RE: [RPSEC] Re: draft-convery-bgpattack-00

[Iljitsch van Beijnum <[e-mail]>]

On Fri, 8 Nov 2002, Stephen Kent wrote:

> There is a difference between approaches to security that rely on
> other ISPs to do the right thing, and approaches that let you know if
> other ISPs are doing the right thing. S-BGP falls into the latter
> category and thus is more resistant to benign failures and attacks
> against internal ISP route management components or procedures, vs.
> schemes that rely on ISPs doing local source address filtering, for
> example.

Source address filtering can be done in other places than just the
customer edge. It is possible to do this on peering interfaces as well,
if done with care. Unfortunately, it can't be done on transit
interfaces. So the tier-1 ISPs (who get all their traffic from peering)
should step up to the plate and start doing this to protect the rest of
us.

Iljitsch

_______________________________________________
RPSEC mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/rpsec