Hacker News Reader

Couldn’t most of the UDP packet spoofing be mitigated if we mandated ISPs and networking equipment to drop packets with addresses that couldn’t have possibly originated from downstream?

View on HN

Most firewalls and gateway routers already do. The issue is more for internet connected services, where backbone routing can’t do that for scale/redundancy routing reasons.

Indeed it could, as recommended in BCP38 (mentioned in m3047's comment) and BCP84:

https://www.internetsociety.org/deploy360/anti-spoofing/

m3047 also notes:

> The simple way to avoid amplification with UDP is not to send a reply

Reply on news.ycombinator.com