6

BCP38 is a network security standard which has the scope to prevent spoofing the source of DDOS attacks. The main idea is that the ISP shouldn't forward traffic which is not coming from it's network range.

My question is: Is it enough to prevent massive DDOS attacks?

  • 1
    Not enough, but at least it'll make locating the attack's source faster. – André Borie Oct 27 '16 at 17:12
4

There are multiple types (or methods to achieve) of DDoS attack likes -

  • ICMP flood
  • P-to-P attack
  • SYN Flood
  • DNS Amplifications attack
  • And many more

Some types of attack are possible through spoofing of source ip addresses (like DNS amplification, Syn flood, ICMP flood and others). Attacks which can be achieved through UDP protocol can be done through spoofing while for those where TCP 3-way handshake needs to be completed, can't be achieved through spoofing.

My question is: Is it enough to prevent massive DDOS attacks?

BCP 38 can only stop spoofing attacks. It can't protect the victim against TCP based attacks. DDoS attack on Dyn (on 21st October) was done through IoT devices, which was not a spoofed type attack.

In a nutshell, if BCP38 get implemented in all the ISP across whole world, then DDoS attack will not going to be easy to launch against the victims.

P.S. -- BCP38 is implemented in my organisation (i works for one of the largest ISP of my country).

  • You keep using code formatting for highlighting. As you can see, it produces problems. Please stop! – schroeder Oct 29 '16 at 16:19
10

There are types of DDOS attacks which don't use source spoofing and where thus BCP38 does not help. For example the current IoT based DDOS attacks against Dyn, OVH, etc did not use source spoofing at all. Also, DDOS by employing the Slashdot Effect does not make use of spoofed addresses either.

Spoofed addresses are instead mainly used in amplification attacks which is only one of the techniques for DDOS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.