Live data from Hacker News

The real reason for large DDoS attacks? It's IP Spoofing, not memcached

blog.cloudflare.com

11–20 of 38 posts

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#11

Are there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, on the server side, BGP hijacking and anycast routing are enabled by the same bug or feature, depending how you look at it.

Locally, yes. Spoofing IPs is one way of having a multi-homed cluster always respond on a given IP. (Higher layers figure out what's really going on, and co-ordinate responses correctly to end clients.)

In the sense of where bcp38 should be applied? I agree that it should be POSSIBLE, through some administrative means, to prove an entity does in fact own a given address range and to request the additional privilege of sending data as if it were from that range.

This would be how a non-ISP obtains an independent entity allocation and sets up multi-homing.

It's also how data-centers would allow a co-located server to do the same (and should require the same steps).

At the more backbone levels it should be possible to automatically determine IF ingress packets are from authorized sources. Failure to do this, and failure to respond in a timely manor to filtering invalid ingress, should result in 1) those packets being rejected (and visible rejection notices sent back) 2) if the issue persists, the source of that address being blocked /entirely/ from the Internet, as a non-administered system.

Grace time should likely depend on the severity of the issue (volume of problem traffic/load on the upstream filtering capacity).

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#12
post #7
post #5

Earlier quoted context omitted.

Is egress filtering really that egregious?

No, it's not. It's just time consuming. If you're a large ISP with several disconnected IP subnets, then it's hard to get right.

I don't follow. Seems to me that whatever program/firmware on the router knows where to send incoming packets must also be able to trivially check and filter the addresses of outgoing ones.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#13
post #10
post #7

Earlier quoted context omitted.

No, it's not. It's just time consuming. If you're a large ISP with several disconnected IP subnets, then it's hard to get right.

This is quite an over simplification but a large amount of the filtering, if placed close to the client, is a single line of config. "ip verify unicast source reachable-via rx" in the Cisco world.

This should be the default.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#14
post #2

>Let's take a deep breath and discuss why such large DDoS attacks are even possible on the modern internet. Because all traffic is treated at face value and not deep filtered and throttled according to some company's whims. Cloudflare wants to change this. Cloudflare wants centralization. Cloudflare wants blacklists.

They are not suggesting centralization. They are suggesting bcp38 [0] This comes up quite often and people argue back and forth why they (the ISP's) can't or won't do this. Bcp38 simply requires ISP's to egress filter out IP traffic that does not belong to them. [0] - https://tools.ietf.org/html/bcp38

[deleted]

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#15
post #5
post #2

>Let's take a deep breath and discuss why such large DDoS attacks are even possible on the modern internet. Because all traffic is treated at face value and not deep filtered and throttled according to some company's whims. Cloudflare wants to change this. Cloudflare wants centralization. Cloudflare wants blacklists.

Is egress filtering really that egregious?

Nope, not in the age of software defined networks. It's crazy to me this is still a problem. I worked at an ISP and VPS provider years ago on a tiny engineering team. We employed anti-spoofing at multiple layers; from the hypervisor out to the edge. It's usually just an extra line in a much larger, more complicated network config. In fact, if I were ranking the networking challenges from most to least mental cycles it would be near the bottom.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#16
Your incumbent won't do filtering. Your incumbent won't maintain proper 'route' objects https://www.ripe.net/manage-ips-and-asns/db/support/managing... Your shoestring independent ISP won't to that either. Who is left? Tier1 ISP and some of them do BCP38 filtering sometimes on some ports.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#18

Are there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, on the server side, BGP hijacking and anycast routing are enabled by the same bug or feature, depending how you look at it.

There’s one reason I could think of. Combining two Internet lines together to get a faster connection. I blogged about this a few years back

https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmet...

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#20
post #5
post #2

>Let's take a deep breath and discuss why such large DDoS attacks are even possible on the modern internet. Because all traffic is treated at face value and not deep filtered and throttled according to some company's whims. Cloudflare wants to change this. Cloudflare wants centralization. Cloudflare wants blacklists.

Is egress filtering really that egregious?

[deleted]
Post reply on HN