5

BCP38 is a network security standard which has the scope to prevent spoofing the source of DDOS attacks. The main idea is that the ISP shouldn't forward traffic which is not coming from it's network range.

My question is: Is it enough to prevent massive DDOS attacks?

1
  • 1
    Not enough, but at least it'll make locating the attack's source faster. Oct 27, 2016 at 17:12

2 Answers 2

4

There are multiple types (or methods to achieve) of DDoS attack likes -

  • ICMP flood
  • P-to-P attack
  • SYN Flood
  • DNS Amplifications attack
  • And many more

Some types of attack are possible through spoofing of source ip addresses (like DNS amplification, Syn flood, ICMP flood and others). Attacks which can be achieved through UDP protocol can be done through spoofing while for those where TCP 3-way handshake needs to be completed, can't be achieved through spoofing.

My question is: Is it enough to prevent massive DDOS attacks?

BCP 38 can only stop spoofing attacks. It can't protect the victim against TCP based attacks. DDoS attack on Dyn (on 21st October) was done through IoT devices, which was not a spoofed type attack.

In a nutshell, if BCP38 get implemented in all the ISP across whole world, then DDoS attack will not going to be easy to launch against the victims.

P.S. -- BCP38 is implemented in my organisation (i works for one of the largest ISP of my country).

1
  • You keep using code formatting for highlighting. As you can see, it produces problems. Please stop!
    – schroeder
    Oct 29, 2016 at 16:19
10

There are types of DDOS attacks which don't use source spoofing and where thus BCP38 does not help. For example the current IoT based DDOS attacks against Dyn, OVH, etc did not use source spoofing at all. Also, DDOS by employing the Slashdot Effect does not make use of spoofed addresses either.

Spoofed addresses are instead mainly used in amplification attacks which is only one of the techniques for DDOS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .