Subject: Re: What to improve? BCP-38/SAC-004 anyone?
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
Content-Type: text/plain; charset=utf-8
From: Jared Mauch <jared@puck.nether.net>
In-Reply-To: <16726.1451602892@obiwan.sandelman.ca>
Date: Thu, 31 Dec 2015 19:17:59 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <4CB46486-1B4C-480D-BC98-DAE90C32D9FC@puck.nether.net>
References: <7664F94E-F7A6-4556-B1E6-2DE536A7B7FC@frobbit.se>
 <5684FCDB.7010009@mnt.se>
 <A074CA07-691E-41A7-B1D7-33F4ECBED5A9@puck.nether.net>
 <568579FB.6030702@gmail.com> <16726.1451602892@obiwan.sandelman.ca>
To: Michael Richardson <mcr+ietf@sandelman.ca>
Archived-At: <http://mailarchive.ietf.org/arch/msg/ietf/LEeKU8bWRlWjQEQobcqbVJqO4NE>
Cc: ietf@ietf.org
Precedence: list


> On Dec 31, 2015, at 6:01 PM, Michael Richardson =
<mcr+ietf@sandelman.ca> wrote:
>=20
>=20
> Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
>> That seems worth a bit more discussion. I'd always naively assumed =
that BCP38 was
>> scalable since all it appears to need is a prefix match, and routers =
are very
>> good at matching prefixes; it's just that they don't normally match =
the source
>> prefix. Could some router-vendor person comment on this?
>=20
> It's also really really really cheap to do in the CMTS or PPP =
concentrator,
> where for IPv4, it's often not even a "prefix" machine, but a /32 =
match.
>=20
> IPv6 with PD makes it potentially a list...

These often aren=E2=80=99t the devices that are a problem.  The majority =
of cable/DSL
networks do not permit spoofing.  There are external ways to measure =
this with
traceroute and data from things like the OpenResolverProject stuff which =
I worked
on.

I can get a $5/mo server or a $2/mo so-called-booter service to launch =
attacks from.

What I often need are better tools to trace back spoofed packets or mark =
them.  The
nice thing about most of these attack networks is they respond faster =
than I can trace
and most attacks we see are sub-15 minutes.  The incentives are all =
wrong here and
I=E2=80=99d love to talk to people about how to change them.  Some =
locations, eg: Finland
have a regulator that does not accept spoofing from the entities they =
supervise.

It=E2=80=99s one approach, but perhaps doesn=E2=80=99t scale to other =
markets.

- Jared=