Hacker News Reader

Comment by jacquesm | Hacker News Reader

That would penalize a whole pile of parties that probably have nothing whatsoever to do with the spoofers. It's akin to blackholing mail from yahoo.com because there are spammers on yahoo.com.

View on HN

Isn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?

No, if you drop the BGP route the whole range disappears, not just the host that spoofs the IPs. So it kills off a whole pile of innocents as collateral damage.

I don't know if I understand. At first I thought you meant that we shouldn't drop entire providers because one of their customers spoofed an IP, but of course the burden should be on those providers to make sure spoofed packets can't leave their network (since further up the chain you're getting packets that are originating from many networks). Are you talking about something else?

BGP route is on the receiving end.

You stop peering with providers originating spoofed traffic. The whole point is that you don't know which host is doing it (the IP is spoofed!). All you know is that a provider is allowing spoofed packets (with a probe from participating endpoints in a measuring service). That provider should be dropped and everyone on that provider should suffer collateral damage because that's the only way to economically incentivize them.

What legitimate purpose is there for spoofing your IP address?

I think there are probably many of them but they are hard to think of because they would relate to unusual situations. There at least one very nice that I know : if you are hosting something (eg a webserver) behind a connection with limited upload capabilities like a consumer grade DSL, you can very easily aggregate multiple uploads links with nothing more than a bit of iptable magic. It would be completely transparent to the downloading peer.

Most cases (this one included) are covered by a proper BGP setup (you advertise to each upstream) or an email conversation with the upstream ISP to get another IP allowed.

These are still likely to be IP addresses in an IP range the ISP is responsible for routing. This is the big need. ISPs need to stop packets on egress that are from IP addresses not in the ISPs network. There's no excuse for it and it would drastically undermine a sizeable number of DDoS attacks (not every DDoS, because they don't all require IP spoofing.)

Unfortunately this requires ISPs to actually be responsible for the data coming out of their network, including DDoS traffic. Once you stop the spoofing, ISPs and transit providers will soon figure out which ASs are problems and start blocking them etc.

Now that subscription based walled-gardens are becoming the new internet, I don't expect freedom (outsiders) to be much of a concern for society.

Reply on news.ycombinator.com