RE: [RPSEC] Re: draft-convery-bgpattack-00

[Iljitsch van Beijnum <[e-mail]>]

On Fri, 8 Nov 2002, Stephen Kent wrote:

> >Source address filtering can be done in other places than just the
> >customer edge. It is possible to do this on peering interfaces as well,
> >if done with care. Unfortunately, it can't be done on transit
> >interfaces. So the tier-1 ISPs (who get all their traffic from peering)
> >should step up to the plate and start doing this to protect the rest of
> >us.

> I realize that one can filter other than at the edge, but it gets
> harder to do it the further one goes away from the edge, with transit
> interfaces being the agreed upon limiting case. Your last sentence
> conflicts with my observation about the undesirability of relying on
> others to protect you, as far as security goes.

> Its somewhat analogous to living in an apartment building; you can
> lock your own door to keep out unwanted visitors, or you can rely on
> all your fellow apartment dwellers to not loose their keys and to not
> buzz in bad visitors.

You should be able to rely on the door man to keep people out who are
recognizable as undesirable elements. After all, that's what you pay
for.

We all (directly or indirectly) pay the tier-1 networks so it is
reasonable to ask them to do anti-spoofing filtering on their peering
interfaces, for the exact reason you mention: expecting all ISPs to
filter their customers is the short road to disappointment.

_______________________________________________
RPSEC mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/rpsec