1

I've read that many networks use ingress/egress filtering to eliminate the number of spoofed UDP packets sent and received by their network.

Given that network provides have been much more diligent in restricting the amount of spoofed UDP packets sent and received by their networks, is it possible to send a UDP packet with a spoofed header that is drastically different than it's actual IP address?

Besides blocking spoofed packets from leaving their networks, in which other ways can network providers ensure that they are not passing along or sending spoofed UDP packets?

2

It's hard to address the degree of diligence of providers in blocking spoofed packets as there's a huge degree of variability out there. It is safe to say that it's still very possible to successfully send such packets from lots of places as the continued prevalence of certain types of DoS attacks attests.

In practice the most common mechanism of blocking spoofed traffic is the use of unicast RPF checking. This basically causes a given interface to drop packets sourced from an address that isn't reachable by that interface (validating the packet based on the return route, in other words).

uRPF is a good mechanism in general but tends to lose effectiveness the further from the edge the point of enforcement moves. Applied against an individual customer advertising a couple of /24's? Great. Applied against a peering connection with a few thousand routes? Could be ok, but can start to falter in bigger/more complex environments. Against a transit link with 600K routes? Almost useless. The other problem - paradoxically - is that it's a somewhat expensive feature to implement in hardware and tends not to be as commonly found on cheaper edge ports.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.