Lazy Engineers and Viable Excuses

Tue Aug 26 15:39:28 UTC 2003

On dinsdag, aug 26, 2003, at 17:03 Europe/Amsterdam, Leo Bicknell wrote:

> Now, the customer, over their two T1 transit circuits does the
> following:

> as-path access-list 1 deny .*

> neighbor verio filter-list 1 in

> ip route 0.0.0.0 0.0.0.0 sprint

> Should the customer have to register a route with Sprint to make
> this work?  How does UUNet, who only received a route from Verio,
> know incoming packets from Sprint aren't spoofed?

You're not saying anything about outgoing route advertisements here so 
these questions are unanswerable.

My position is that if you want to use certain source addresses, you 
should announce and register the route that goes with those addresses. 
Expecting the whole world to forego uRPF just because that makes your 
life easier isn't realistic.

However, maybe we're spending too much effort on the whole source 
address spoofing issue, as stopping this doesn't really solve the core 
problem, which is how to shut up undesired incoming traffic.

Looking up the unspoofed source address in a registry and then email or 
phone the listed contact isn't exactly a sure fire way to do this.

> <mime-attachment>

Why???