Why don't ISPs filter on source address to prevent spoofing?

Question

I'm under the impression that if all the ISP's were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably.

• Are any ISPs implementing this practice?
• Should they?

Answer 1

One of the main issues is with fast switching at the core routing level. A long time ago when I was a Cisco Engineer, the cisco core routers could fast switch very effectively and provide minimal latency, but if you wanted to source filter then this would turn off fast switching and add hugely to the latency - No ISP is going to be willing to have multiple seconds of latency when they like small numbers in the millisecond region.

One of the other issues can be around encapsulation - For example,if you are using an MPLS routed networks then you were unable to see inside of the packet to conduct source filtering.

Hope this helps.

Answer 2

Basic answer: cost. Doing so does nothing to protect their own network but does add additional cost in the form of maintenance overhead, and routing overhead. Because spoofed addresses outgoing won't really affect them, there is

Answer 3

Some ISP's are starting to come to the conclusion that preventing spoofing will save them money in the long term. We find them now starting to lump anti spoofing along with anti DDoS in terms of things which will cost them money in the short term, but will lighten their network load and be able to be sold as value add in the longer term.

The infrastructure and team required to configure this is where the main cost lies. There would have to be analysis as to which addresses might be required for valid spoofing (although this could be much less of an issue in reality) and the effort required to configure and maintain every router (or at least those at the edge) is pretty high.

It potentially becomes more of a challenge (just in terms of scale) with IPv6, as IPv4 will also be around for a long time.

Probably makes more sens for them to ignore IPv4 anti-spoofing, and start to build it into their v6 edge rollout.

Answer 4

IP traceback is a name given to any method for reliably determining the origin of a packet on the Internet. Since the source IP address of a packet is not authenticated. The problem of finding the source of a packet is called the IP traceback problem. IP Traceback is a critical ability for identifying sources of attacks and instituting protection measures for the Internet. There are number of techniques proposed most popular are

1. Probabilistic packet marking: probabilistically marking packets as they traverse routers through the Internet. The router mark the packet with either the router’s IP address or the edges of the path that the packet traversed to reach the router.
2. Deterministic packet marking: this technique attempt to put a single mark on inbound packets at the point of network ingress. Their idea is to put, with random probability of .5, the upper or lower half of the IP address of the ingress interface into the fragment id field of the packet, and then set a reserve bit indicating which portion of the address is contained in the fragment field. By using this approach they claim to be able to obtain 0 false positives with .99 probability after only 7 packets.