10,352 active botnets (was Re: register.com down sev0?

Jack Bates jbates at brightok.net
Thu Oct 26 21:38:49 UTC 2006

Matthew Crocker wrote:
>> Maybe the new slogan needs to be "Save the Internet! Train the chimps!"
> Shouldnt  'ip verify unicast source reachable-by rx' be a default 
> setting on all interfaces?  Only to be removed by trained chimps?

Only if you wish to break existing configurations during IOS upgrades. I could 
see ip verify unicast source reachable-by any (less breakage), but rx will kill 
all types of good asymmetric routing. The largest breakage I have seen caused by 
rx is the link IP breakage caused by the router responding out multiple 
interfaces. It's also a problem when customers are straddling the fence, 
purposefully using asymmetric routing.

It would be nicer to have router support where a packet is acceptable if it's 
network is acceptable in the BGP (or IGP) policy/filter (ie, network may not be 
there, but it is allowed) as well as the link addresses associated with the BGP 
(or IGP) peer.


More information about the NANOG mailing list