Hacker News Reader

Egress address verification? Are you referring to RPF, or http://www.bcp38.info/index.php/Main_Page ?

uRPF is a challenge. In some cases, the consequence is flows must route symmetrically through a given network. That's not always the most efficient, flexible, or cost-effective way to go, particularly if you're a large provider sloshing massive amounts of traffic through your network.

View on HN

smart edge, dumb core.

if edge networks implemented uRPF, it would put a huge dent in the ease of mounting DDoS attacks. unfortunately, the economics aren't there.

Agreed with your first point, but not sure about your second - how many of these attacks could really be dented with uRPF? My understanding is the majority are either distributed (coming from multiple ASes) or from compromised accounts in Azure, GC, or AWS.

If uRPF was stopping me from successfully attacking a destination, I would just not spoof. ACLs, uRPF, and anything stateful are still not going to 100% mitigate an attack from a broad range of addresses.

Reply on news.ycombinator.com