Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Aka strict rpf which none of the Tier1 does


For very good reason. Legitimate routing is often asymmetric and applying this rule would block a large percentage of Internet traffic.


Doesnt matter if its asymmetrtic or not. You should not be allowed to send egress from prefixes that dont belong to you and that you dont advertise to your upstream. Thats what strict rpf is for. Else you are spoofing.


Can you elaborate a little?

I mean any ISP can check if a packet leaving their network is actually a network they have under their control, routing doesn't have anything to do with that?


End ISPs can. If you're an ISP supplying internet service to a business you can and should block source addresses that don't belong to that business, on that business's line.

It doesn't work in the "Internet core". If you're Verizon and you got a packet from Comcast that says it's originally from Cogent, how do you validate that? This router that happens to be checking the packet prefers to send packets to Cogent via Sprint, but that doesn't mean Cogent also prefers to send packets to you via Sprint. Each router can have a different preference, too. (Example scenario only)


Ah I was only thinking hosting providers/consumer ISP yes, not transit parties. But then they aren't also the source imho. It would help already quite a bit if the parties that can, do the source checking.

I think many providers now also limit UDP which might become an issue when http/3 gets more adopted.


Tier 1 providers means the Internet backbone. These are the networks whose core business is interconnecting the whole world. Think Level 3 and Hurricane Electric. It makes zero sense for a Tier 1 provider to deploy reverse route filtering.

(Tier 2 providers are those with lots of interconnections, but not the whole world, just regionally. Tier 3 providers are those who just buy wholesale internet service from another provider and don't have many if any other interconnections.)

No sane provider restricts UDP. You might be thinking of one of the more obscure protocols like SCTP.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: