Source address validation (was Re: UUNet Offer New Protection Against DDoS)

Sun Mar 7 01:27:07 UTC 2004

--On 06 March 2004 18:39 -0500 Sean Donelan <sean at donelan.com> wrote:

> Source address validation (or Cisco's term uRPF) is perhaps more widely
> deployed than people realize.  Its not 100%, but what's interesting is
> despite its use, it appears to have had very little impact on DDOS or
> lots of other bad things.
...
> But relatively few DDOS attacks use spoofed
> packets.  If more did, they would be easier to deal with.

AIUI that's cause & effect: the gradual implementation of source-address
validation has made attacks dependent on spoofing less attractive to
perpetrators. Whereas the available of large pools of zombie machines
has made the use of source spoofing unnecessary. Cisco et al have shut
one door, but another one (some suggest labeled Microsoft) has opened.

Those with long memories might draw parallels with the evolution of
phreaking from abuse of the core, which became (reasonably) protected
to abuse of unprotected PABXen. As I think I said only a couple of days
ago, there is nothing new in the world.

Alex