Subject: [DNSOP] Re: I-D ACTION:draft-ietf-dnsop-reflectors-are-evil-03.txt

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 5 Mar 2007 11:53:26 +0100

>   It's not excessive to repeat that, although recommended
>   configurations described in this document could alleviate the
>   problem, the only solution to source address spoofing problems is
>   the wide-scale deployment of Ingress Filtering to prevent use of
>   spoofed IP addresses [BCP38], [BCP84].

Not only it *is* excessive (four mentions in a small I-D) but it is
not true since there is no notice in the I-D that BCP-38 does not
prevent intra-provider spoofing.

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 5 Mar 2007 11:53:26 +0100

---

From: Mark Andrews <[email-masked]>
Date: Mon, 05 Mar 2007 23:35:02 +1100

> prevent intra-provider spoofing.

	I don't know may providers that have their network implemented
	as a single broadcast domain.  BCP-38 can equally be applied
	inside a network as at the borders.  In fact it is easier
	to do it if is applied inside the network.  The border filters
	then protect the rest of the net from router compromise.

	BCP-38 may not stop all spoofing but it will localize the
	source of spoofed traffic.
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Mon, 05 Mar 2007 23:35:02 +1100

---

From: Joe Abley <[email-masked]>
Date: Mon, 5 Mar 2007 08:35:16 -0500

> prevent intra-provider spoofing.

If it doesn't, then the problem is the definition of a provider's  
border, not in BCP 38.

Joe

---

From: Joe Abley <[email-masked]>
Date: Mon, 5 Mar 2007 08:35:16 -0500

Joe