<html><head/><body><html><head></head><body>Roland, I'm not asking that source address validation be hardwired. Merely the default. I don't think any of us want new operators forwarding packets even in disconnected networks if they don't understand these issues. Let the default for new routers be s.a.v. and I don't expect much trouble. Leave the default as is and I'll expect linear trouble with growth. Paul<br><br><div class="gmail_quote">"Dobbins, Roland" <rdobbins@arbor.net> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre style="white-space: pre-wrap; word-wrap:break-word; font-family: monospace; margin-top: 0px"><br />On Oct 26, 2012, at 12:48 AM, paul vixie wrote:<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">until cisco makes source address validation the default</blockquote><br />Unfortunately, neither Cisco nor any other network infrastructure vendor will do this absent some fundamental breakthrough in anti-spoofing mechanisms, because there are too many topological situations in which the primary existing mechanism (uRPF, ACLs) can induce overblocking.<br /><br /><hr /><br />Roland Dobbins <rdobbins@arbor.net> // <<a href="http://www.arbornetworks.com">http://www.arbornetworks.com</a>><br /><br /> Luck is the residue of opportunity and design.<br /><br /> -- John Milton<br /><br /><hr /><br />dns-operations mailing list<br />dns-operations@lists.dns-oarc.net<br /><a
href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br />dns-jobs mailing list<br /><a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a><br /></pre></blockquote></div><br>
-- <br>
Sent from my Android phone with K-9 Mail. Please excuse my brevity.</body></html></body></html>