Re: DoS/DDoS Attack

[Barrie Dempster <barrie () reboot-robot net>]

On Sat, 2005-01-15 at 12:03 -0500, Steven wrote: 
> Would it not be safe to say that a large amount of this issue could be 
> mitigated if ISPs and/or those links above them took a more responsible 
> approach to packet handling?  Wouldn't the whole issue (problem) of spoofed 
> packets be handled if they were quashed at the start instead of the end? 
> Perhaps I don't understand enough here, but it seems that initially 
> routers/switches should have the capability to drop packets that could not 
> have originated from their own network.  If new equipment had the option to 
> enforce this or had it automatically built in, would this not severely 
> mitigate some of this issue?  Is there a reason why spoofed packets should 
> be able to make their way off a LAN and across the world?

You understand this fine. It's perfectly acceptable for an ISP to do
this and it's not difficult to implement in their ACLs. Some ISP's do
this already but they are a minority. IMO ISP's should do this as
standard, but most wont.

> Perhaps this would only hold up so long until someone decided to make all 
> DDoS spoof the packet from the same network but just a different host 
> address.  Then maybe it would be possible to have the first router check if 
> the source address of the packet exactly matches where it is actually coming 
> from some how and not just that the network is valid.

Doesn't matter, if you can track it to the ISP then the ISP techs can
monitor their network and see exactly where it's coming from. You
couldn't bypass the protection in this way as, when you get to the
source ISP, recognising the customer is trivial and then finding the
specific box just takes time.

> Perhaps I just have a weak understanding of how this works and it cannot be 
> solved so easily, but it appears that if that "some" of this is not so hard 
> to stop.  If what I have proposed is possibly and not being implemented on a 
> wide scale, then why isn't it?
> Steven

Simply because the public mostly doesn't care and the public are the
customers. As more customers have trouble with this then the ISPs
probably will make changes. Until then they don't see this as a
financially beneficial measure.

With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue

  http://www.bsrf.org.uk

[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]

Attachment: signature.asc
Description: This is a digitally signed message part