Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm under the impression that if all the ISPs were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably.

  • Are any ISPs implementing this practice?
  • Should they?
share|improve this question
up vote 5 down vote accepted

One of the main issues is with fast switching at the core routing level. A long time ago when I was a Cisco Engineer, the cisco core routers could fast switch very effectively and provide minimal latency, but if you wanted to source filter then this would turn off fast switching and add hugely to the latency - No ISP is going to be willing to have multiple seconds of latency when they like small numbers in the millisecond region.

One of the other issues can be around encapsulation - For example,if you are using an MPLS routed networks then you were unable to see inside of the packet to conduct source filtering.

Hope this helps.

share|improve this answer
In a perfect world ISPs would enforce filtered packets prior to accepting them from a customer.... or a technology analogous to fast switching would apply to the sender. – LamonteCristo Dec 14 '10 at 15:32

Some ISP's are starting to come to the conclusion that preventing spoofing will save them money in the long term. We find them now starting to lump anti spoofing along with anti DDoS in terms of things which will cost them money in the short term, but will lighten their network load and be able to be sold as value add in the longer term.

The infrastructure and team required to configure this is where the main cost lies. There would have to be analysis as to which addresses might be required for valid spoofing (although this could be much less of an issue in reality) and the effort required to configure and maintain every router (or at least those at the edge) is pretty high.

It potentially becomes more of a challenge (just in terms of scale) with IPv6, as IPv4 will also be around for a long time.

Probably makes more sens for them to ignore IPv4 anti-spoofing, and start to build it into their v6 edge rollout.

share|improve this answer

Basic answer: cost. Doing so does nothing to protect their own network but does add additional cost in the form of maintenance overhead, and routing overhead. Because spoofed addresses outgoing won't really affect them, there is

share|improve this answer
+1 for antici..... – Scott Pack Dec 9 '10 at 21:51

IP traceback is a name given to any method for reliably determining the origin of a packet on the Internet. Since the source IP address of a packet is not authenticated. The problem of finding the source of a packet is called the IP traceback problem. IP Traceback is a critical ability for identifying sources of attacks and instituting protection measures for the Internet. There are number of techniques proposed most popular are

  1. Probabilistic packet marking: probabilistically marking packets as they traverse routers through the Internet. The router mark the packet with either the router’s IP address or the edges of the path that the packet traversed to reach the router.
  2. Deterministic packet marking: this technique attempt to put a single mark on inbound packets at the point of network ingress. Their idea is to put, with random probability of .5, the upper or lower half of the IP address of the ingress interface into the fragment id field of the packet, and then set a reserve bit indicating which portion of the address is contained in the fragment field. By using this approach they claim to be able to obtain 0 false positives with .99 probability after only 7 packets.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.