Re: [spoofing-tf] HOWTO draft

[Pekka Savola pekkas@localhost]

On Wed, 13 Sep 2006, Juan P. Cerezo wrote:
> This is the draft of the Anti-Spoofing Howto document, to be 
> discussed on the list. There are some items to be filled yet, but 
> people can start to comment on what's been written up to now.

I looked quickly at the first sections only.  Two comments below:

4.2.1.	 Filtering prefixes

- What to filter

Basically, IP traffic with a source address belonging to prefixes that
should not be on the routing table of routers connected to (or that
forward traffic from/to) the public Internet. The most common
characterization of these prefixes is the so-called Bogon Prefixes[1].

==> why do you recommend filtering only bogon prefixes?  That's pretty 
useless in the grand scheme of spoofing.  The more important issue is 
filtering out addresses which have been spoofed to be from someone 
else's address space.

- Where to filter 
On the IP hosts (if the TCP/IP stack implements this option), on the
customer (CPE) routers, on the ISP infrastructure equipment (access
routers and concentrators, DFZ routers).

==> I'd also recommend applying filtering at your peering/upstream 
edges:
 - outbound: allow out only valid addresses you give transit for (just 
in case you glitched somewhere, your wrong traffic won't leak out; 
also disables transit stealing by static routing)
 - inbound: disallow your own singlehomed addresses as source

FWIW, we've done both of these successfully for quite some time now.

--
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings