myITmicroblog

Some time ago I sent question to EU about DOS/DDOS protection because I believe ISPs could do a bit more to protect us: Dear Sirs, I found you are responsible of creating safe, reliable Internet. As you know most of EU companies already had or they will have problems with hackers. One of the attacks is commonly known as Denial of Service Attack or Distributed Denial of Service Attack (DOS, DDOS). 15 years ago one document was published, knows as Best Current Practice 38 (BCP 38 or RFC 2267). I don't know why it has not been widely implemented by ISPs during last 15 years. They complained it is very time consuming and difficult to manage. Let me explain how it works: - every company or home user has IP address or range of IP addresses allocated by ISP (for example 7.7.7.7) - every edge router is managed by the same ISP who allocates these IP addresses - BCP 38/RFC 2267 says: block any traffic from network (company or home) where source IP is different fro...

I would like to talk about defeating DDOS and scenarios how we can actually use it. Let’s get started ! I’m going to talk about two methods: 1) before you forward any packet, check if you know the return path. If you know, forward the packet, if you don’t – drop it. There are two ways of implementation: strict and loose. First one accepts packets only when the return path is through the interface which is the ingress one. The second one accept any packet if the router has the return path via any interface. As you can see you can’t use this solution for transit or multihomed networks. It should be rather singlehomed, stub network. During DDOS attackers spoof a source IP and the solution will work (packets will be dropped) only for those with invalid source IP addresses. If the source IP is a valid, the packet will be forwarded. 2) edge router checks if the source IP is the one, which is allocated for particular ISP client – this is the best, easiest for single homed ...