"general badness" AS-based reputation system
mysidia at gmail.com
Sun Sep 25 23:31:42 UTC 2011
On Sun, Sep 25, 2011 at 10:37 AM, Gadi Evron <ge at linuxbox.org> wrote:
> In my opinion, third-party security based AS-reputation systems will
> eventually become de-facto border filtering systems for ISPs, but that day
> is still not here, as that is still socially unacceptable in our circles,
> and will remain so until it becomes _necessary_.
Sorry... what makes you think the problem with use of a
AS-reputation systems is
social and not technical?
IP packets are not stamped with the numbers of any of the AS they
transitted to reach your network.
The IP protocol simply does not expose AS number information,
therefore, for filtering purposes,
you don't actually have the information....
It's difficult to justify a complex AS-reputation system that would
effectiveness, and really, is little better than other reputation
(such as source address blacklisting)
More information about the NANOG