RE: [RPSEC] Re: draft-convery-bgpattack-00

At 6:04 PM +0100 11/9/02, Iljitsch van Beijnum wrote:
>On Fri, 8 Nov 2002, Stephen Kent wrote:
>
>>  >Source address filtering can be done in other places than just the
>>  >customer edge. It is possible to do this on peering interfaces as well,
>>  >if done with care. Unfortunately, it can't be done on transit
>>  >interfaces. So the tier-1 ISPs (who get all their traffic from peering)
>>  >should step up to the plate and start doing this to protect the rest of
>>  >us.
>
>>  I realize that one can filter other than at the edge, but it gets
>>  harder to do it the further one goes away from the edge, with transit
>>  interfaces being the agreed upon limiting case. Your last sentence
>>  conflicts with my observation about the undesirability of relying on
>>  others to protect you, as far as security goes.
>
>>  Its somewhat analogous to living in an apartment building; you can
>>  lock your own door to keep out unwanted visitors, or you can rely on
>>  all your fellow apartment dwellers to not loose their keys and to not
>>  buzz in bad visitors.
>
>You should be able to rely on the door man to keep people out who are
>recognizable as undesirable elements. After all, that's what you pay
>for.
>
>We all (directly or indirectly) pay the tier-1 networks so it is
>reasonable to ask them to do anti-spoofing filtering on their peering
>interfaces, for the exact reason you mention: expecting all ISPs to
>filter their customers is the short road to disappointment.

Amsterdam must be a more civilized place than most major U.S. cities :-)

Most apartment complexes here do not have doormen. The "undesirable 
elements" can and do gain entrance by "buzzing" apartments randomly 
in hopes someone will let them in, or by following in legitimate 
residents (tailgating), showing up dressed as a delivery person, etc. 
So, we have adopted a more defensive posture and assume the need to 
secure entrance to individual apartments as the responsibility of the 
residents.

Steve
_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec