How to protect registered IP addresses

Thu Mar 13 02:19:58 UTC 1997

On Thu, Mar 13, 1997, 3:39:29 AM PST George Herbert wrote:

>
>I believe you can just deny by default and allow traffic from the
>registered address blocks under each interface, on incoming interfaces
>at your central router (and sub-routers).  Nice short list.
>
>-george william herbert
>gherbert at crl.com
>

This is obviously better then nothing, and probably the most practical
solution, but most networks have holes in their allocated blocks.  
Wouldn't some sort of authentication scheme (RADIUS/TACACS
or maybe Kerbros) be a better solution?  More complicated for sure. 

The idea would be to check the connection request to the outgoing router
against some sort of database, then expiring the token after it's use.  The 
real trick to this is checking only the initial request.  Something more in the
realm of switching authentication...

Anyone have any ideas how something as large as a class B with say 30% address
utilization on scattered addresses (non-contigeous) could be rapidly verified
without checking every packet?

Thanks for your indulgance,

Chris Cook
Network Engineer
__________________________________________________________________________
Net Asset Network Operations Center
1315 Van Ness Ave., Suite 103
Fresno CA 93721
209/225-0222