3

What are valid usages? Why don't ISPs prevent this by default? Do any major ISPs do this already?

Improve this question
10
  • Whatever anti-spoofing firewall policy is in place is a matter of good culture. Many devices allow spoofing by default without explicit policy.
    – Aria
    May 6, 2017 at 13:39
  • I was referring to ISPs not end devices. My ISP assigned me one IP address if someone takes over my router it should be impossible to spoof the source IP.
    – Meir Maor
    May 6, 2017 at 15:13
  • 3
    Apparently this mechanism is called egress filtering (out-bound filtering). This blog post discusses the problem, and this Hacker News thread discusses that blog post.
    – Nat
    May 6, 2017 at 15:56
  • 1
    @Nat Yes, the technical term is egress filtering. (You can do ingress filtering too, but then you can only filter out traffic which claims to come from your own netblocks but doesn't come from the corresponding places, which isn't very useful.) This may get better answers on Network Engineering than here.
    – user
    May 6, 2017 at 17:52
  • 1
    @schroeder obviously at least a significant portion of ISPs do not, or we wouldn't see so many botnets doing DDOS using spoofed IPs
    – Meir Maor
    May 6, 2017 at 19:49

2 Answers 2

Reset to default
2

There is a proposal known as BCP38 that has existed for a while (http://www.bcp38.info/index.php/Main_Page) which is based on RFC 2827 (https://www.rfc-editor.org/rfc/rfc2827)

The RFC proposes that ISPs block traffic coming into their network with source IPs that are not registered to come from the devices passing the traffic along. There are a lot of details to this, but in short there's a protocol known as Border Gateway Protocol (BGP) which has routers on the edge of an ISPs network broadcast which IP ranges they can route traffic for. When one ISP connects their network to another ISP (known as peering) they share this routing information. Because this information is known and shared, it's easy to detect when traffic contains spoofed IPs because that connected network doesn't advertise that they route traffic for those IPs, hence it can be blocked.

The problem is that ISPs don't generally implement this because (they claim) it costs them too much in resources to perform the extra analysis of the packets to determine whether it's spoofed. This is why it's still possible to spoof IPs. I believe there are some ISPs that do implement but not all do.

Even if ISPs implemented it, you can still spoof IPs as long as they are in the proper IP ranges for which the ISP broadcasts that it can route for. While it's more limited, that range can still be quite large.

Improve this answer
1

In addition to the technical answer Michael has provided, I'd provide an economic one.

In short, egress filtering is what economists call a "negative externality". Briefly, a negative externality is where the cost goes to a different entity than the gain. In this case the cost is to the ISPs, and provides little or nothing to them in return. The benefit happens to the internet at large, and only happens when almost every ISP in the world does it.

It's worth mentioning again that the benefit would only be gained if a very large portion of ISPs implemented this. The global nature of the internet makes this very unlikely. If implementation isn't nearly universal, then attackers only need find one ISP that doesn't do egress filtering.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .