2

I'm trying to understand why source-address RTBH needs to be coupled with configuring uRPF on the edge ports.

I've read RFC5635 and other vendor papers on this topics but I can't figure out the reason, perhaps I'm missing something obvious.

Why would S/RTBH not work without uRPF? The trigger router would advertise the source-address that needs to be blocked with a specific "evil" community and based on this community the edge routers would install a next-hop of discard. So the source-address would be blocked anyway, so why the need for uRPF?

Many thanks,

Cristian

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:26
4

Router can't advertise "source address". When you see some prefix in RIB, router talks about destination as opposed to source. In case of S/RTBH packet from specific source should be dropped. uRPF checks whether source of the packet is reachable via some interface except "null" one.

S/RTBH technique uses null routes along with uRPF. So if detected source of the DoS attack is reachable via "null" device, and packet from that source comes through interface with uRPF configured, uRPF check will fail and packet will never reach destination. On the other hand all the healthy packets will be permitted by uRPF check.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.