Re: [rtcweb] UDP transport problem

On 14 Feb 2014, at 16:46, cowwoc <cowwoc@bbs.darktech.org> wrote:

> On 14/02/2014 9:42 AM, Cb B wrote:
>> Right. The source port will be a function of the amp server such as 53, 123, 19... all very common. The destination port is of the spoofers choosing.
>> But, as the us-cert advisory notes, there are several impacted appilication ports. Well-known webrtc fixed ports would help for a white list.
>> 
>> Creating a blacklist of just 53, 123, 19 makes us still behind the curve on whatever is next.
>> 
> 
> Which is why we will never be able to stop DDoS attacks:
> With dumb firewall rules that rely upon port numbers alone.
> Unless the destination address is able to communicate back to the source (or as close as possible to the source) that it does not wish to continue receiving (any) packets from it, and in so doing pushes the problem back as far as possible to the source.

I don't agree, when we set up an ISP in the '90s we had egress filter rules that dropped any packets with From address that were not
routed as 'inside' our network.

At the time we were told to drop that (along with a pile of other security features which are slowly returning). 
I see no reason why anyone would peer with an ISP that refused to do that.

(We now return to your #rtcweb program).

T.

> Gili
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb

Tim Panton - Web/VoIP consultant and implementor
www.westhawk.co.uk