Re: DoS/DDoS Attack

[Rogan Dawes <discard () dawes za net>]

Steven wrote:
> Would it not be safe to say that a large amount of this issue could be 
> mitigated if ISPs and/or those links above them took a more responsible 
> approach to packet handling?  Wouldn't the whole issue (problem) of 
> spoofed packets be handled if they were quashed at the start instead of 
> the end? Perhaps I don't understand enough here, but it seems that 
> initially routers/switches should have the capability to drop packets 
> that could not have originated from their own network.  If new equipment 
> had the option to enforce this or had it automatically built in, would 
> this not severely mitigate some of this issue?  Is there a reason why 
> spoofed packets should be able to make their way off a LAN and across 
> the world?
>
> Perhaps this would only hold up so long until someone decided to make 
> all DDoS spoof the packet from the same network but just a different 
> host address.  Then maybe it would be possible to have the first router 
> check if the source address of the packet exactly matches where it is 
> actually coming from some how and not just that the network is valid.
>
> Perhaps I just have a weak understanding of how this works and it cannot 
> be solved so easily, but it appears that if that "some" of this is not 
> so hard to stop.  If what I have proposed is possibly and not being 
> implemented on a wide scale, then why isn't it?
>
> Steven

What you are talking about is called (in Cisco terms, anyway) Reverse 
Path Forwarding, and, in my opinion, should be used by ALL ISP's on 
their access routers. Basically, if the router receives a packet, and 
its routing tables do not show a return path going out the same 
interface it came in on, it drops the packet.

Unfortunately, it is not feasible to use something like this on internal 
routers, because it fails wherever asymmetric routing is being used. But 
for the first hop from the customer to the ISP, I think that it is 
entirely feasible to enable something like this.

For details, see http://www.cisco.com/warp/public/707/21.html#anti_spoofing

Rogan
--
Rogan Dawes

*ALL* messages to discard () dawes za net will be dropped, and added
to my blacklist. Please respond to "lists AT dawes DOT za DOT net"