Subject: RE: Need your opinion of this.

From: "Turk, Doughan A." <[email-masked]>
Date: Fri, 26 Jul 2002 22:18:48 -0400

The draft does not suggest a way of verifying reverse path or validating
source address. My comment was just an answer to Sri's questions. BGP is the
only routing protocol I can think of with the capabilities to do what the
draft suggests. More information about the draft can be found at
http://www.ietf.org/internet-drafts/draft-turk-ertb-00.txt

DT

-----Original Message-----
From: Justin Fletcher [mailto:[email-masked]] 
Sent: Friday, July 26, 2002 9:11 PM
To: Turk, Doughan A.
Cc: [email-masked]
Subject: RE: Need your opinion of this.

On Fri, 2002-07-26 at 18:24, Turk, Doughan A. wrote:
> I am using BGP to help stopping DoS and DDoS traffic. BGP can send 
> updates quickly and route-maps can translate communities to stop 
> traffic destined to a certain destination. TCP is not the issue here. 
> Attackers usually relay on the fact that most routers out there do 
> destination based routing without checking the validity of the source 
> address in case it is spoofed.
> 
> DT
> 

Is BGP the place to do this?  Note this section from RFC1812:

5.3.8 Source Address Validation
   
   A router SHOULD IMPLEMENT the ability to filter traffic based on a
   comparison of the source address of a packet and the forwarding table
   for a logical interface on which the packet was received.  If this
   filtering is enabled, the router MUST silently discard a packet if
   the interface on which the packet was received is not the interface
   on which a packet would be forwarded to reach the address contained
   in the source address.  In simpler terms, if a router wouldn't route
   a packet containing this address through a particular interface, it
   shouldn't believe the address if it appears as a source address in a
   packet read from this interface.

--
Justin Fletcher
Proficient Networks, Inc.

---

From: PamSri <[email-masked]>
Date: Sat, 27 Jul 2002 08:18:47 -0700 (PDT)

Hi Turk ,
            Here are a few more questions :
1. Is DoS a problem specific to BGP or the box ? 
2. So do we provide this kind of solution to all the routing protocols.         
3. Here's what i think : DoS, Anti-Spoofing, Firewalls etc.. can be catagorized as IP Services. Do we want to bring these concepts into IP routing ?
4. There are vendors who provide these IP Services along with routing by clearly making a distinction between these two concepts.
Regards,
sri
 "Turk, Doughan A." wrote:The draft does not suggest a way of verifying reverse path or validating
source address. My comment was just an answer to Sri's questions. BGP is the
only routing protocol I can think of with the capabilities to do what the
draft suggests. More information about the draft can be found at
http://www.ietf.org/internet-drafts/draft-turk-ertb-00.txt

DT

-----Original Message-----
From: Justin Fletcher [mailto:[email-masked]] 
Sent: Friday, July 26, 2002 9:11 PM
To: Turk, Doughan A.
Cc: [email-masked]
Subject: RE: Need your opinion of this.

---------------------------------
Do You Yahoo!?
Yahoo! Health - Feel better, live better