What are the reasons this has been so difficult? It seems like this must have been desirable for decades. Is the config of internal and external just tricky? Does some legitimate traffic use this so it's difficult to get everyone to switch to alternatives?
There are some incentive misalignments. Each AS that configures it is doing it to protect its neighbors, and does not benefit from itself having configured this way. Best practice suggestions only go so far.
Another aspect is, if you configure it not just with your own prefixes but also that of your peers and downstreams (and their downstreams etc), then you need a source of ground truth. (Remember that not all ASes need to announce everything they have, all the time.) This is usually an out of band database. Then you have the problem of database needing to verify the truth, and keeping all the data fresh, etc.
If we can simply ask hosts to not send packets with spoofed source addresses, then surely we can just ask them not to send any DoS attacks in the first place?
Dunno, but somehow this just doesn't feel like such a realistic approach to me.
My read was that networks where traffic originates can and should prevent spoofing (edit: that is, prevent their own networks from sending spoofed traffic, not prevent others from spoofing their addresses) via egress filtering (per BCP38), whereas the stuff about FooCorp and CloudFlare is about transit/destination networks trying to prevent spoofing via ingress filtering. Did I misunderstand something?
I feel the same way, but I worry that ISPs won't ever change unless they're forced to. I'm starting to wonder if Google should just stop accepting (or start delaying?) traffic to or from ISPs that allow spoofed traffic. I mean it doesn't feel hard to test.
On the one hand I already avoid Google because they're getting uncomfortably large, but on the other hand I feel like it's going to take a company of Google's size to take a stand, or regulatory changes, before anything will change for the better here.
It worked for improving the SSL situation and for distrusting bad CAs, didn't it? Non-rhetorical question, it feels like it did to me.
Turns out that is not as true as you would think in practice.. you can reduce the search space significantly because of known IPv6 prefixes, EUI-64, a MAC address database and trying a few additional likely addresses such as ::1 ::fffe etc
Would they be publicly resolvable? And even if they are, how would you find the name? Wouldn't a lot of these machines be internal infrastructure of various companies?
https://blog.cloudflare.com/the-root-cause-of-large-ddos-ip-...
We will have amplification attacks as long as we have ISPs that permit (and benefit) from spoofing.