Re: Is it time to abandon bogon prefix filters?
From: Rob Thomas <robt () cymru com>
Date: Thu, 07 Aug 2008 18:13:12 -0500
Hey, Randy.
this is an extremely far cry from 60%. what am i not understanding?
There are a few factors at work here.One, the 60% figure was from 2001-03-16. There were more bogons then, and our sundry measures saw a lot more malevolence from bogon space.
A popular belief in the underground in 2001 was that spoofing in general, and the use of bogon space specifically, added a layer of protection for their collections of compromised hosts. In the age of masses of compromised routers, servers, and workstations, that's no longer a necessary defensive measure. At circa US $.04 each, bots are easily replaced. Compromised routers don't cost much more than that.
Two, we really can't compare the two (time issues aside). The 60% figure came from a study of a frequently (as in daily) attacked web site. The figures I shared today came from our Darknets, which are more global and not limited to a certain type of service or site owner.
Third, that site has been split into multiple sites (after about 2005) so unfortunately I can't easily reproduce the study from 2001. That is a real bummer.
So I'm not comparing apples and apples.We also track DDoS attacks, malware propagation, and other Internet malevolence. As a shot from the hip, I'll say we see very little abuse from bogon IP space. I won't say we see no abuse from bogon space, however, so we keep bogons automatically filtered on our border. I like to keep the online criminal toolkit as sparse as I can. :)
and can you separate reserved (127, ...) and unallocated?
I can indeed, though it'll take me a bit to do so. Again, stay tuned. Thanks, Rob. -- Rob Thomas Team Cymru http://www.team-cymru.org/ cmn_err(CEO_PANIC, "Out of coffee!");
Current thread:
- Re: Is it time to abandon bogon prefix filters?, (continued)
- Re: Is it time to abandon bogon prefix filters? Patrick W. Gilmore (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Robert E. Seastrom (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Randy Bush (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Robert E. Seastrom (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Patrick W. Gilmore (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Rob Thomas (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Rob Thomas (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Randy Bush (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Niels Bakker (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Rob Thomas (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Rob Thomas (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Patrick W. Gilmore (Aug 07)
- Re: Is it time to abandon bogon prefix filters? Patrick W. Gilmore (Aug 06)
- RE: Out of Date Bogon Prefix Nick Downey (Aug 06)