Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"Source Address Validation and BCP-38." ISPs should validate the source address of UDP traffic from their end customers. This would end most UDP based volumetric DDoS attacks.


It would help reflection attacks that direct e.g. DNS responses to the target. It wouldn't help when the DNS servers themselves are the target.


No it would help because instead of giving up on tracing the attacks since the source address was spoofed, you would know who was spamming packets and get them black holed.


The OP says that IP addresses were "randomly distributed" over IPv4 space. That's very unlikely for non-spoofed botnet addresses.


The botnet would still be able to perform an attack of the same size. And with many validation schemes it would still be able to randomize the last octet or two, avoiding direct identification of compromised computers.


Yes, but for a volumetric attack, it doesn't matter if you know the source IPs. It just fills your pipes until legitimate traffic can't get through. (This wasn't a volumetric attack though, which is why it would have helped.)


But most volumetric attacks are reflection attacks, which would be impossible if BCP-38 were implemented everywhere. Direct non-reflection volumetric attacks of significant magnitude (say above 40Gbps) are almost non-existent.


It would make filtering out malicious requests easier, which would improve performance for people whose machines weren't botnetted.


In this case, yes, and it would also reduce load on the servers quite a bit. But in a volumetric attack, your pipe is full already. Any filtering you apply after that can only weed out bad traffic; you can't fit any more good traffic in there.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: